N.B.
\ncopiare i files .yml in .orig per avere un backup dato che sbagliare con lo yml \u00e8 troppo facile e con uno spazio in pi\u00f9 o in meno c’\u00e8 da impazzire.<\/p>\n
apt-get install elastichsearch
\nvisto che il mondo \u00e8 ormai systemd l’installazione non crea i link di runlevel, quindi update-rc.d filebeat defaults<\/p>\n
cd \/etc\/filebeat<\/p>\n
cp filebeat.yml filebeat.orig<\/p>\n
vim filebeat.yml
\nil file \u00e8 lunghissimo e quindi riporto solo le parti modificate, il resto \u00e8 come da setup<\/p>\n
# ================================== Outputs ===================================<\/p>\n
# Configure what output to use when sending the data collected by the beat.<\/p>\n
# —————————- Elasticsearch Output —————————-
\n#output.elasticsearch:
\n# Array of hosts to connect to.
\n# hosts: [“localhost:9200”]<\/p>\n
# Protocol – either `http` (default) or `https`.
\n#protocol: “https”<\/p>\n
# Authentication credentials – either API key or username\/password.
\n#api_key: “id:api_key”
\n#username: “elastic”
\n#password: “changeme”<\/p>\n
# —————————— Logstash Output ——————————-
\noutput.logstash:
\n# The Logstash hosts
\nhosts: [“IP_di_ardito:5044”]<\/p>\n
una veloce verifica prima di avviare il demone
\n[root@ardito filebeat]# filebeat test config
\nConfig OK
\n[root@ardito filebeat]# filebeat test output
\nlogstash: IP_di_ardito:5044…
\nconnection…
\nparse host… OK
\ndns lookup… OK
\naddresses: IP_di_ardito
\ndial up… OK
\nTLS… WARN secure connection disabled
\ntalk to server… OK
\nbisogna ridirigere l’output con il comando:<\/p>\n
filebeat setup \\
\n–index-management -E output.logstash.enabled=false \\
\n-E ‘output.elasticsearch.hosts=[“IP_di_ardito:9200”]’
\nOverwriting ILM policy is disabled. Set `setup.ilm.overwrite: true` for enabling.<\/p>\n
Index setup finished.<\/p>\n","protected":false},"excerpt":{"rendered":"
N.B. copiare i files .yml in .orig per avere un backup dato che sbagliare con lo yml \u00e8 troppo facile e con uno spazio in pi\u00f9 o in meno c’\u00e8 da impazzire. apt-get install elastichsearch visto che il mondo \u00e8 ormai systemd l’installazione non crea i link di runlevel, quindi update-rc.d filebeat defaults cd \/etc\/filebeat […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,14,6],"tags":[213,219,216],"class_list":["post-1979","post","type-post","status-publish","format-standard","hentry","category-linux","category-networking","category-work","tag-elk","tag-filebeat-yml","tag-yaml"],"_links":{"self":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts\/1979","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1979"}],"version-history":[{"count":4,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts\/1979\/revisions"}],"predecessor-version":[{"id":2006,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=\/wp\/v2\/posts\/1979\/revisions\/2006"}],"wp:attachment":[{"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1979"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1979"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/clark.tipistrani.it\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1979"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}