Setup Filebeat to Monitor Elasticsearch Logs

#elasticsearch #kibana #logstash #filebeat #elasticsearchtutorial
To monitor the Elasticsearch logs, Filebeat has a module that will get that done for you. In this tutorial, we setup Filebeat to monitor the logs of Elasticsearch nodes.

Watch how I installed and configured Metricbeat to monitor Elasticsearch:

Thank you for watching!

[MrSalFav]

Hi Ali, Thank you for putting out these videos they are really helpful . wanted to learn more about Elastic Stack for my ForgeRock project. and you videos are of great help.

[kumak]

Hi Ali, Thank you for uploading videos about ELK.. Hopefully you can upload a monitor log with Elastic Agent.

[mnmmnmpth]

Thank you so much for explaining filebeat. Can you please put a video tutorial, how to connect filebeat to API GATEWAY?

[romanjkee]

Great video! Need it with logstash)
Also, how can I monitor apm queue free size?

[onemo]

Hey, excellent video, the entire ElasticSearch saga is really helpful!

For Metricbeat, you skipped part 2.2 (setup.kibana) and part 3, was it intentional or you realized afterwards that you should have done the same?

[ananyayechuri]

Hey, I was able to download and setup filebeat and it showed me that kibana dashboard must be running and reachable but when I refresh the page the logs section shows me that I still need to install filebeat which I have already done

[MyTeevo]

Hey appreciate your efforts, your videos are extremely informative. Could you please do a detailed video on setting up interface stats for fortigate on ELK

[szymonzalewski]

Hi Ali, does it need to be set up on other nodes aswell?

[SnakeFredy]

Thank you very much for the videos Ali. I wanted to ask you, I have mounted Elasticsearch, kibana and logstash, Is it better to replace logstash by Filebeat? this since I also have a Fortinet Firewall. Thanks in advance

[JoseManuel-loed]

You are the ElasticBoss... Jajajajajajajaja.

best regards.

[unlimited.travel.channel]

I can't get "admin login alerts" with Filebeat. Which Fortigate syslog parameters should be enabled? Thanks in advance.

[nisrrah]

Where are the imported logs from fluentd or filebeat stored? In logstash or elasticsearch? I need to configure this so that it doesnt fill up the c:

[walidbarrani]

hey ali thanks for the video i just wanna ask before i start the steps did it worked when i just want to see logs with suricata on another filebeat machine (ubuntu i used ) your answer will be helpful thank you

[arunrmyt]

Can you help us with fortigate logs are not working with var.input: file and var.path: /path/to/*.log

[tonylagumen]

Hello Ali - you are setting up filebeat on chamber2 but the monitoring log dashboard in kibana is showing chamber1. --- Was the filebeat log shipper configuration properly setup for chamber2?

[JoseManuel-loed]

Do not work to me Mister, ELK is horrible. I do not what to do more to make that filebeat send logs to my elasticsearch... Amazing.

Best regards.

[zmartinelli]

I think you forget to give root permissions on the directories, that is why the elasticsearch data did not show in the UI.

[clearthinking]

why don't you configure all of this through docker?

[IvarsRuza]

Nice vidtuts! But why U R enabling the same repo again and again? Alos for ELK REPP - make sure: enabled=0, so U will not update it automaticly. When U will be ready to update ELK, use: yum --enablerep=Eelastic-8.x install filebeat, metricbeat logsthas elasticsearch etc.

[kumak]

Hi Ali, Thank you for uploading videos about ELK.. Hopefully you can upload a monitor log with Elastic Agent.