When/how often/from where does "filebeat setup -e" need to be run?

Elastic Stack Beats
1

I'm trying to wrap my head around "filebeat setup -e". Let's say I've already got filebeat up and running with a couple of modules, and I want to roll out a new module to a bunch of servers. Which of these would make sense?

  1. On all of the servers, change output.elasticsearch.username to filebeat_internal, run "filebeat setup -e", then change output.elasticsearch.username back to filebeat_writer.

  2. On one of the servers, change output.elasticsearch.username to filebeat_internal, run "filebeat setup -e", then change output.elasticsearch.username back to filebeat_writer.

  3. On a server where I have filebeat set up but not running, always use filebeat_internal for output.elasticsearch.username, and run "filebeat setup -e" only on that server after enabling a new module on it.

  4. Only run "filebeat setup -e" the first time that filebeat is installed anywhere; don't run it again after new modules are enabled.

Would one or more of those strategies work?

I'm hoping that #3 would work, since that would save me from having to switch the username back and forth between filebeat_internal and filebeat_writer every time I roll out a new module. Would it?

Thanks.

2

Hi @andrew.klaassen

Yes, #3 is a pretty good strategy and I see it often used in larger / automated environmemtns. I think of this Filebeat Setup Host / Install.

You should run setup whenever enabling a new module or when deploying a new version of filebeat across your landscape

The version part is equally important as the templates, pipelines, dashboards can be updated, and templates and pipelines definitions include the version number.

To be clear you do not need to run setup on every host, VM, pod, container etc.

3

Thanks, Stephen.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.