You are looking at documentation for an older release. Not what you want? See the current release documentation.

    Filebeat overview  »

Filebeat Reference

---

• Filebeat Reference: master6.x6.4 (current)6.36.26.16.05.65.55.45.35.25.15.01.31.21.11.0.1
• Overview
• Contributing to Beats
• Getting Started With Filebeat
  • Step 1: Install Filebeat
  • Step 2: Configure Filebeat
  • Step 3: Configure Filebeat to use Logstash
  • Step 4: Load the index template in Elasticsearch
  • Step 5: Set up the Kibana dashboards
  • Step 6: Start Filebeat
  • Step 7: View the sample Kibana dashboards
  • Quick start for common log formats
  • Repositories for APT and YUM
• Setting up and running Filebeat
  • Directory layout
  • Secrets keystore
  • Command reference
  • Running Filebeat on Docker
  • Running Filebeat on Kubernetes
• Upgrading Filebeat
• How Filebeat works
• Configuring Filebeat
  • Specify which modules to run
    • Specify variable settings
    • Advanced settings
  • Set up prospectors
    • Specify multiple prospectors
  • Manage multiline messages
    • Examples of multiline configuration
    • Test your regexp pattern for multiline
  • Specify general settings
  • Load external configuration files
    • Live reloading
  • Configure the internal queue
  • Configure the output
    • Elasticsearch
    • Logstash
    • Kafka
    • Redis
    • File
    • Console
    • Output codec
    • Cloud
  • Load balance the output hosts
  • Specify SSL settings
  • Filter and enhance the exported data
    • Define processors
    • Add cloud metadata
    • Add the local time zone
    • Decode JSON fields
    • Drop events
    • Drop fields from events
    • Keep fields from events
    • Add Kubernetes metadata
    • Add Docker metadata
  • Parse data by using ingest node
  • Set up project paths
  • Set up the Kibana endpoint
  • Load the Kibana dashboards
  • Load the Elasticsearch index template
  • Configure logging
  • Use environment variables in the configuration
  • Autodiscover
  • YAML tips and gotchas
  • Regular expression support
  • filebeat.reference.yml
• Modules
  • Modules overview
  • Apache2 module
  • Auditd module
  • Icinga module
  • Kafka module
  • Logstash module
  • MySQL module
  • Nginx module
  • Osquery module
  • PostgreSQL module
  • Redis module
  • System module
  • Traefik module
• Exported fields
  • Apache2 fields
  • Auditd fields
  • Beat fields
  • Cloud provider metadata fields
  • Docker fields
  • Icinga fields
  • Kafka fields
  • Kubernetes fields
  • Log file content fields
  • logstash fields
  • MySQL fields
  • Nginx fields
  • Osquery fields
  • PostgreSQL fields
  • Redis fields
  • System fields
  • Traefik fields
• Monitoring Filebeat
  • Configuration options
• Securing Filebeat
  • Secure communication with Elasticsearch
  • Secure communication with Logstash by using SSL
  • Filebeat and X-Pack Security
    • Configuring Authentication Credentials for Filebeat
    • Granting Users Access to Filebeat Indices
    • Configuring Filebeat to use Encrypted Connections
• Troubleshooting
  • Get help
  • Debug
  • Frequently asked questions
• Migrating from Logstash Forwarder to Filebeat
  • Migrate to the Beats input plugin for Logstash
  • Update the registry file
  • Migrate your configuration
  • Changes to command line options
  • Changes to the output fields
  • Other changes

    Filebeat overview  »

Getting Started Videos

• Starting Elasticsearch
• Introduction to Kibana
• Logstash Starter Guide