Paperback 
Elasticsearch Filebeat
Video Lecture
Description
I demonstrate how to setup a Filebeat service to read systemd logs.
Filebeat download instructions can be found at https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html#installation
I downloaded the debian package manager version.
1 2 | |
1 2 | |
1 | |
Enable a module for Filebeat to run.
Get a list.
1 | |
I enable the system module
1 | |
1 2 | |
You can also disable a module
1 | |
If you enable/disable a module, then restart Filebeat.
1 2 | |
Since my filebeat service is running on a different server on the internet, and my Elasticsearch server is IP restricted, I will need to add a new rule on my Elasticsearch server to allow my filebeat service to post data to it.
So on my Elasticsearch server, I get the iptables rules line numbers.
1 | |
I insert the new rule for my IP before the DROP rule.
1 | |
Persist changes.
1 | |
Now we can set up a new data source in Grafana, or modify the existing and test it using the explore tab.