Filebeat Configuration

Filebeat

Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing (verbatim from Filebeat’s documentation).

For more information on Filebeat, refer to its documentation here.

Filebeat installation (optional):

helm repo add elastic https://helm.elastic.co helm install filebeat elastic/filebeat

Configure filebeat:

Edit filebeat configmap by running kubectl edit cm filebeat-filebeat-daemonset-config and add the following lines under the filebeat.yml section

setup.ilm.enabled: false setup.template.enabled: false output.elasticsearch: hosts: ["http://<ingress-ip>:80/ingester/api/v1/filebeat"]

To get ingress IP run: kubectl get services | grep -i "ingress". Pick the ingress-external IP.

Restart the filebeat daemonset for the configmap changes to kick in by running:

kubectl rollout restart daemonset filebeat-filebeat