Answer the question
In order to leave comments, you need to log in
Elasticsearch+Logstash+Kibana: how to set up Dashboard?
Hello!
Just installed ELK. Installed Filebeat on the server itself and on one more machine.
I loaded the index template like this - according to the instructions If the host running Filebeat does not have direct connectivity to Elasticsearch, see Load the template manually (alternate method) - my case because Filebeat sends data to Logstash, which already sends it to Elasticsearch:
filebeat export template > filebeat.template.json
curl -XPUT -H 'Content-Type: application/json' localhost:9200/_template/filebeat-6.4.2 [email protected]
filebeat setup -e \
-E output.logstash.enabled=false \
-E output.elasticsearch.hosts=['localhost:9200'] \
-E setup.kibana.host=elk.mydomain.ru:5601
Could not locate that index-pattern-field (id: system.syslog.hostname)
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/*.log
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup .template.settings:
index.number_of_shards: 3
setup.kibana:
host: "elk.mydomain.ru:5601"
output.logstash:
# The Logstash hosts
hosts: ["elk.mydomain.ru:5044"]
input {
beats {
port => 5044
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+ YYYY.MM.dd}"
document_type => "doc"
}
}
Answer the question
In order to leave comments, you need to log in
In the end I decided it was easy. Removed visualizations, dashboards, template. I commented out in the Logstash config, registered Elasticsearch.
Fulfilled
Both the template and dashboards and everything you need are installed. Uncommented Logstash, commented out Elasticsearch, launched Filebeat. Works.
Hike,
-E output.logstash.enabled=false \
-E output.elasticsearch.hosts=['localhost:9200']
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question