Hi.
I have two problems to solve:
1.How to manage configuration of elastic agents / filebeat config files on remote machines ?
I want to have one centralized place so I can update remotely the Filebeat configuration. Is there a way to do so ?
2. Can I use elastic agent to collect logs and send it to logstash server for parsing and date filtering ? I was trying with that configuration but it is not sending data to logstash and elasticsearch. Any ideas ?
This is a elastic agent yml main file.
For Elastic Agent the recommend deployed model is to use Fleet, with will allow you to manage the agentes from the Fleet UI, deploying the agents in standalone mode is considered an advanced use case.
For filebeat there is nothign to centrally manage, you would need to build some automation to do that.
This is the documentation about using Fleet to manage the agents.
Yes, you can send logs to Logstash, but you should do the parsing on Elasticsearch.
Elastic Agent relies on integrations, those integrations will use Ingest Pipelines to parse the data and the ingest pipelines are executed in Elasticsearch ingest nodes.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.