Configure multiple servers logs into single kibana dashboard

(pavan sai) #1

Please assist how to configure multiple servers logs into single kibana dashboard

(David Pilato) #2

Install filebeat on every server.
Configure it to send the data to your elasticsearch instances.
Done.

(pavan sai) #3

i configured filebeat in one server but i am not getting any windows events related logs, Can you please suggest for that

(David Pilato) #4

What is the output of:

GET /_cat/indices?v
(pavan sai) #5

I configured in Windows OS:
Where we can get that path, Please let us know

(David Pilato) #6

In Kibana dev console

(pavan sai) #7

Where i can get this in dev tools :

(Christian Dahlqvist) #8

Which version of the stack have you installed?

(David Pilato) #9

You copy this line:

GET /_cat/indices?v

And paste it in the dev console (replace all existing code)

Then click on the green arrow.

(pavan sai) #10

Thanks.

Please find below output of above mentioned code:

health status index                           uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   .monitoring-es-6-2019.04.30     LQ5zlGv6RDSKBWZqawHZIg   1   0     276899          432    141.9mb        141.9mb
green  open   .monitoring-kibana-6-2019.05.15 MG7lftnlRaOfVePDVEgIwg   1   0       2406            0    996.4kb        996.4kb
yellow open   filebeat-7.0.0-2019.04.29       74QbJ-V1QuqINrgV25TcUw   1   1       2877            0    793.5kb        793.5kb
green  open   .monitoring-kibana-6-2019.05.02 uhBUeZoTSIS6gFqcYH0uqQ   1   0       8634            0      2.4mb          2.4mb
green  open   .monitoring-es-6-2019.05.03     oo-GurGeRsCl05PaKsBA3g   1   0     285871          754    147.6mb        147.6mb
yellow open   filebeat-7.0.0-2019.04.27       mUbK8jTxQsWTTpgedzGdiA   1   1       2877            0    627.8kb        627.8kb
green  open   .monitoring-kibana-6-2019.05.03 SSiwWDD5Th-3ZxkIxa7oxA   1   0       8635            0      2.4mb          2.4mb
yellow open   metricbeat-7.0.1-2019.05.06     0uaV2ATnQLeFiTr5TFEnZQ   1   1      18755            0      3.9mb          3.9mb
green  open   .monitoring-kibana-6-2019.05.09 WTt1AbPIQDWy-1OJ_B_rLA   1   0       3954            0      1.3mb          1.3mb
green  open   .monitoring-kibana-6-2019.05.14 _tVSe0vdR36BqHz0DWsXpQ   1   0       3955            0      1.2mb          1.2mb
yellow open   filebeat-7.0.0-2019.04.26       YHDGuRXuSWOUGqKS5zSw5w   1   1       2876            0    790.7kb        790.7kb
yellow open   filebeat-7.0.0-2019.04.30       n2XhvbGcRHSs7lDZOcNvUQ   1   1       2878            0    794.2kb        794.2kb
green  open   .monitoring-es-6-2019.05.08     OO-xfdyhQMu-T2V1lVFrjg   1   0      77136          132     34.8mb         34.8mb
green  open   .kibana_1                       KtJC9VptTsq-43zO8XTT3w   1   0        430            4    903.1kb        903.1kb
green  open   .monitoring-kibana-6-2019.05.08 fnYfoROgTF2KJ2RY6Yb1Yg   1   0       1937            0      816kb          816kb
green  open   .kibana_task_manager            wtZ5wDDKSYKhfriFsIhy6Q   1   0          2            0     13.5kb         13.5kb
green  open   .monitoring-es-6-2019.05.14     a69YkHFARtKNY2JDXpbrwg   1   0     189745          456     80.1mb         80.1mb
green  open   .monitoring-es-6-2019.05.15     OFAlXOnBTzyvSLBLPz2yBA   1   0     120398          312     53.4mb         53.4mb
green  open   .monitoring-kibana-6-2019.04.29 5w9scGNoTc65xpxMRZt8yA   1   0       8635            0      2.4mb          2.4mb
green  open   .monitoring-kibana-6-2019.05.10 XirW56EMSwGOsfsyXJyrag   1   0       2620            0   1013.2kb       1013.2kb
yellow open   filebeat-7.0.0-2019.04.28       AOAGYg3_S_OTVXEho8mM3w   1   1       2877            0    626.6kb        626.6kb
green  open   .monitoring-es-6-2019.05.04     UVL_q0dKQkCnl_nmWXv_8w   1   0      71552          540     38.6mb         38.6mb
green  open   .monitoring-es-6-2019.05.10     kd2NFA95QDKXRvpxAixTyA   1   0     116137          432     52.1mb         52.1mb
green  open   .monitoring-kibana-6-2019.04.28 KAHvpaixTcSX9yRhgXi6Mg   1   0       8636            0      2.4mb          2.4mb
yellow open   default-2019.04                 TzFHLjxzRcSdZE0EBtGtLA   5   1         53            0    224.6kb        224.6kb
green  open   .monitoring-es-6-2019.04.29     -Fwf0QAdT-ud-DIpxPQq3Q   1   0     250534          550    125.8mb        125.8mb
green  open   .monitoring-es-6-2019.05.02     9F9pX2lATZ2HrZpM-NKKaA   1   0     277141          728    138.7mb        138.7mb
yellow open   filebeat-7.0.0-2019.05.03       _KCpgZE3QG-YBWO8Rrko2A   1   1       2877            0    625.8kb        625.8kb
green  open   .monitoring-es-6-2019.05.01     D1GnX1O4TzeGQHi-t4rdiQ   1   0     269226          756    137.7mb        137.7mb
yellow open   filebeat-7.0.0-2019.05.01       QkYY1-HoTRul0_q1rNfIEA   1   1       2877            0    732.1kb        732.1kb
yellow open   filebeat-7.0.0-2019.04.24       IuIk7nyQSMKLDNKnu5URwA   1   1       2881            0    680.2kb        680.2kb
green  open   .monitoring-kibana-6-2019.05.06 NsvD6EtESsaSpXtGfmY2aQ   1   0       1316            0    588.7kb        588.7kb
green  open   .monitoring-kibana-6-2019.04.30 D3q1kGJRTRWEEXCsH-GFUA   1   0       8634            0      2.4mb          2.4mb
green  open   .monitoring-es-6-2019.05.06     IQ_YqXxTS16QcYJyLoVhDQ   1   0      48362          640     24.4mb         24.4mb
yellow open   winlogbeat-7.0.1-2019.05.09     Sy5ZRkAaQGKhqCBhLgiInA   1   1         61            0    119.4kb        119.4kb
green  open   .monitoring-es-6-2019.05.13     LpzHrW9aS9mTha-sqY6sgQ   1   0     182058          370     78.1mb         78.1mb
green  open   .monitoring-es-6-2019.05.09     L6mUU85OTHSjNNuvPRK8pA   1   0     219905          556     94.2mb         94.2mb
green  open   .monitoring-es-6-2019.04.28     3qbrj_eNREetC-q4AqZNFA   1   0     224571          644    115.6mb        115.6mb
yellow open   filebeat-7.0.0-2019.04.23       oC2UkG6ESBauT2Eewqd5lA   1   1      36831            0      6.8mb          6.8mb
green  open   .monitoring-kibana-6-2019.05.04 abZg-VdMQRqyRvNMfY8YiA   1   0       2078            0    736.1kb        736.1kb
yellow open   filebeat-7.0.0-2019.04.25       0FysPZDgQpiOVX7rK2zCag   1   1       2877            0    753.8kb        753.8kb
green  open   .monitoring-kibana-6-2019.05.13 KMOmE6jlSy2_s1MoL3DhEQ   1   0       3955            0      1.2mb          1.2mb
yellow open   filebeat-7.0.0-2019.05.02       N1JJF9VARAOO0bbTQ2MGtg   1   1       2878            0    793.4kb        793.4kb
green  open   .monitoring-kibana-6-2019.05.01 vkE0T7aoRFquGLwPjD53pg   1   0       8634            0      2.4mb          2.4mb
yellow open   default-2018.08                 stHb89dKRG2JPyqlrJrD6w   5   1          1            0      4.8kb          4.8kb
yellow open   filebeat-7.0.0-2019.05.04       qKpCm7JIQCmg0B2GYRKIaQ   1   1        693            0    245.9kb        245.9kb
(pavan sai) #11

6.7.1

(David Pilato) #12

But filebeat seems to be a 7.0 version. You need to be consistent.

(pavan sai) #13

If you don't mind, Please share me the correct document to upgrade kibana & elasticsearch, Else sharing documents to removing existing filebeat

(pavan sai) #14

Please share steps to remove the existing filebeat without disturbing other settings.

(Kerry Gallagher) #15

@pavansai,

You can find upgrade documentation for the Elastic Stack here.

When upgrading the Elastic Stack you want to upgrade your components in the following order:

  • Elasticsearch
  • Kibana
  • Logstash
  • Beats

The previous version of Beats is designed to work with the next version of Elasticsearch, i.e. "Beats and Logstash 6.7 are compatible with Elasticsearch 7.0.1 to give you flexibility in scheduling the upgrade." but not the other way around.

Rolling upgrades are supported between minor versions: "Elasticsearch supports rolling upgrades between minor versions, from Elasticsearch 5.6 to 6.7, and from 6.7 to 7.0.1."

If you'd like to remove your Filebeat indices, you can follow these docs: https://www.elastic.co/guide/en/elasticsearch/reference/6.7/indices-delete-index.html, you'll want to use a wildcard expression of filebeat-*.

(Kevin G) #16

You need to use winlogbeat for Windows event logs

https://www.elastic.co/downloads/beats/winlogbeat

1 Like