Connect FileBeat to Logstash and ES

[Ghaith_Haddad]

Hello everyone,

So i have filebeat configured in an apache server AWS EC2 instance and another EC2 instance which has logstash and elasticsearch. i can send log files to the ec2 instance to logstash but i can only display them on the console, like the output on the logstash config is { stdout {} }. How can i forward those files to elasticsearch and actually be able to see them or go through them i can't figure it out. Because i also have kibana setup and i need to view all the logs from the apache server and also a bunch of other servers as well.

Any help or guidance is GREATLY APPRECIATED!

Cheers!

[daniel_a (daniel_aug)]

Just set up output in logstash.conf file on Logstash.

https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html

Then, restart the service.

[daniel_a (daniel_aug)]

You might need to install a plugin on your Logstash:

https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html

[Ghaith_Haddad]

Thank you @daniel_a for your reply, but after all that is done, how can i see or go through the log files that filebeat sent thru logstash to elastichsearch?

[daniel_a (daniel_aug)]

Can you share your Logstash config and make sure Logstash has started correctly?

 sudo service logstash start (to start the service)
 sudo tail -f /var/log/syslog (to check if the service started)

Not sure what's your index name you created for these logs. It could be filebeat-xxxxx

[Ghaith_Haddad]

Got it, thank you very much!