I'm not sure, if beats is the right place to put my question here, maybe it's also logstash or elasticsearch or kibana...
For explanation: I run top beat on two different hosts and an ELK stack on another host. I use the topbeat-dashboard from the examples and run on a search for topbeat-*. Since the two hosts (say jcl02, jcl03) topbeat to elastic directly (didn't get filters and stuff to work with logstash yet) , they will be shown on the dashboard together. Worse than that, cpu load averages are calculated together, while I just want to have the results of the single hosts.
My question: Is it somehow possible to have a dashboard for each of the jcl* hosts, so I can gather average values from each host separately?
Options might be using a search or some kibana field filter. kibana dashboards can be bookmarked. The bookmark will contain the search filter and all settings.
Since they are both going to elasticsearch, you can specify the index that they will be written to.
Have a look here : https://www.elastic.co/guide/en/beats/topbeat/current/elasticsearch-output.html
It is straight forward.
As you said, the other option would be to go through logstash where you can specify the output with many different ways.
Hope it helps.
You can simply visualize the dashboard with data coming from a single host by using the search box from the dashboard. You can try using the filter:
beat.name: jcl02 and the data in your dashboard will be updated with info coming from
jcl02. You can save the dashboard view to something like
Topbeat Dashbord - jcl02 by clicking on the
Save button and pass a different name.
This topic was automatically closed after 21 days. New replies are no longer allowed.