Misconfigured dashboards?

Elastic Stack Beats
1

I have built a syslog receiver using ELK 6.2.1, which works great.

Logstash receives syslog data and pushes it into ES and then I can use discover to see the logs coming in via Kibana.

I read somewhere that there are some default dashboards in filebeat that would allow me to see more in Kibana.

So I have installed filebeat on my single ELK server and I edited the following in filebeat.yml:

In paths:

  • /var/log/.log
    was changed to /var/lib/logstash/    .log

In the Dashboards section:
setup.dashboards.enabled: true

In the Kibana section
I added
setup.kibana:
host: "localhost:5601

I then ran the filebeat setup and installed it successfully (well I got no errors)

I then when into Kibana and saw lots of new dashboards but also got the following message on the top status bar:

No matching indices found: No indices match pattern "filebeat-*"

All my syslog data comes into Kibana with Logstash* and @timestamp.

Can anyone tell me what else I may need to do to the filebeat.yml file to be able to use the syslog dashboard with my syslog files within logstash?

All help is appreciated,
QR

2

I believe the problem is that Logstash is creating an index named differently than "filebeat-*".

Have you followed the logstash output docs? It's easy to misconfigure it.

3

Thank you for your thoughts... but I’m not using filebeats for anything other than to get to the dashboards.

I receive native syslog from network components like fw, routers, etc straight into logstash

If I’m not using filebeats can I still use the dashboards in Kibana?

I’ve no interest in filebeats for clients as they don’t suit my use cases.

4

I don't think the dashboards will work with documents that are not generated by filebeat as they won't have the required fields.

But I may be wrong, so you can try setting an index pattern in Kibana that matches the indexes created by logstash.

5

You might want to try this solution as a starting point for collecting syslog data...

6

Wow that looks just what I’m looking for :grin:
When I installed Kibaba I was asked to create an index and offered logstash*. Can I create a syslog-* as well?

Thanks
QR

7

@QuizzyRascal as you dig into this more, you will realize that there are four things that have to work together...

  1. Logstash Pipelines
  2. Elasticsearch Index Templates
  3. Kibana Index Patterns
  4. Kibana Dashboards

The material in this repository walks through a more in depth example...

Even more advanced deployments, will consider normalizing sources to a common data model, which allows for analytics and visualization of a heterogenous environment with a common set up tools and dashboards. Providing such solutions in a turnkey package, are what we provide for our customers.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.