I'm pretty new to this software, but trying to set up Kibana, Elasticsearch, Filebeat, and Logstash.
The set up I'm trying to achieve is as such. Kibana, ES, Logstash are all on one server, for this sake, we'll say 1.1.1.1, I want to send the logs from other servers to Logstash, so that I can view them in Kibana, on 1.1.1.1.
I've installed ES, Kibana, Logstash, with the following settings:
// KIBANA.YML
# File managed by Puppet.
---
server.port: '5601'
server.host: "1.1.1.1"
Kibana works fine, and can be accessed via the web.
// LOGSTASH.yml
path.data: "/var/lib/logstash"
path.config: "/etc/logstash/conf.d"
path.logs: "/var/log/logstash"
http.port: '9700'
This is the ES set up on 1.1.1.1
output {
if [@metadata][pipeline] {
elasticsearch {
hosts => ["localhost:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
pipeline => "%{[@metadata][pipeline]}"
}
} else {
elasticsearch {
hosts => ["localhost:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
}
And this is my "beats" config on 1.1.1.1
input {
beats {
port => 9700
}
}
And then this is one of my other servers, say 2.2.2.2, which is running filebeat
### Filebeat configuration managed by Puppet ###
---
name: server1..
tags: []
fields: {}
fields_under_root: false
filebeat:
config.inputs:
enabled: true
path: "/etc/filebeat/conf.d/*.yml"
config.modules:
enabled: false
path: "/etc/filebeat/modules.d/*.yml"
modules: []
overwrite_pipelines: false
shutdown_timeout: '0'
registry:
path: "/var/lib/filebeat"
file_permissions: '0600'
flush: 0s
autodiscover: {}
http: {}
cloud: {}
queue: {}
output:
logstash:
hosts:
- 1.1.1.1:9700
loadbalance: true
shipper: {}
logging: {}
runoptions: {}
processors: []
setup: {}
Everything seems to be working fine, but if I run:
curl -XGET 'http://1.1.1.1:9200/filebeat-*/_search?pretty', I get:
{
"took" : 2,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 0,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
}
}
which seems like nothing has been sent to Logstash/ES; I looked at the Digital Ocean tutorial which said to run:
filebeat setup --index-management -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["1.1.1.1:9200"]'
filebeat setup -E output.logstash.enabled=false -E output.elasticsearch.hosts=['1.1.1.1:9200'] -E setup.kibana.host=1.1.1.1:5601
but there was no change? Does anyone know what I've been doing wrong? I'm missing something potentially obvious here, I think, but can't figure out what?