#Logstack list filebeats how to#
#Logstack list filebeats install#

ConclusionĬonfiguring FileBeat to send logs from Docker to ElasticSearch is quite easy. Note that conditions can also be applied to processors. You can check the FileBeat documentation to help you create your own conditions. If you configure an index pattern for filebeat-elastic-* and filebeat-apps-* in Kibana, it can make it easier to browse the logs. The only thing left to do is to create the filebeat configuration file in /MY_WORKDIR/filebeat.yml:įilebeat.inputs : - type : container paths : - '/var/lib/docker/containers/*/*.log' processors : - add_docker_metadata : host : 'unix:///var/run/docker.sock' - decode_json_fields : fields : target : 'json' overwrite_keys : true output.elasticsearch : hosts : indices : - index : 'filebeat-%' That is why the user was changed to root in the docker compose file. Unfortunately, the user filebeat used in the official docker image does not have the privileges to access them. The user running FileBeat needs to be able to access all these shared elements. That allows FileBeat to use the docker daemon to retrieve information and enrich the logs with things that are not directly in the log files, such as the name of the image or the name of the container. The docker socket /var/run/docker.sock is also shared with the container. You can usually find them in /var/lib/docker/containers but that may depends on your docker installation. We will see in the next section what to put in this file.įileBeat also needs to have access to the docker log files. To share this configuration file with the container, we need a read-only volume /usr/share/filebeat/filebeat.yml:ro. Kibana does not need a volume as it uses ElasticSearch to persist its configuration.įileBeat on the other hand needs a specific configuration file to achieve what we want. ElasticSearch has a volume to keep its data. They are respectively available on port 92. There is not much to say about ElasticSearch and Kibana as it is a very standard configuration for docker. Note that you need to replace /MY_WORKDIR/ by a valid path on your computer for this to work. The docker compose file docker-compose.yml looks like this: We will use the official docker images and there will be a single ElasticSearch node. To make things as simple as possible, we will use docker compose to set them up.

#Logstack list filebeats install#

There are many ways to install FileBeat, ElasticSearch and Kibana. Although FileBeat is simpler than Logstash, you can still do a lot of things with it. It was created because Logstash requires a JVM and tends to consume a lot of resources. The setup works as shown in the following diagram:ĭocker writes the container logs in files.įileBeat then reads those files and transfer the logs into ElasticSearch.įileBeat is used as a replacement for Logstash. It should be able to decode logs encoded in JSON.It should be as efficient as possible in terms of resource consumption (cpu and memory).Even after being imported into ElasticSearch, the logs must remain available with the docker logs command.All the docker container logs (available with the docker logs command) must be searchable in the Kibana interface.The setup meets the following requirements: In this article I will describe a simple and minimalist setup to make your docker logs available through Kibana.

#Logstack list filebeats how to#

Regarding how to import the logs into ElasticSearch, there are a lot of possible configurations.īut this is often achieved with the use of Logstash that supports numerous input plugins (such as syslog for example). The Kibana interface let you very easily browse the logs previously stored in ElasticSearch. If you are looking for a self-hosted solution to store, search and analyze your logs, the ELK stack (ElasticSearch, Logstash, Kibana) is definitely a good choice.