How to differentiate Multiple metricbeat system logs in one kibana index

Elastic Stack Kibana
1

Hi all, I have 4 different remote machines so I'm getting system information like disk, cpu and memory used using metricbeat and sanding it to logstash, in creating only one index daily bases.
So my question is how can I figure out in kibana that which cpu, disk and memory is belongs to which machine?

Thanks in advanced.

Regards,
Vinit

2

Vinit,
I just set this up. it is really easy once you know what is happenning behind kibana

I am doing yearly index. one index per year for all the systems combine.

first install metricbeat on all the system without turning anything.
I have also install this in one of the kibana server as well

now on kibana server where you going to turn on metricbeat you need following entry in metricbeat.yml. This is what I have
kibana and metricbeat server are same host as this is test

[root@kibana01 conf.d]# less /etc/metricbeat/metricbeat.yml |grep -v '#' |sed '/^$/d'
metricbeat.config.modules:
path: /etc/metricbeat/modules.d/system.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 3
index.codec: best_compression
setup.dashboards.enabled: true
setup.dashboards.beat: metricbeat
setup.dashboards.index: metricbeat_sysstat_*
setup.kibana:
host: "kibana01:5601"
output.elasticsearch:
hosts: ["kibana01:9200"]
index: "metricbeat_sysstat_%{+yyyy}"
setup.template.name: "metricbeat_sysstat"
setup.template.pattern: "metricbeat_sysstat_*"
processors:

  • add_host_metadata: ~
    logging.to_files: true
    logging.files:
    path: /elkdata01/log/metricbeat
    keepfiles: 4

Make sure to go in to /usr/share/metricbeat/kibana/6/dashboard and remove all the dashboard that you don't want. I kept only system related stuff as I didn't want anything to with http or kafka or others.

now start metricbeat on kibana01

now go to your other system and their /etc/metricbeat/metricbeat.yml looks like this
You will see that no kibana option is enable on this host.

[root@houst01 metricbeat]# cat /etc/metricbeat/metricbeat.yml |grep -v '#' |sed '/^$/d'
metricbeat.config.modules:
path: /etc/metricbeat/modules.d/system.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 3
index.codec: best_compression
output.elasticsearch:
hosts: ["kibana01:9200"]
index: "metricbeat_sysstat_%{+yyyy}"
setup.template.name: "metricbeat_sysstat"
setup.template.pattern: "metricbeat_sysstat_*"
processors:

  • add_host_metadata: ~
    logging.to_files: true
    logging.files:
    keepfiles: 4

Once you do that you will have host01 appers in your dash board in seconds.

3

@elasticforme Thank you for valuables information. And one more question is

Can we change the beat.name in metricbeat.
bcoz I found on google that beat.name can contain different IP of the remote machine.
So I just want to change that IP to any custom name.

4

that I have no clue.
actually beat.name = hostname sending information.