Send filebeat 6.0 dashboard template to Kibana using logstash

Elastic Stack Kibana
1

Hi

I am new to the ELK stack

Previously I was using 5.6.3 and had connected fileBeat and metricBeat to Logstash where a geoip lookup was done in /etc/logstash/conf.d/beats.conf and this was then forwarded to Elasticsearch

Today I decided to set up the same env but load Kibana's Nginx dashboard so that I don't have to build the nginx dashboard myself

So, in fileBeat, I enabled the nginx module

./filebeat modules enable nginx

and in the filebeat.yml, specified the URL host:port to Kibana and logstash both - when I ran, it gave the error:

CRIT Exiting: Template loading requested but the Elasticsearch output is not configured/enabled

I am confused here... the filebeat.yml file says:

Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
This requires a Kibana endpoint configuration.

I am assuming that you don't need to specify the Elasticsearch endpoint since the template will be loaded via the Kibana endpoint anyway

Is this a bug? Or intended behavior - i.e. if you use send a Kibana dashboard from fileBeat, you can't use logstash in the middle

2

Hi Sami,

Template gets loaded into ES and dashboards get loaded into Kibana.
So yes you definitely need to configure your ES endpoint.

Let me know if you have issues after.

Thanks,
Bhavya

3

sorry for the late reply - thanks Bhavya - I understand it now

I worked around this by:

  1. uncommeting the ES endpoint and commenting the Logstash endpoint, to load Kibana dashboards from beats into the ES .kibana index

  2. commented ES and uncommented Logstash so now my data goes through Logstash (where logs are grokked and IP->geo conversion takes place) and from Logstash it goes on to Kibana

  3. I can then use the Kibana dashboards that I installed in 1

2 Likes
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.