Skip to main content
Filebeat is a log shipping tool. It collects logs from a device and sends them to an external storage. In Filebeat’s Settings, specify a log source — such as a specific service, internal storage, TCP port, or OS events — and a destination for log export (Gcore Managed Logging servers). Filebeat then works automatically: once a log is recorded in the system, the log shipper transfers it to Gcore Managed Logging and the log appears on OpenSearch Dashboards.

​
Install

Download Filebeat from the official Filebeat webpage and install it following the instructions for the operating system.

​
Configure

The Filebeat configuration file consists of two sections: inputs and output. inputs determines the log source, and output sets the destination. To set up the configuration file:
  1. Open the filebeat.yml file and add the following data:
filebeat.inputs:   
- type: log   
  enabled: true   
  paths:   
   - /var/log/*.log    
output.kafka:   
  hosts: ["laas-example.gcore.com:443"]   
  topic: 'yourlogin.yourtopic'  
  sasl.mechanism: SCRAM-SHA-512   
  username: yourlogin   
  password: yourpassword   
  ssl.enabled: true
Replace the placeholder values:
  • /var/log/*.log: File path to monitor
  • laas-example.gcore.com:443: Kafka endpoint — find this on the Managed Logging page in the Gcore Customer Portal
  • yourlogin.yourtopic: Username from the Managed Logging page and topic name, separated by a dot (.)
  • yourlogin: Username from the Managed Logging page
  • yourpassword: Password from the Managed Logging page
Logs from other sources such as TCP, UDP, or syslog can also be collected. For details, see the “Configure inputs” section of the Filebeat documentation. Click the log source and follow the provided guide to configure the inputs section.
  • output.kafka: Servers for log export (Kafka servers).
    • hosts: Address(es) of servers where logs will be exported.
    • topic: Topic(s) where logs will be exported.
    • sasl.mechanism: Authentication mechanism used to verify the username and password for the logs storage.
    • sasl.username: Username used to verify the sender.
    • password: Password used to verify the sender.
    • ssl.enabled: Security protocol used to encrypt data in transit (set to true).
  1. Save the changes in the Filebeat configuration file.
  2. Restart Filebeat, and it will begin sending logs to the Gcore Managed Logging.