- Filebeat Reference: other versions:
- Overview
- Getting Started With Filebeat
- Step 1: Installing Filebeat
- Step 2: Configuring Filebeat
- Step 3: Configuring Filebeat to Use Logstash
- Step 4: Loading the Index Template in Elasticsearch
- Step 5: Starting Filebeat
- Step 6: Loading the Kibana Index Pattern
- Quick Start for Common Log Formats
- Command Line Options
- Directory Layout
- Repositories for APT and YUM
- Running Filebeat on Docker
- Upgrading Filebeat
- How Filebeat Works
- Configuring Filebeat
- Modules
- Exported Fields
- Securing Filebeat
- Troubleshooting
- Migrating from Logstash Forwarder to Filebeat
WARNING: Version 5.6 of Filebeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
System module
editSystem module
editThis module collects and parses logs created by system logging server of common Unix/Linux based distributions.
Compatibility
editThis module was tested with logs from OSes like Ubuntu 12.04, Centos 7, and macOS Sierra.
This module is not available for Windows.
Dashboard
editThis module comes with a sample dashboard showing syslog data.

Syslog fileset settings
editvar.paths
editAn array of paths where to look for the log files. If left empty, Filebeat will choose the paths depending on your operating systems.
Fields
editFor a description of each field in the metricset, see the exported fields section.