Need to install Filebeat on Single instance for multiple servers

Elastic Stack Beats
1

Hi All,

We have multiple servers and I want to install the Filebeat on single instance for all servers.

Can anyone suggest the way to achieve this.

Thanks,
Nitin Bisht

2

Hi @Nitin08bisht,

  1. Does it mean, You want to install filebeat on one server and it should able to read logs file from rest of other servers?

  2. Also curious to know what is your use case?

3

Hi @ashishtiwari1993 ,

Yes, I want to install Filebeat on a single server.
Please find the our use case below.

Our Use case:
for eg. A shared location \\sharedPath\Logs having subdirectory A, B, C so on. Each directory contain log file of different -2 application.

\sharedPath\Logs\A
\sharedPath\Logs\B
\sharedPath\Logs\C

We want to setup ILM policy based on the directory so that logs of each directory will be ingest on index based on the defined ILM Policy as mentioned below.

setup.ilm:
      enabled: true
      policy_name: "A"
      overwrite: true
      rollover_alias: "A-%{[agent.version]}"
      pattern: "{now/d}-0000001"


setup.ilm:
      enabled: true
      policy_name: "B"
      overwrite: true
      rollover_alias: "B-%{[agent.version]}"
      pattern: "{now/d}-0000001"

setup.ilm:
      enabled: true
      policy_name: "C"
      overwrite: true
      rollover_alias: "C-%{[agent.version]}"
      pattern: "{now/d}-0000001"

Thanks,
Nitin Bisht

4

  1. Not sure if you have tried Fleet + Elastic agent. You can use elastic agent instead of filebeat. You need to install elastic agent at every server and from the fleet (In kibana) you can manage different policy across the servers.

  2. If you don't want to use fleet, You can manually install filebeat on every server or you can use automation tool like Ansible for auto deployment and upgradation. But still, changing configuration will be manual where as fleet provides central place to manage configuration across the servers.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.