Deploying filebeat on AWS Beanstalk

[sharadachukka]

Has anybody deployed filebeat successfully on AWS beanstalk? What is your architecture? Is it best to write directly to elasticsearch?.. or better to have a logstash instances as middle layer to write to elasticsearch.
Can you please share your .ebextensions config that works

Regards,
Sharada

[JeremyPlease (Jeremy)]

I successfully set up filebeat on AWS Elastic Beanstalk today.

Simply create a file named 02_filebeat.config.config in the .ebextensions folder of your repo.

Example content of the file:

files:
  "/etc/filebeat/filebeat.yml":
    mode: "000755"
    owner: root
    group: root
    content: |
      filebeat.prospectors:
      - input_type: log
        paths:
          - /var/app/current/logs/*.log
        json.message_key: event
        json.keys_under_root: true
        json.overwrite_keys: true
      output.elasticsearch:
        hosts: ["elasticsearch.example.com:9200"]

commands:
  1_command:
    command: "curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.2.0-x86_64.rpm"
    cwd: /home/ec2-user
  2_command:
    command: "rpm -ivh --replacepkgs filebeat-5.2.0-x86_64.rpm"
    cwd: /home/ec2-user
  3_command:
    command: "/etc/init.d/filebeat start"

Hope that helps!

[sharadachukka]

Thanks Jeremy. This really helps !