![]() ![]() Indeed after running filebeat setup with templates included, everything works as expected, huge thx for that Is there a better intended way to achieve this? The reason I want to have output of each module in a different index is that i want to easily manages permissions to access system-* and apache-* index patterns. Please select a new field.Īny idea what I am doing wrong, I already tried the make a fresh installation on a fresh machine, but the result was the same. Opening the dashboards gives me multiple errors like Error in visualisation > "field" is a required parameter The predefined dashboards are not working, the index patterns somehow get overwritten and they no longer have 3733 fields mapped but only like 80. However after i start the filebeat and logstash and start actually sending data in. That also worked out fine the index patterns are created with all the 3733 fields mapped. filebeat setup -modules system -E = -E =localhost:5601 -E ="system-*" -E output.logstash=disabledįilebeat setup -modules apache -E = -E =localhost:5601 -E ="apache-*" -E output.logstash=disabled Index => => i wanted to to do the setup needed for each of the modules I changed the logstash elasticsearch output configuration to include the module name. What i wanted to do next is use separate index for system logs and apache logs Send them to logstash and from logstash to elastic Gather data with filebeat and use filebeat modules to parse them
0 Comments
Leave a Reply. |