Hi, I'm in the process of adding Filebeat (and Metricbeat) to hundreds of servers that we want to retrieve logs from.
These servers are not all config managed using tools like ansible or puppet, so manual deployment is the only option.
I'd like to suggest the below:
- For Windows Servers, a MSI package is built (I'm currently having to make my own)
- Consolidate the multiple Beats into WinBeat and LinuxBeat
- Enable Central Management for all Beats
- Enable configuration of all settings through Central Management (like adding tags)
- Create a long-lived token (like 30 days long) for deployment of central management. This could be passed in through MSI package parameter during install. Having to deploy each Beat with the once-only token is very slow and manual
Otherwise I'm very happy with the product so far and would love to see improvements to help us poor sys admins