Run_from config

Elastic Stack Beats
1

Simple question here, if I have 10 different monitors setup on a single agent, do I have to duplicate the run_from section (example below) and specify the id for each of them, or if I exclude the id field, will the run_from section apply to all?

heartbeat.run_from:
  id: example1.contoso.com
  geo:
    name: Microsoft HQ
    location: 47.6516, -122.1351
    continent_name: North America
    country_iso_code: US
    region_name: Washington
    region_iso_code: WA
    city_name: Redmond
  id: example2.contoso.com
  geo:
    name: Microsoft HQ
    location: 47.6516, -122.1351
    continent_name: North America
    country_iso_code: US
    region_name: Washington
    region_iso_code: WA
    city_name: Redmond
2

Hello there @wwalker - thanks for your interest in Heartbeat!

If you have 10 monitors running on a single Heartbeat instance, and you want all of them to register the same geo data, you can specify heartbeat.run_from in your config. In the case of the run_from field, the id actually corresponds to the location name, not the monitor.

So, in your example, I would revise the YAML to look like this:

heartbeat.run_from:
  id: microsoft-hq
  geo:
    name: Microsoft HQ
    location: 47.6516, -122.1351
    continent_name: North America
    country_iso_code: US
    region_name: Washington
    region_iso_code: WA
    city_name: Redmond

This should cause all 10 of your monitors (defined in the heartbeat.monitors field) to register that geo data in their processor metadata. The id value you specify here (microsoft-hq in the example above) will populate in the observer.name field in your Elasticsearch documents, and the rest of the data will be visible under observer.geo. It's also possible to specify an individual run_from field on monitors configs themselves, if you should want to override the agent-wide geo config for specific checks.

In case you haven't already looked, there are docs for this specific feature.

Please let me know if you have any trouble or further questions, and thanks again for using Heartbeat!

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.