In our previous tutorial, we have 3 LXC containers: master-1, data-1 and data-2. Login and ssh to each of those containers and install Filebeat then install it
curl -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-7.13.3-x86_64.rpm rpm --install metricbeat-7.13.3-x86_64.rpm systemctl enable metricbeat
Edit the yml file /etc/metricbeat/metricbeat.yml. These are the only lines I changed from the LXC master-1 (look under “setup.kibana” and “—- Outputs —-)
The IP below is the master-1 host and it’s Kibana port 8080
Under —- Outputs —-, just change the hostname, port, username and password. The IP below is the master-1 host and the port 9200 is the elasticsearch port service.
output.elasticsearch: # Array of hosts to connect to. hosts: ["10.73.174.25:9200"] #api_key: "id:api_key" username: "elastic" password: "password88123818"
Do the same for file beat. Google “Download filebeat rpm” and install like the steps above. Follow the same concept for editing the yml file.
Enable system mode from Filebeat
[root@master-1 ~]# filebeat modules enable system Enabled system
Push the config for all the enabled modules. Make sure ES and Kibana are up and running. Otherwise, this will fail.
[root@master-1 ~]# filebeat setup Overwriting ILM policy is disabled. Set `setup.ilm.overwrite: true` for enabling. Index setup finished. Loading dashboards (Kibana must be running and reachable) Loaded dashboards Setting up ML using setup --machine-learning is going to be removed in 8.0.0. Please use the ML app instead. See more: https://www.elastic.co/guide/en/machine-learning/current/index.html Loaded machine learning job configurations Loaded Ingest pipelines
Start the Filebeat service and check the status
[root@master-1 ~]# systemctl start metricbeat [root@master-1 ~]# systemctl status metricbeat ● metricbeat.service - Metricbeat is a lightweight shipper for metrics. Loaded: loaded (/usr/lib/systemd/system/metricbeat.service; disabled; vendor preset: disabled) Drop-In: /run/systemd/system/metricbeat.service.d └─zzz-lxc-service.conf Active: active (running) since Sun 2021-07-11 23:30:47 UTC; 4s ago
Check if Filebeat indexes in ES. Check if it’s properly ingesting data
curl localhost:9200/_cat/indices?v -u elastic
Screenshot above shows it is there with 1083 documents/log events. So the steps above was for the ‘master-1’ node/container.
Do the same for the other containers ‘data-1’ and ‘data-2’