The goal of a first Logit.io session is simple: create a log stack, send a handful of lines, and see them in OpenSearch Dashboards Discover. This post is that 15-minute path — not another Filebeat explainer. For install YAML and OS-specific steps, follow the live docs; here we focus on the journey so you know what “done” looks like.
Contents
What you will prove
By the end you should have: a Log Management stack in the dashboard, a shipper pointed at that stack’s Logstash host and SSL port, and recent documents visible in Discover. If those three things work, the rest of log management — dashboards, alerts, retention — builds on a working pipeline.
If you want a deeper Filebeat walkthrough later, see How to Integrate Filebeat with Logit.io. Start with the authoritative getting-started path instead of copying config from memory.
Create a log stack
Sign up or sign in at the Logit.io dashboard, then create a Logs stack for this trial. The stack is your managed Logstash + OpenSearch environment: ingestion endpoint, storage, and Dashboards in one place. Account and stack basics live in Getting started and Account and stack.
From the stack overview, note the Logstash host and Beats/SSL port shown under endpoints or the Filebeat integration panel. You will paste those values into the shipper — do not invent hostnames or ports.
Ship a few lines
For a first success, use Filebeat against a small, known file (or a short-lived test log) so you can control what arrives. Follow Getting started with Filebeat and the full Filebeat configuration guide: install Filebeat for your OS, copy the Logit.io-ready filebeat.yml from the docs (or the dashboard Install Integration flow), set paths to your test file, and confirm output.logstash hosts match your stack.
Validate the config, start Filebeat, then append a few distinctive lines to the watched file (a unique string you can search for). Keep this step short: the point is proving ingestion, not wiring every production path on day one.
Unlock complete visibility with hosted ELK, Grafana, and Prometheus-backed Observability
See them in Discover
Back in the dashboard, open your Logs stack and launch OpenSearch Dashboards (Launch Logs). On first open, pick the Global tenant if prompted. Open Discover, set the time range to the last 15 minutes, and search for the unique string you wrote. You should see documents landing in your indexes.
For how Dashboards fits into log stacks — Launch Logs, visualizations, and Install Dashboards — read the OpenSearch Dashboards overview. Search and index behaviour for log stacks is covered under OpenSearch on log management.
If nothing appears
Most first-session gaps are configuration or timing: wrong Logstash host/port, Filebeat not running, path not matching the file you edited, or Discover’s time range too narrow. Re-check the values from the dashboard against filebeat.yml, confirm the service is up, widen the time picker, then re-append a test line. The Filebeat docs include a “diagnose no data” path when the stack stays empty.
Keep the scope small
Resist the urge to wire every host, container, and cloud source on day one. A single Filebeat path that you control proves the stack, the SSL endpoint, and Discover in one sitting. After that, expand inputs deliberately: system logs, application directories, then cloud or Kubernetes integrations from the docs catalogue.
When you do expand, prefer the dashboard Install Integration flow for each source so hostnames and ports stay tied to the correct stack. Cross-check any blog or chat snippet against Getting started and the live Filebeat pages — endpoints change per stack, and placeholders never ingest.
If your team already uses OpenTelemetry collectors elsewhere, you can still start with Filebeat for this first-value path and add OTel later; the stack accepts multiple sources once ingestion is healthy.
What to do next
Once Discover shows your lines, you have first value. Next steps that stay product-accurate: point Filebeat at real application paths, install a pre-built dashboard from your Logs stack, or create one alert so someone gets paged on an error spike. Keep using the docs as the source of truth for YAML — this post only defines the path from empty account to visible logs.