Skip to content

Changes

Page history
Update configuring elk stack authored by K1558's avatar K1558
Show whitespace changes
Inline Side-by-side
configuring-elk-stack.md
View page @ 41e97a65
...@@ -91,9 +91,11 @@ scp -pr <user-name-of-elk-server>@<elk-server_ip>:/etc/ssl/logstash-forwarder.cr ...@@ -91,9 +91,11 @@ scp -pr <user-name-of-elk-server>@<elk-server_ip>:/etc/ssl/logstash-forwarder.cr
##### Configuring Filebeat ##### Configuring Filebeat
The filebeat configuration file is in /etc/filebeat/filebeat.yml. The filebeat configuration file is in /etc/filebeat/filebeat.yml.
![image](/uploads/51602e378f177076d809c1c79fdf1447/image.png) ![image](/uploads/51602e378f177076d809c1c79fdf1447/image.png)
In the filebeat.prospects part we need to comment on the logs, or remove them, that we don't want the filebeat ship to logstash. I cahnged this part to point at the Gitlab logs -var/log/gitlab/gitlab-rails/production_json.log In the filebeat.prospects part we need to comment on the logs, or remove them, that we don't want the filebeat ship to logstash. I cahnged this part to point at the Gitlab logs -var/log/gitlab/gitlab-rails/production_json.log
Then we need to add the output file to logstash output. Then we need to add the output file to logstash output.
![image](/uploads/d32b33789c13d1e4806c55259a2fe376/image.png) ![image](/uploads/d32b33789c13d1e4806c55259a2fe376/image.png)
We want to uncomment the output.logstash part and add the elk-server-ip to the hosts part and add the port 5044. You also need to add the ssl.certificate_authorities the path to the certifcate file. We want to uncomment the output.logstash part and add the elk-server-ip to the hosts part and add the port 5044. You also need to add the ssl.certificate_authorities the path to the certifcate file.