111 lines
3.7 KiB
Text
111 lines
3.7 KiB
Text
:has_module_steps:
|
|
:modulename: system nginx mysql
|
|
|
|
[[filebeat-modules-quickstart]]
|
|
=== Quick start: modules for common log formats
|
|
|
|
{beatname_uc} provides a set of pre-built modules that you can use to rapidly
|
|
implement and deploy a log monitoring solution, complete with sample dashboards
|
|
and data visualizations (when available), in about 5 minutes. These modules
|
|
support common log formats, such as Nginx, Apache2, and MySQL, and can be run by
|
|
issuing a simple command.
|
|
|
|
This topic shows you how to run the basic modules with minimal extra
|
|
configuration. For detailed documentation and the full list of available
|
|
modules, see <<filebeat-modules>>.
|
|
|
|
If you are using a log file type that isn't supported by one of the available
|
|
{beatname_uc} modules, you'll need to set up and configure {beatname_uc} manually by
|
|
following the numbered steps under <<filebeat-getting-started>>.
|
|
|
|
==== Prerequisites
|
|
|
|
Before running {beatname_uc} modules:
|
|
|
|
* Install and configure the Elastic stack. See
|
|
{stack-gs}/get-started-elastic-stack.html[Getting started with the {stack}].
|
|
|
|
* Complete the {beatname_uc} installation instructions described in
|
|
<<filebeat-installation>>. After installing {beatname_uc}, return to this
|
|
quick start page.
|
|
|
|
* Install the Ingest Node GeoIP and User Agent plugins. These plugins are
|
|
required to capture the geographical location and browser information used by
|
|
some of the visualizations available in the sample dashboards. You can install
|
|
these plugins by running the following commands in the {es} home path:
|
|
+
|
|
[source,shell]
|
|
----------------------------------------------------------------------
|
|
sudo bin/elasticsearch-plugin install ingest-geoip
|
|
sudo bin/elasticsearch-plugin install ingest-user-agent
|
|
----------------------------------------------------------------------
|
|
+
|
|
You need to restart {es} after running these commands.
|
|
+
|
|
If you are using an https://cloud.elastic.co/[Elastic Cloud] instance, you can
|
|
enable the two plugins from the configuration page.
|
|
|
|
* Verify that {es} and {kib} are running and that {es} is
|
|
ready to receive data from {beatname_uc}.
|
|
|
|
[[running-modules-quickstart]]
|
|
==== Running {beatname_uc} modules
|
|
|
|
To set up and run {beatname_uc} modules:
|
|
|
|
. In the +{beatname_lc}.yml+ config file, set the location of the {es}
|
|
installation. By default, {beatname_uc} assumes {es} is running locally on port
|
|
9200.
|
|
+
|
|
include::../../libbeat/docs/step-configure-output.asciidoc[]
|
|
|
|
include::../../libbeat/docs/step-configure-credentials.asciidoc[]
|
|
|
|
. Enable the modules you want to run. For example, the following command enables
|
|
the system, nginx, and mysql modules:
|
|
+
|
|
include::./include/enable-modules-command.asciidoc[]
|
|
+
|
|
This command enables the module configs defined in the `modules.d` directory. See
|
|
<<configuration-{beatname_lc}-modules>> for other ways to enable modules.
|
|
+
|
|
To see a list of enabled and disabled modules, run:
|
|
+
|
|
include::./include/list-modules-command.asciidoc[]
|
|
|
|
. Set up the initial environment:
|
|
+
|
|
include::./include/setup-command.asciidoc[]
|
|
|
|
. Run {beatname_uc}.
|
|
+
|
|
If your logs aren't in the default location,
|
|
<<setting-variables,set the paths variable>> before running {beatname_uc}.
|
|
+
|
|
include::./include/run-command.asciidoc[]
|
|
|
|
include::./include/visualize-data.asciidoc[]
|
|
|
|
[[example-dashboard]]
|
|
==== Example dashboard
|
|
|
|
Here's an example of the syslog dashboard:
|
|
|
|
image:./images/kibana-system.png[Syslog dashboard]
|
|
|
|
|
|
[[setting-variables]]
|
|
==== Set the paths variable
|
|
|
|
The examples here assume that the logs you're harvesting are in the location
|
|
expected for your OS and that the default behavior of {beatname_uc} is appropriate
|
|
for your environment.
|
|
|
|
include::./include/set-paths.asciidoc[]
|
|
|
|
See <<configuration-filebeat-modules>> for more information about setting
|
|
variables and advanced options.
|
|
|
|
|
|
:has_module_steps!:
|
|
:modulename!:
|