i have kafka and packetbeat in same machine of ubuntu distribution. i can get the network statistics of 80 and 53 port from packetbeat but i would like to know is there any way we can get the kafka traffic.
i have seen the option of the process in packetbeat.yml which makes me to try with kafka.
here is my configuration:
ports: [80, 8080, 8000, 5000, 8002]
enabled: true - process: kafk-1 cmdline_grep: QuorumPeerMain
logstash: hosts: ["fqdn:5048"]
tags: ["kafka-01"] ignore_outgoing: false
to_files: true files:
rotateeverybytes: 10485760 # = 10MB
i have started the zookeeper service from the port 2181 and kafka server with 9093.
process name i referred from the path /proc/pid/cmdline.
zookeeper has cmdline:
kafka server has cmdline:
i have mentioned the below for the zookeeper in packetbeat.yml:
- after the above packetbeat configuration, i have started the packetbeat service in debug mode, i dont see network socket from the process name into elasticsearch nor i am receiving in logstash.
2.i don't have idea how to mention cmdline_grep process name for kafka server from the /proc/pid/cmdline. i also tried mentioning the process name from /proc/pid/comm but it was given "java". can we mention java as process name in packetbeat.yml?
your help would be much appreciated.
thanks in advance.