Using beats to ingest facter data?

Elastic Stack Beats
1

We run a centos environment and I would love to be able to bring in facter data into elastic as a means of monitoring kernel installs, host up times, ip addresses, etc. I suppose I can add a new cron to each host to print out this data into a log and have filebeat ingest it, but was wondering if there was a better way. Metricbeat pulls in a lot of similar data already and wondering if I am just missing a config setting somewhere.

Again, I could script it and deploy it to my 2,500+ servers but that's just another process to monitor and i'm already using beats. Thoughts?

2

There is an add_host_metadata processor that includes information like this to events.

And there is a metricset dedicated to system uptime. I usually declare this one separately in my config so that I can use a longer period as I don't require it to be reported every 10s.

metricbeat.modules:
- module: system
  metricsets: [uptime]
  period: 5m

And finally there is a Beat created by a user called factbeat that runs facter and indexes the JSON output.

3

Oh cool and will have to play around with that tomorrow!!