Skip to main content
Version: 10.2.8

Filebeat

General configuration​

The configuration file is filebeat.yml.

Directory config​

# general settings
path:
  home: '{{ install_dir }}/filebeat'
  config: '{{ install_dir }}/filebeat'
  data: '{{ install_dir }}/filebeat/data'
  logs: '{{ install_dir }}/filebeat/logs'
  modules: '{{ install_dir }}/filebeat/modules.d'

Input config​

filebeat:
  registry_file: registry_in
  config:
    inputs:
      enabled: true
      path: inputs.d/*.yml
      reload:
        enabled: true
        period: 10s

Name config​

# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
name: "{{ hostname }}"

Output config​

# output settings
output.logstash:
  enabled: true
  hosts: ["{{ apm_hostname }}:{{ logstash_spa_port }}"]
  ssl.certificate_authorities: ["{{ filebeat.path.home + '/ssl/ca.crt' }}"]

Logging config​

logging.level: info
logging.to_syslog: False
logging.to_files: True
logging.files:
  path: {{ filebeat.path.logs }}
  name: filebeat.log
  rotateeverybytes: 104857600
  keepfiles: 30

Input configuration​

The configuration file is inputs.d/*.yml.

See the input config example:

- type: log
  enabled: true
  paths: 
    - /tmp/service.log
  fields: 
    service_group_name: 'app'
    service_name: 'service'
  fields_under_root: true
  close_inactive: 2m