CODEWITHSUNDEEP
logginglogstashelastic-stackfilebeat
DaPoox
DaPoox

Reputation: 149

Retrieve log file from distant server with FileBeat

I am currently using 4 servers, they have some log files I want to analyse. I want to use Logstash and Elasticsearch for that, and maybe filebeat too. I have made some tests, getting the files from the servers (manually) and analyzing them with Logstash (input => file). What I want to do is to configure FileBeat to get the log files as input (from the 4 servers). So my question is, is it possible to make Filebeat get those files automatically as input?

Upvotes: 0

Views: 1391

Answers (1)

berrytchaks
berrytchaks

Reputation: 849

You will have to install filebeat and logstash on the 4 servers (let called them server1, server2, server3 and server4) then you can install elasticsearch on one server (say server2).

You will then have to configure filebeat as follows

For server1

filebeat.prospectors:

- paths:
    - /path/to/log/*.*

output.logstash:
  hosts: ["server1Ip:5044"]

For server2

filebeat.prospectors:

- paths:
    - /path/to/log/*.*

output.logstash:
  hosts: ["server2Ip:5044"]

etc...

Used this configuration for all the 4 servers on which logstash is installed.

input {
  beats {
    port => "5044"
 }
}
 output {
   elasticsearch {
    hosts => [ "server2Ip:9200" ]
    index => "indexName"
 }
}

For elasticsearch, you will only have to set the network.host

network.host: server2Ip

Hope this helps.

Upvotes: 2

Related Questions