- Auditbeat Reference: other versions:
- Overview
- Contributing to Beats
- Getting started with Auditbeat
- Breaking changes in 6.2
- Setting up and running Auditbeat
- Configuring Auditbeat
- Specify which modules to run
- Specify general settings
- Reload the configuration dynamically
- Configure the internal queue
- Configure the output
- Specify SSL settings
- Filter and enhance the exported data
- Parse data by using ingest node
- Set up project paths
- Set up the Kibana endpoint
- Load the Kibana dashboards
- Load the Elasticsearch index template
- Configure logging
- Use environment variables in the configuration
- YAML tips and gotchas
- Regular expression support
- auditbeat.reference.yml
- Modules
- Exported fields
- Monitoring Auditbeat
- Securing Auditbeat
- Troubleshooting
WARNING: Version 6.2 of Auditbeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Step 4: Set up the Kibana dashboards
editStep 4: Set up the Kibana dashboards
editAuditbeat comes packaged with example Kibana dashboards, visualizations,
and searches for visualizing Auditbeat data in Kibana. Before you can use
the dashboards, you need to create the index pattern, auditbeat-*, and
load the dashboards into Kibana. To do this, you can either run the setup
command (as described here) or
configure dashboard loading in the
auditbeat.yml config file.
This requires a Kibana endpoint configuration. If you didn’t already configure a Kibana endpoint, see configured Auditbeat
Make sure Kibana is running before you perform this step. If you are accessing a secured Kibana instance, make sure you’ve configured credentials as described in Step 2: Configure Auditbeat.
To set up the Kibana dashboards for Auditbeat, use the appropriate command for your system. The command shown here loads the dashboards from the Auditbeat package. For more options, such as loading customized dashboards, see Importing Existing Beat Dashboards in the Beats Developer Guide.
deb and rpm:
auditbeat setup --dashboards
mac:
./auditbeat setup --dashboards
win:
Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select Run As Administrator). If you are running Windows XP, you may need to download and install PowerShell.
From the PowerShell prompt, change to the directory where you installed Auditbeat, and run:
PS > auditbeat setup --dashboards