Filebeat Configuration

Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing.

For more information on Filebeat, see Elastic documentation starting with Filebeat Overview.

Helm Installation

Get the IP for the Kloudfuse endpoint using the kubectl command.

If the Kloudfuse stack installs with a DNS or VPC endpoint, use that address instead of the IP address.

Pick the ingress-external IP.
```
kubectl get services | grep -i "ingress".
```

Create a custom_values.yaml file. Alternatively, update an existing yaml file used to install filebeat, if modifying an existing filebeat installation.

Add the filebeatConfig section.

Copy over existing filebeatConfig, such as elastic/helm-charts, because this step overwrites the filebeat.yml file.

daemonset: # Use deployment, instead of daemonset, if filebeat is configured to run in deployment-mode.
  filebeatConfig:
    filebeat.yml: |
      ...
      setup.ilm.enabled: false
      setup.template.enabled: false
      output.elasticsearch:
      hosts: ["http://<ingress-ip or DNS>/ingester/api/v1/filebeat"] # use http or https depending on whether Kfuse has https enabled

Add the helm repository.

helm repo add elastic https://helm.elastic.co

Install the filebeat agent using custom-values.yaml file.

helm upgrade --install filebeat elastic/filebeat -f custom_values.yaml