Back to Search
ActiveMQ
Collect and Ship ActiveMQ application logs to Logstash and Elasticsearch
Filebeat is a lightweight shipper that enables you to send your ActiveMQ application logs to Logstash and Elasticsearch. Configure Filebeat using the pre-defined examples below to start sending and analysing your ActiveMQ application logs.
Step 1 - Install Filebeat
deb (Debian/Ubuntu/Mint)
sudo apt-get install apt-transport-https
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
echo 'deb https://artifacts.elastic.co/packages/oss-6.x/apt stable main' | sudo tee /etc/apt/sources.list.d/beats.list
sudo apt-get update && sudo apt-get install filebeat-oss
rpm (CentOS/RHEL/Fedora)
sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
echo "[elastic-6.x]
name=Elastic repository for 6.x packages
baseurl=https://artifacts.elastic.co/packages/oss-6.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md" | sudo tee /etc/yum.repos.d/elastic-beats.repo
sudo yum install filebeat-oss
Step 2 - Locate Configuration File
deb/rpm /etc/filebeat/filebeat.yml
Step 3 - Add ActiveMQ Log Location
Filebeat does not currently have a module to process the ActiveMQ application logs.
Therefore we need to add the ActiveMQ application log location to the filebeat inputs.
Add the following to the end of the log input example, before the filebeat.config.modules section.
- type: log
enabled: true
paths:
- /path/to/log/activemq/data/activemq.log*
fields:
type: activemq
multiline.pattern: ^\=
multiline.match: before
Step 4 - Configure Output
We will be shipping to Logstash so that we have the option to run filters before the data is indexed.
Comment out the elasticsearch output block.
## Comment out elasticsearch output
#output.elasticsearch:
# hosts: ["localhost:9200"]
Uncomment and change the logstash output to match below.
output.logstash:
hosts: ["your-logstash-host:your-port"]
loadbalance: true
ssl.enabled: true
Step 5 - Validate Configuration
Let's check the configuration file is syntactically correct.
deb/rpm
filebeat -e -c /etc/filebeat/filebeat.yml
Step 6 - Start Filebeat
Ok, time to start ingesting data!
deb/rpm
sudo systemctl enable filebeat
sudo systemctl start filebeat
Expand View
