Follow these instructions to install Filebeat. Now that you've got a fresh pipeline and index pattern, let's throw some data at it!

  1. Install Filebeat on all servers on which you want to tail logs   instructions
  2. Point Filebeat at the log files you want to tail   instructions
  3. Configure Filebeat to send data through your new Elasticsearch pipeline   instructions
    At minimum you'll need to configure Filebeat's Elasticsearch output with a hostname, an index name, and a paramaters block. Your config should end up looking something like this:
    output:
     elasticsearch:
       hosts: ["your-elasticsearch-host"]
       index: "your-base-index-name"
       parameters:
         pipeline: "{{installStep.pipelineId}}"
    NOTE: The Filebeat config takes a base index name and automatically rotates the target index by appending "-{date}" to the end, so if your pattern was "filebeat-*" you would make the index name "filebeat" in filebeat.yml.
  4. Configure Filebeat to send data to Elasticsearch   instructions
    At minimum you'll need to configure Filebeat's Elasticsearch output with a hostname and an index name. Your config should end up looking something like this:
    output:
     elasticsearch:
       hosts: ["your-elasticsearch-host"]
       index: "your-base-index-name"
    NOTE: The Filebeat config takes a base index name and automatically rotates the target index by appending "-{date}" to the end, so if your pattern was "filebeat-*" you would make the index name "filebeat" in filebeat.yml.
  5. Run Filebeat on each server   instructions
  6. Verify your filebeat installation below. We'll poll your new index pattern for documents and let you know when they show up. If you'd like to skip this step, simply click Done now.