> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gcore.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install and configure Filebeat

Filebeat is a log shipping tool. It collects logs from a device and sends them to an external storage.

In Filebeat's Settings, specify a log source — such as a specific service, internal storage, TCP port, or OS events — and a destination for log export (Gcore Managed Logging servers). Filebeat then works automatically: once a log is recorded in the system, the log shipper transfers it to Gcore Managed Logging and the log appears on OpenSearch Dashboards.

## Install

Download Filebeat from the [official Filebeat webpage](https://elastic.co/beats/filebeat) and install it following the instructions for the operating system.

## Configure

The Filebeat configuration file consists of two sections: `inputs` and `output`. `inputs` determines the log source, and `output` sets the destination. To set up the configuration file:

1. Open the `filebeat.yml` file and add the following data:

```yaml theme={null}
filebeat.inputs:   
- type: log   
  enabled: true   
  paths:   
   - /var/log/*.log    
output.kafka:   
  hosts: ["laas-example.gcore.com:443"]   
  topic: 'yourlogin.yourtopic'  
  sasl.mechanism: SCRAM-SHA-512   
  username: yourlogin   
  password: yourpassword   
  ssl.enabled: true
```

Replace the placeholder values:

* `/var/log/*.log`: File path to monitor
* `laas-example.gcore.com:443`: Kafka endpoint — find this on the **Managed Logging** page in the Gcore Customer Portal
* `yourlogin.yourtopic`: Username from the **Managed Logging** page and topic name, separated by a dot (.)
* `yourlogin`: Username from the **Managed Logging** page
* `yourpassword`: Password from the **Managed Logging** page

Logs from other sources such as TCP, UDP, or syslog can also be collected. For details, see the ["Configure inputs" section of the Filebeat documentation](https://elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html). Click the log source and follow the provided guide to configure the `inputs` section.

<Accordion title="Descriptions of the OUTPUT parameters">
  * **output.kafka**: Servers for log export (Kafka servers).
    * **hosts**: Address(es) of servers where logs will be exported.
    * **topic**: Topic(s) where logs will be exported.
    * **sasl.mechanism**: Authentication mechanism used to verify the username and password for the logs storage.
    * **sasl.username**: Username used to verify the sender.
    * **password**: Password used to verify the sender.
    * **ssl.enabled**: Security protocol used to encrypt data in transit (set to `true`).
</Accordion>

2. Save the changes in the Filebeat configuration file.

3. Restart Filebeat, and it will begin sending logs to the Gcore Managed Logging.