- Filebeat Reference: other versions:
- Overview
- Getting Started With Filebeat
- Step 1: Install Filebeat
- Step 2: Configure Filebeat
- Step 3: Configure Filebeat to use Logstash
- Step 4: Load the index template in Elasticsearch
- Step 5: Set up the Kibana dashboards
- Step 6: Start Filebeat
- Step 7: View the sample Kibana dashboards
- Quick start: modules for common log formats
- Repositories for APT and YUM
- Setting up and running Filebeat
- Upgrading Filebeat
- How Filebeat works
- Configuring Filebeat
- Specify which modules to run
- Configure inputs
- Manage multiline messages
- Specify general settings
- Load external configuration files
- Configure the internal queue
- Configure the output
- Load balance the output hosts
- Specify SSL settings
- Filter and enhance the exported data
- Parse data by using ingest node
- Set up project paths
- Set up the Kibana endpoint
- Load the Kibana dashboards
- Load the Elasticsearch index template
- Configure logging
- Use environment variables in the configuration
- Autodiscover
- YAML tips and gotchas
- Regular expression support
- HTTP Endpoint
- filebeat.reference.yml
- Modules
- Exported fields
- Apache2 fields
- Auditd fields
- Beat fields
- Cloud provider metadata fields
- Docker fields
- elasticsearch fields
- Host fields
- Icinga fields
- IIS fields
- Kafka fields
- kibana fields
- Kubernetes fields
- Log file content fields
- logstash fields
- mongodb fields
- MySQL fields
- Nginx fields
- Osquery fields
- PostgreSQL fields
- Redis fields
- System fields
- Traefik fields
- Monitoring Filebeat
- Securing Filebeat
- Troubleshooting
- Migrating from Logstash Forwarder to Filebeat
- Contributing to Beats
Monitoring Filebeat
editMonitoring Filebeat
editX-Pack monitoring for Filebeat requires Elasticsearch 6.2 or later.
X-Pack monitoring enables you to easily monitor Filebeat from Kibana. For more information, see Monitoring the Elastic Stack and Beats Monitoring Metrics.
To configure Filebeat to collect and send monitoring metrics:
-
Create a user that has appropriate authority to send system-level monitoring
data to Elasticsearch. For example, you can use the built-in
beats_system
user or assign the built-inbeats_system
role to another user. For more information, see Setting Up User Authentication and Built-in Roles. -
Add the
xpack.monitoring
settings in the Filebeat configuration file. If you configured Elasticsearch output, specify the following minimal configuration:xpack.monitoring.enabled: true
If you configured a different output, such as Logstash, you must specify additional configuration options. For example:
xpack.monitoring: enabled: true elasticsearch: hosts: ["https://example.com:9200", "https://example2.com:9200"] username: beats_system password: beatspassword
Currently you must send monitoring data to the same cluster as all other events. If you configured Elasticsearch output, do not specify additional hosts in the monitoring configuration.
- Configure monitoring in Kibana.
-
To verify your monitoring configuration, point your web browser at your Kibana
host, and select Monitoring from the side navigation. Metrics reported from
Filebeat should be visible in the Beats section. When X-Pack security is enabled,
to view the monitoring dashboards you must log in to Kibana as a user who has the
kibana_user
andmonitoring_user
roles.