Filebeat reading from another Linux server

Elastic Stack Beats
1

Hi,

I have three Red Hat Linux servers. I only have admin access at one of them and that is the one running Filebeat, Logstash, Elasticsearch and Kibana.

My other two servers are have a log file each that I somehow need to get.

server_overview

What is the best approach for doing this?

2

You have [at least] two ways to configure logs shipping, in both cases you will need admin access to the #2 and #3 boxes:

  • install and configure filebeat on these boxes
  • configure rsyslog on these boxes for send logs to the 1st box

Filebeat seems me more straightforward and elegant.