Managing Beats

Use the Central Management UI under Management > Beats to define and manage configurations in a central location in Kibana and quickly deploy configuration changes to all Beats running across your enterprise. For more about central management, see the related Beats documentation:

Kibana makes it easy for you to use central management by walking you through the enrollment and configuration process step by step the first time you use the Central Management UI.

You need to enroll Beats to register them in central management and establish trust. Enrolled Beats will have the credentials needed to retrieve configurations from Kibana.

A configuration tag is a group of configuration blocks that you can apply to one or more Beats. For example, you can create a tag called development to group configurations for Beats running in your development environment.

The first time you walk through the enrollment process, you’ll create a configuration tag that’s applied to the Beats instance you’re enrolling.

After that, under Configuration tags, you can create additional tags and apply them to any enrolled Beats, and the Beats will use the configurations defined in the tag.

Add one or more configuration blocks to the tag. A tag can have configuration blocks for different types of Beats. When the enrolled Beats run, they will use the configuration blocks that are valid for their type.

Central management supports configuration settings for:

Use the Central Management UI to define and manage settings for supported configuration blocks. You cannot define those settings in local Beats configuration files. For configuration blocks that are not supported by central management, configure the settings in the local configuration file after enrolling the Beat in central management.

Under Enrolled Beats, you can view the list of enrolled Beats to see details, including the type, applied tags, configuration status, and the last configuration update. Click the Beat name or Type column heading to sort the list. To filter the list, enter a search string. If there are errors in a configuration, you’ll see an Error status in the Central Management UI and need to look at Beats logs to troubleshoot the problem.

You can add or remove tags, and the configuration changes are automatically deployed to all Beats that have the tag. Avoid applying tags with conflicting configurations. Because the configurations for all assigned tags are merged, conflicting configurations result in errors.

You can unenroll Beats to remove them from central management.

Under Configuration tags, you can select tags and delete them, or you can drill down into a tag to add, modify, or remove configuration blocks from the tag. When you change the configuration blocks or remove tags, the configuration changes are automatically deployed to all Beats that have the tag.