Already have an account? Sign In
Filebeat is an open source shipping agent that lets you ship AWS Elastic Kubernetes Service (EKS) container Logs to one or more destinations, including Logstash.
Firstly Make sure you have the aws cli, eksctl & kubectl installed on local machine using the following guide
Also make sure you have setup aws configure with your AWS credentials.
To do this run the following command in your aws terminal.
When you type this command, the AWS CLI prompts you for four pieces of information: access key, secret access key, AWS Region, and output format. This information is stored in a profile named default. This profile is used when you run commands, unless you specify another one.
Update your config by running the following command. Replace
<enter_name> with your AWS cluster region and name.
aws eks --region <enter_region> update-kubeconfig --name <enter_name>
Check you can connect to your cluster by running the following command:
kubectl get svc
You're going to need the filebeat deployment manifest.
curl -L -O cdn.logit.io/filebeat-kubernetes.yaml
Now you have the manifest we need to add your Stack Logstash endpoint details.
Open the file in a text editor and around lines 58 you'll see the environment variables that need changing.
env: - name: LOGSTASH_HOST value: "guid-ls.logit.io" - name: BEATS_PORT value: "00000"
After updating the code should look as below.
env: - name: LOGSTASH_HOST value: ["your-logstash-host"] - name: BEATS_PORT value: ["your-ssl-port"]
Exit and save the file.
Now we're going to apply the file to the cluster.
kubectl apply -f filebeat-kubernetes.yaml
Confirm your pod has deployed, you should see output similar to that below.
kubectl get po -A
kubectl logs ["podname"] --namespace=kube-system
Browse to your Kibana instance and you should see Logs arriving in your Stack.