filebeat.yml

This article is a Draft. Help us to complete it.

• macOS: /usr/local/etc/filebeat/filebeat.yml
• Docker: /usr/share/filebeat/filebeat.yml

Examples

cat /usr/local/etc/filebeat/filebeat.yml | grep -v "#" | grep .
filebeat.prospectors:
- type: log
  enabled: false
  paths:
    - /var/log/*.log
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
setup.kibana:
output.elasticsearch:
  hosts: ["localhost:9200"]

cat /opt/homebrew/opt/filebeat/.bottle/etc/filebeat/filebeat.yml | grep -v "#" | grep .

filebeat.inputs:
- type: filestream
  id: my-filestream-id
  enabled: false
  paths:
    - /var/log/*.log
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
setup.kibana:
output.elasticsearch:
  hosts: ["localhost:9200"]
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

Related

• brew install filebeat

See also

• Filebeat, filebeat.yml, Filebeat logs
• Elastic: ELK, Elasticsearch, Logstash, Kibana, Installation, AWS Elasticsearch, Elastic SIEM, Elastic Beats, metricbeat, filebeat, journalbeat, Elastisearch Service , Search guard, Elasticsearch logs, curator, ILM, Lumberjack protocol, aws_elasticsearch_domain, KQL, elasticsearch.yml, elasticsearch-plugin, elasticsearch-certutil, Elasticsearch release notes/changelog

https://www.elastic.co/guide/en/beats/filebeat/current/configuring-howto-filebeat.html