I am new to the ELK stack
Previously I was using 5.6.3 and had connected fileBeat and metricBeat to Logstash where a geoip lookup was done in /etc/logstash/conf.d/beats.conf and this was then forwarded to ElasticSearch
Today I decided to set up the same env but load Kibana's Nginx dashboard so that I don't have to build the nginx dashboard myself
So, in fileBeat, I enabled the nginx module
./filebeat modules enable nginx
and in the filebeat.yml, specified the URL host:port to Kibana and logstash both - when I ran, it gave the error:
CRIT Exiting: Template loading requested but the Elasticsearch output is not configured/enabled
I am confused here... the filebeat.yml file says:
Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
This requires a Kibana endpoint configuration.
I am assuming that you don't need to specify the Elasticsearch endpoint since the template will be loaded via the Kibana endpoint anyway
Is this a bug? Or intended behavior - i.e. if you use send a Kibana dashboard from fileBeat, you can't use logstash in the middle