V
V
vlarkanov2018-10-18 16:17:00
linux
vlarkanov, 2018-10-18 16:17:00

Elasticsearch+Logstash+Kibana: how to set up Dashboard?

Hello!
Just installed ELK. Installed Filebeat on the server itself and on one more machine.
I loaded the index template like this - according to the instructions If the host running Filebeat does not have direct connectivity to Elasticsearch, see Load the template manually (alternate method) - my case because Filebeat sends data to Logstash, which already sends it to Elasticsearch:


filebeat export template > filebeat.template.json
curl -XPUT -H 'Content-Type: application/json' localhost:9200/_template/filebeat-6.4.2 [email protected]

Filled the dashboards themselves like this:

filebeat setup -e \
-E output.logstash.enabled=false \
-E output.elasticsearch.hosts=['localhost:9200'] \
-E setup.kibana.host=elk.mydomain.ru:5601

On the server, I enabled the filebeats system module, on the other machine - system and mysql.
Ran filebeats on both machines.
In Discovery, incoming data is visible, but the trouble is, in Dashbord, something like
Could not locate that index-pattern-field (id: system.syslog.hostname)

5bc887a0d5736697567308.png
How to win, comrades? Reading the documentation hasn't helped yet.
Configs:
Filebeat

filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/*.log
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup .template.settings:
index.number_of_shards: 3
setup.kibana:
host: "elk.mydomain.ru:5601"
output.logstash:
# The Logstash hosts
hosts: ["elk.mydomain.ru:5044"]

logstash

input {
beats {
port => 5044
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+ YYYY.MM.dd}"
document_type => "doc"
}
}

Answer the question

In order to leave comments, you need to log in

1 answer(s)
V
vlarkanov, 2018-10-23
@vlarkanov

In the end I decided it was easy. Removed visualizations, dashboards, template. I commented out in the Logstash config, registered Elasticsearch.
Fulfilled
Both the template and dashboards and everything you need are installed. Uncommented Logstash, commented out Elasticsearch, launched Filebeat. Works.
Hike,

-E output.logstash.enabled=false \
-E output.elasticsearch.hosts=['localhost:9200']

are not processed normally.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question