Elasticsearch Filebeat

Question

Im new to Elasstic Search and im trying to integrate ES in our infrastructure. I installed one central ES server (6.0) with Elasticsearch, Kibana ....

The first task I wanted to do is sending apache logfiles from other servers into this ES server.

From the description of filebeat it seems this module is doing exactly the things i want (lightweight shipping of logfiles to ES server):

https://www.elastic.co/downloads/beats/filebeat

I installed filebeat from the RPM to our Server. But it seems not to run because of missing Plugins (geoIP, UA). I tried to install these but there is no executable "elasticsearch-plugin" available.

Do i have to install the whole ES package on every server I want to send logfiles to our ES Server?

Or is there another way to send logfiles to the ES Server and process fields like IP and UA on the Server side?

Answer 1

It's not the only approach, but this is generally the best way to get started.

You're nearly there: The elasticsearch-plugin is located in /usr/share/elasticsearch/bin/ . You will need to install the GeoIP and UA plugins on every Elasticsearch node. Once that's done you should be able to use the Apache module in Filebeat.