Configure Packetbeat

To get started quickly, read Quick start: installation and configuration.

To configure Packetbeat, edit the configuration file. The default configuration file is called packetbeat.yml. The location of the file varies by platform. To locate the file, see Directory layout.

There’s also a full example configuration file called packetbeat.reference.yml that shows all non-deprecated options.

See the Config File Format for more about the structure of the config file.

The following topics describe how to configure Packetbeat:

Network flows
Protocols
Processes
General settings
Project paths
Traffic sniffing
Output
SSL
Index lifecycle management (ILM)
Elasticsearch index template
Kibana endpoint
Kibana dashboards
Processors
Internal queue
Logging
HTTP endpoint
Instrumentation
Feature flags
packetbeat.reference.yml

« Upgrade Packetbeat Configure traffic capturing options »