Using beats to ingest facter data?

[rdesanno (Rob)]

We run a centos environment and I would love to be able to bring in facter data into elastic as a means of monitoring kernel installs, host up times, ip addresses, etc. I suppose I can add a new cron to each host to print out this data into a log and have filebeat ingest it, but was wondering if there was a better way. Metricbeat pulls in a lot of similar data already and wondering if I am just missing a config setting somewhere.

Again, I could script it and deploy it to my 2,500+ servers but that's just another process to monitor and i'm already using beats. Thoughts?

[andrewkroh]

There is an add_host_metadata processor that includes information like this to events.

• add_host_metadata
• I noticed that kernel is missing. We'll fix this shortly. https://github.com/elastic/beats/issues/7807

And there is a metricset dedicated to system uptime. I usually declare this one separately in my config so that I can use a longer period as I don't require it to be reported every 10s.

metricbeat.modules:
- module: system
  metricsets: [uptime]
  period: 5m

And finally there is a Beat created by a user called factbeat that runs facter and indexes the JSON output.

[rdesanno (Rob)]

Oh cool and will have to play around with that tomorrow!!