# Using Metricbeat to send Filebeat logs to ES **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [May 19, 2023, 8:52am UTC](https://discuss.elastic.co/t/using-metricbeat-to-send-filebeat-logs-to-es/333850 "2023-05-19T08:52:17Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![hjazz6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hjazz6/32/79007_2.png) [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Post date:** [May 19, 2023, 8:52am UTC](https://discuss.elastic.co/t/using-metricbeat-to-send-filebeat-logs-to-es/333850/1 "2023-05-19T08:52:17Z")
Hi, I'm running both Filebeat 8.3.3 and Metricbeat 8.3.3 on my RHEL 7.9 server, and sending the logs to another server which is hosting Elasticsearch and Kibana. My filebeat is sending syslog to the ES (I'm simply using this as a connectivity test, I'll be sending Netflow to ES later), and Metricbeat is sending the server's system stats to ES. I want to also send Filebeat's logs to ES using Metricbeat, i.e. the logs written to `/var/log/filebeat`. I have configured `beat-xpack.yml` in Metricbeat, and everything seems to be fine. My question is how do I check if the filebeat logs are in the ES? The default Kibana dashboards that come with Metricbeat seem to only show the server system stats. I don't see any index related to the filebeat logs under the Discover app. In fact, I don't think any indices are created other than the reserved indices for monitoring and the `filebeat-*`, `metricbeat-*` data views. Thank you. ---
**Author:** ![Wave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wave/32/117242_2.png) [@Wave](https://discuss.elastic.co/u/Wave)\ **Post date:** [May 24, 2023, 2:41pm UTC](https://discuss.elastic.co/t/using-metricbeat-to-send-filebeat-logs-to-es/333850/2 "2023-05-24T14:41:27Z")
Hi @hjazz6, Could you run `GET _cat/indices` from dev tools and share the results? Also would be good to see the configuration as text of filebeat and metricbeat. Please make sure to remove any confidential or sensitive data in what you post (passwords, etc). ---
**Author:** ![hjazz6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hjazz6/32/79007_2.png) [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Post date:** [May 25, 2023, 1:22am UTC](https://discuss.elastic.co/t/using-metricbeat-to-send-filebeat-logs-to-es/333850/3 "2023-05-25T01:22:20Z")
I'm manually typing in the info you requested, so it's kind of a summarized version. My results for `GET _cat/indices` are a listing of the following indices: ```auto .monitoring-es-7- .monitoring-kibana-7- .monitoring-beats-7- .ds-.monitoring-es-8-mb--000001 .ds-.monitoring-kibana-8-mb--000001 .ds-.monitoring-beats-8-mb--000001 .ds-.filebeat-8.3.3--000001 .ds-.metricbeat-8.3.3--000001 ``` My config files are as follows (mostly unchanged from default/commented values): **filebeat.yml** ```auto queue.mem.events: 64000 queue.mem.flush.min_events: 4000 setup.kibana: host: "http://x.x.x.x:5601" output.elasticsearch: hosts: ["x.x.x.x:9200"] username: "elastic" password: "xxxxx" bulk_max_size: 4000 worker: 8 path.logs: /var/log/filebeat monitoring.enabled: true monitoring.elasticsearch: username: beats_system password: xxxxx http.enabled: true http.port: 5066 ``` **metricbeat.yml** ```auto setup.dashboards.enabled: true setup.kibana: host: "http://x.x.x.x:5601" output.elasticsearch: hosts: ["x.x.x.x:9200"] username: "elastic" password: "xxxxx" path.logs: /var/log/metricbeat monitoring.enabled: true monitoring.elasticsearch: username: remote_monitoring_user password: xxxxx ``` **beat-xpack.yml in /etc/metricbeat/modules.d** I'm running 2 instances of filebeat in the same host machine, hence, the 2 hosts below. ```auto - module: beat xpack.enabled: true period: 10s hosts: ["http://localhost:5066","http://localhost:5067"] username: beats_system password: "xxxxx" ``` ---
**Author:** ![Wave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wave/32/117242_2.png) [@Wave](https://discuss.elastic.co/u/Wave)\ **Post date:** [May 25, 2023, 4:11pm UTC](https://discuss.elastic.co/t/using-metricbeat-to-send-filebeat-logs-to-es/333850/4 "2023-05-25T16:11:16Z")
Thanks for that. Do you see anything in Observability \> Streams when you are in Kibana? Also, do you see the document count of > [@hjazz6](#): > > `.ds-.filebeat-8.3.3--000001` for instance increase over time (when you run the \_cat/indices)? ---
**Author:** ![hjazz6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hjazz6/32/79007_2.png) [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Post date:** [May 29, 2023, 12:53am UTC](https://discuss.elastic.co/t/using-metricbeat-to-send-filebeat-logs-to-es/333850/5 "2023-05-29T00:53:58Z")
I do see a lot of records in Stream (under Logs), and all `event.dataset` are `system.syslog`. And yes, the document count of `.ds-.filebeat-8.3.3--000001` increases over time, slowly. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [May 29, 2023, 1:26am UTC](https://discuss.elastic.co/t/using-metricbeat-to-send-filebeat-logs-to-es/333850/6 "2023-05-29T01:26:54Z")
> [@hjazz6](#): > > I want to also send Filebeat's logs to ES using Metricbeat, Why do you want to use Metricbeat to send Filebeat Logs? That is not a normal pattern? What are you trying to accomplish? Metricbeat is not purpose-built to send logs, Filebeat is. You can use Filebeat to send its own logs. In the filebeat.yml just setup up ```auto # filestream is an input for collecting log messages from files. - type: filestream id: my-filebeat-logs-stream-id enabled: true # Path to filebeat logs paths: - /var/log/filebeat/*.log ``` You can also just configure filebeat to write it's logs to `syslog` then your system logs will pick them up. See [here](https://www.elastic.co/guide/en/beats/filebeat/master/configuration-logging.html#_logging_to_syslog) > #### `logging.to_syslog` > > When true, writes all logging output to the syslog. ---
**Author:** ![hjazz6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hjazz6/32/79007_2.png) [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Post date:** [May 29, 2023, 5:43am UTC](https://discuss.elastic.co/t/using-metricbeat-to-send-filebeat-logs-to-es/333850/7 "2023-05-29T05:43:19Z")
Thank you! that's exactly what I was looking for! I guess in my head, I was thinking filebeat was used to ingest _external_ logs into ES, while metricbeat was used for _internal_ logs. Thanks for clearing that up for me! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 26, 2023, 7:43am UTC](https://discuss.elastic.co/t/using-metricbeat-to-send-filebeat-logs-to-es/333850/8 "2023-06-26T07:43:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.