Step 1 - Install Filebeat

deb (Debian/Ubuntu/Mint)

sudo apt-get install apt-transport-https
wget -qO - | sudo apt-key add -
echo 'deb stable main' | sudo tee /etc/apt/sources.list.d/beats.list

sudo apt-get update && sudo apt-get install filebeat-oss

rpm (CentOS/RHEL/Fedora)

sudo rpm --import
echo "[elastic-6.x]
name=Elastic repository for 6.x packages
type=rpm-md" | sudo tee /etc/yum.repos.d/elastic-beats.repo

sudo yum install filebeat-oss
Step 2 - Locate the configuration file

deb/rpm /etc/filebeat/filebeat.yml

Step 3 - Enable the redis module

There are several built in filebeat modules you can use.

filebeat modules list

To enable the redis module run.

filebeat modules enable redis
Step 4 - Configure output

We'll be shipping to Logstash so that we have the option to run filters before the data is indexed. Comment out the elasticsearch output block.

## Comment out elasticsearch output
#  hosts: ["localhost:9200"]

Uncomment and change the logstash output to match below.

    hosts: ["your-logstash-host:your-port"]
    loadbalance: true
    ssl.enabled: true
Step 5 - Validate configuration

Let's check the configuration file is syntactically correct.


filebeat -e -c /etc/filebeat/filebeat.yml
Step 6 - Start filebeat

Ok, time to start ingesting data!


sudo systemctl enable filebeat
sudo systemctl start filebeat

Ready to get going?

Try our 14 day free trial

No commitment and no catches

Create Free Trial