# Deploying filebeat on AWS Beanstalk

**URL:** https://discuss.elastic.co/t/deploying-filebeat-on-aws-beanstalk/72246
**Category:** Beats
**Tags:** filebeat
**Created:** [January 20, 2017, 1:58am UTC](https://discuss.elastic.co/t/deploying-filebeat-on-aws-beanstalk/72246 "2017-01-20T01:58:03Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![sharadachukka](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@sharadachukka](https://discuss.elastic.co/u/sharadachukka)
#### Post date: [January 20, 2017, 1:58am UTC](https://discuss.elastic.co/t/deploying-filebeat-on-aws-beanstalk/72246/1 "2017-01-20T01:58:03Z")

</div>

Has anybody deployed filebeat successfully on AWS beanstalk? What is your architecture? Is it best to write directly to elasticsearch?.. or better to have a logstash instances as middle layer to write to elasticsearch.  
Can you please share your .ebextensions config that works

Regards,  
Sharada

---

<div class="post-metadata">

### Author: ![JeremyPlease](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeremyplease/32/15200_2.png) [@JeremyPlease](https://discuss.elastic.co/u/JeremyPlease)
#### Post date: [February 3, 2017, 10:55pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-aws-beanstalk/72246/2 "2017-02-03T22:55:32Z")

</div>

I successfully set up filebeat on AWS Elastic Beanstalk today.

Simply create a file named `02_filebeat.config.config` in the `.ebextensions` folder of your repo.

Example content of the file:

```auto
files:
  "/etc/filebeat/filebeat.yml":
    mode: "000755"
    owner: root
    group: root
    content: |
      filebeat.prospectors:
      - input_type: log
        paths:
          - /var/app/current/logs/*.log
        json.message_key: event
        json.keys_under_root: true
        json.overwrite_keys: true
      output.elasticsearch:
        hosts: ["elasticsearch.example.com:9200"]

commands:
  1_command:
    command: "curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.2.0-x86_64.rpm"
    cwd: /home/ec2-user
  2_command:
    command: "rpm -ivh --replacepkgs filebeat-5.2.0-x86_64.rpm"
    cwd: /home/ec2-user
  3_command:
    command: "/etc/init.d/filebeat start"

```

Hope that helps!

---

<div class="post-metadata">

### Author: ![sharadachukka](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@sharadachukka](https://discuss.elastic.co/u/sharadachukka)
#### Post date: [February 8, 2017, 3:36pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-aws-beanstalk/72246/3 "2017-02-08T15:36:14Z")

</div>

Thanks Jeremy. This really helps !

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 8, 2017, 3:36pm UTC](https://discuss.elastic.co/t/deploying-filebeat-on-aws-beanstalk/72246/4 "2017-03-08T15:36:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.