How to create multiple filebeats dashboard in Kibana

Elastic Stack Kibana
1

Hi,
I have multiple Filebeats are running in multiple systems with custom index name. Filebeat send data to Logstash then logstash send data to Elasticsearch. Every thing is working fine logs are showing in Discovery tab. But the issue is when i trying to load dashboard in kibana by using 'Filebeat setup -e' the dashboards are not getting load in it it and showing the error(Image is attached)

image
image1353×453 24 KB

Filebeat.yml

filebeat.inputs:

  • type: log
    enabled: true
    paths:
    • /var/log/.log
      filebeat.config.modules:
      path: ${path.config}/modules.d/      .yml
      reload.enabled: false
      setup.template.settings:
      index.number_of_shards: 1
      setup.dashboards.enabled: true
      setup.dashboards.index: "care-stagging-"
      setup.kibana:
      host: "http://xx.xx.xx.xx:5601"
      username: "elastic"
      password: "VKkLOmFXUupzgXNnahp"
      ssl.verification_mode: none
      output.logstash:
      hosts: ["xx.xx.xx.xx:5044"]
      index: "care-stagging"
      setup.template.name: "care-stagging"
      setup.template.pattern: "care-stagging-      "
      setup.ilm.enabled: false
      setup.template.enabled: true
      setup.template.overwrite: false
      processors:
    • add_fields:
      fields:
      host.ip: "xx.xx.xx.xx"
      logging.metrics.period: 30s

Please share how can i load multiples filebeat dashboards in kibana.

2

In filebeat.yml, use a different "space" for each one.

Optional Kibana space ID.

#space.id: "

3

I think you issue is You are setting a custom index name

index: "care-stagging"

The preloaded filebeat dashboards work on a specific index pattern..

filebeat-*

As the error indicates in your screenshot, You will need to build your own filebeat dashboards.

In addition, you are trying to use the Apache logs dashboard without using the module That will not work either as there is specific parsing that takes place and data types so I'm not really clear what you're trying to accomplish.

Are your logs Apache logs?

And since you didn't format your filebeat.yml it's very hard to tell what it's actually configured

4

If i use same index with name filebeat-* for all Filbeats that are running in different servers, isn't it will conflict when that data were show in Kibana Discovery?

I am trying to create sperate kibana dashboards for each Filebeat. For ex: I have two servers A, B on both machines Filebeat is configured with custom index and sending data to logstash and then logstash send data to Elasticsearch, Now i want, kibana show two sperate dashboards for each server and i can switch between them.

5

If server A and B send the same type of data you could send the data to the filebeat-* index and then simply create 1 dashboard and put a filter control at the top that allows your user to simple select which server they want to look at.

IF this data is apache data, you could use the apache module and just add that control to the top of the default dashboards and have a great user experience.

IF server A and B send to completely different set of data to two completely indices then you need to create your own 2 separate dashboards using 2 separate index patterns

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.