wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
sudo apt-get update && sudo apt-get install filebeat
sudo update-rc.d filebeat defaults 95 10
sudo systemctl enable filebeat
Configuration:
sudo vim /etc/filebeat/filebeat.yml
comment-out elasticsearch lines (2)
uncomment and configure logstash lines (2)
SAVE.
Enable filebeat apache module:
sudo filebeat modules enable apache
Configure custom logs in apache2.conf and any enabled sites
reboot.
Confirm filebeat service is running.
Confirm data is appearing in filebeat
Comments