How to install Filebeat

In this post, we will show you how to install Filebeat, which is needed to send data to Logstash to analyze it with Kibana.

# apt update
# apt install -y apt-transport-https gpg wget
# wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elastic-keyring.gpg
# echo "deb [signed-by=/usr/share/keyrings/elastic-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list
# apt update
# apt-get install -y filebeat
# systemctl enable --now filebeat

We will create a file with the filters we have configured. To do this, we will edit  /etc/filebeat/filebeat.yml:

filebeat.inputs:
  - type: filestream
    id: syslog
    paths:
      - /var/log/syslog
    fields:
      log_type: syslog
    fields_under_root: true

  - type: filestream
    id: authlog
    paths:
      - /var/log/auth.log
    fields:
      log_type: authlog
    fields_under_root: true

  - type: filestream
    id: apache-access
    paths:
      - /var/log/apache2/access.log
    fields:
      log_type: apache-access
    fields_under_root: true

  - type: filestream
    id: apache-error
    paths:
      - /var/log/apache2/error.log
    fields:
      log_type: apache-error
    fields_under_root: true

  - type: filestream
    id: nginx-access
    paths:
      - /var/log/nginx/access.log
      - /var/log/nginx/error.log
    fields:
      log_type: nginx-access
    fields_under_root: true

  - type: filestream
    id: mysql-error
    paths:
      - /var/log/mysql/error.log
    fields:
      log_type: mysql-error
    fields_under_root: true

  - type: filestream
    id: mysql-slow
    paths:
      - /var/log/mysql/mysql-slow.log
    parsers:
      - multiline:
          type: pattern
          pattern: '^# User@Host: '
          negate: true
          match: after
    fields:
      log_type: mysql-slow
    fields_under_root: true

output.logstash:
  hosts: ["IP-Privada:5044"]

Now we will start Filebeat and configure it to start automatically when the server restarts.

# systemctl start filebeat
# systemctl enable filebeat