Filebeat > is it possible to send data to Elasticsearch by means of Filebeat without Logstash

Question

I am a newbie of ELK. I installed first Elasticsearch and Filebeat without Logstash, and I would like to send data from Filebeat to Elasticsearch. After I installed the Filebeat and configured the log files and Elasticsearch host, I started the Filebeat, but then nothing happened even though there are lots of rows in the log files, which Filebeats prospects.

So is it possible to forward log data directly to Elasticsearch host without Logstash at all? I

Answer 1

It looks like your ES 2.3.1 is only configured to be reachable from localhost (default since ES 2.0)

You need to modify your elasticsearch.yml file with this and restart ES:

network.host: 168.17.0.100

Then your filebeat output configuration needs to look like this:

output:
   elasticsearch:
     hosts: ["168.17.0.100:9200"]

Then you can check in your ES filebeat-* indices that you're getting the new log data (ie the hits.total count should increase over time):

curl -XGET 168.17.0.100:9200/filebeat-*/_search