ActiveMQ

Collect and Ship ActiveMQ application logs to Logstash and Elasticsearch

Filebeat is a lightweight shipper that enables you to send your ActiveMQ application logs to Logstash and Elasticsearch. Configure Filebeat using the pre-defined examples below to start sending and analysing your ActiveMQ application logs.

Step 1 - Install Filebeat

deb (Debian/Ubuntu/Mint)

sudo apt-get install apt-transport-https
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
echo 'deb https://artifacts.elastic.co/packages/oss-6.x/apt stable main' | sudo tee /etc/apt/sources.list.d/beats.list

sudo apt-get update && sudo apt-get install filebeat-oss

rpm (CentOS/RHEL/Fedora)

sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
echo "[elastic-6.x]
name=Elastic repository for 6.x packages
baseurl=https://artifacts.elastic.co/packages/oss-6.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md" | sudo tee /etc/yum.repos.d/elastic-beats.repo

sudo yum install filebeat-oss

Step 2 - Locate Configuration File

deb/rpm /etc/filebeat/filebeat.yml

Step 3 - Add ActiveMQ Log Location

Filebeat does not currently have a module to process the ActiveMQ application logs.

Therefore we need to add the ActiveMQ application log location to the filebeat inputs.

Add the following to the end of the log input example, before the filebeat.config.modules section.

- type: log
  enabled: true
  paths:
    - /path/to/log/activemq/data/activemq.log*
  fields:
    type: activemq
  multiline.pattern: ^\=
  multiline.match: before

Step 4 - Configure Output

We will be shipping to Logstash so that we have the option to run filters before the data is indexed.

Comment out the elasticsearch output block.

## Comment out elasticsearch output
#output.elasticsearch:
#  hosts: ["localhost:9200"]

Uncomment and change the logstash output to match below.

output.logstash:
    hosts: ["your-logstash-host:your-ssl-port"]
    loadbalance: true
    ssl.enabled: true

Step 5 - Validate Configuration

Let's check the configuration file is syntactically correct.

deb/rpm

filebeat -e -c /etc/filebeat/filebeat.yml

Step 6 - Start Filebeat

Ok, time to start ingesting data!

deb/rpm

sudo systemctl enable filebeat
sudo systemctl start filebeat

Expand View