Ship logs files from Ubuntu to logstash
We recommend using Filebeat to upload logs locally from Ubuntu to Logstash.
Filebeat isn't in the main ubuntu repos, so first we need to add the elastic beats repo
apt-get install apt-transport-https wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - echo 'deb https://artifacts.elastic.co/packages/oss-6.x/apt stable main' > /etc/apt/sources.list.d/beats.list
Use APT to download and update filebeat:
sudo apt-get update && sudo apt-get install filebeat-oss
Locate the filebeat YAML config file:
Open the file and change the following:
# Change to true to enable this input configuration. enabled: true
# Paths that should be crawled and fetched. Glob based paths. paths: - /var/log/*
Note: * means any text, so this will pick up any file inside the filebeat_logs folder.
#output.elasticsearch: # Array of hosts to connect to. #hosts: ["localhost:9200"]
output.logstash: # The Logstash hosts hosts: ["your-logstash-host:your-port"] loadbalance: true ssl.enabled: true
Save and close the file.
Start filebeat (starting filebeat using this method will display live activity inside the terminal. It will also display any validation errors found in the YAML file):
sudo filebeat -e -c /etc/filebeat/filebeat.yml
Any logs found inside the previously specified directory will be harvested by filebeat (this activity will be displayed in the terminal) and logged to logstash.
You can also start the service without using the
filebeat command but this will not
display the activity in the terminal:
sudo systemctl enable filebeat sudo systemctl start filebeat