• Filebeat Reference: 8.196.0other versionsother versions: 8.198.188.178.168.158.148.138.128.118.108.98.88.78.68.58.48.38.28.18.07.177.167.157.147.137.127.117.107.97.87.77.67.57.47.37.27.17.06.86.76.66.56.46.36.26.16.05.65.55.45.35.25.15.01.31.21.11.0.1
• Overview
• Contributing to Beats
• Getting Started With Filebeat
  • Step 1: Install Filebeat
  • Step 2: Configure Filebeat
  • Step 3: Configure Filebeat to use Logstash
  • Step 4: Load the index template in Elasticsearch
  • Step 5: Set up the Kibana dashboards
  • Step 6: Start Filebeat
  • Step 7: View the sample Kibana dashboards
  • Quick start for common log formats
  • Repositories for APT and YUM
• Setting up and running Filebeat
  • Directory layout
  • Filebeat commands
  • Running Filebeat on Docker
  • Running Filebeat on Kubernetes
• Upgrading Filebeat
• How Filebeat works
• Configuring Filebeat
  • Specify which modules to run
    • Specify variable settings
    • Advanced settings
  • Set up prospectors
    • Specify multiple prospectors
  • Manage multiline messages
    • Examples of multiline configuration
    • Test your regexp pattern for multiline
  • Specify general settings
  • Load external configuration files
    • Live reloading
  • Configure the internal queue
  • Configure the output
    • Elasticsearch
    • Logstash
    • Kafka
    • Redis
    • File
    • Console
    • Output codec
    • Cloud
  • Load balance the output hosts
  • Specify SSL settings
  • Filter and enhance the exported data
    • Define processors
    • Add cloud metadata
    • Add the local time zone
    • Decode JSON fields
    • Drop events
    • Drop fields from events
    • Add additional fields to events
    • Add Kubernetes metadata
    • Add Docker metadata
  • Parse logs by using ingest node
  • Set up project paths
  • Set up the Kibana endpoint
  • Load the Kibana dashboards
  • Load the Elasticsearch index template
  • Set up logging
  • Use environment variables in the configuration
  • YAML tips and gotchas
  • Regular expression support
  • filebeat.reference.yml
• Modules
  • Modules overview
  • Apache2 module
  • Auditd module
  • Icinga module
  • MySQL module
  • Nginx module
  • Redis module
  • System module
• Exported Fields
  • Apache2 Fields
  • Auditd Fields
  • Beat Fields
  • Cloud Provider Metadata Fields
  • docker Fields
  • Icinga Fields
  • kubernetes Fields
  • Log File Content Fields
  • MySQL Fields
  • Nginx Fields
  • Redis Fields
  • System Fields
• Securing Filebeat
  • Secure communication with Elasticsearch
  • Secure communication with Logstash by using SSL
  • Filebeat and X-Pack Security
    • Configuring Authentication Credentials for Filebeat
    • Granting Users Access to Filebeat Indices
    • Configuring Filebeat to use Encrypted Connections
• Troubleshooting
  • Get help
  • Debug
  • Frequently asked questions
• Migrating from Logstash Forwarder to Filebeat
  • Migrate to the Beats input plugin for Logstash
  • Update the registry file
  • Migrate your configuration
  • Changes to command line options
  • Changes to the output fields
  • Other changes