Hello, another newbie here. I am bit confused about setting up the ELK for Apache2 application log aggregation.
My setup is as follows, all components are version 6.2.3;
Apache Logs(3X) --> Filebeat --> Logstash --> ElasticSearch + Kibana
I am able to see data in kibana, and by adding
"multiline.pattern: '^[[:space:]]|^Caused by" in filebeat.yml the lines in stack trace are all together.
My problem is with the rest of the lines in an event. They seem to split into separate events and they appear in random order in Kibana.
Now I am trying to enable apache2 module, which is supposed keep all lines in an event together. I am not sure if I am doing this right.
Added following lines to filebeat.yml
#========================== Modules configuration ============================
#------------------------------- Apache2 Module ------------------------------
Set custom paths for the log files. If left empty,
Filebeat will choose the paths depending on your OS.
Is the section 'filebeat.prospects:' is still required, which section is "var.paths" picked up from?
Is "multiline.pattern: '^[[:space:]]|^Caused by'" still required?
Are there an example configuration available out there for apache log collection.
I am looking for exact files to be modified and any help with what should be modified. Filebeat was installed from RPM.
My filebeat installation is here->>> /usr/share/filebeat/bin/filebeat
So far I have been tinkering with this file only->>> /etc/filebeat/filebeat.yml
Thanks for your help.