• Filebeat Reference: 8.196.5other versionsother versions: 8.198.188.178.168.158.148.138.128.118.108.98.88.78.68.58.48.38.28.18.07.177.167.157.147.137.127.117.107.97.87.77.67.57.47.37.27.17.06.86.76.66.56.46.36.26.16.05.65.55.45.35.25.15.01.31.21.11.0.1
• Overview
• Getting Started With Filebeat
  • Step 1: Install Filebeat
  • Step 2: Configure Filebeat
  • Step 3: Configure Filebeat to use Logstash
  • Step 4: Load the index template in Elasticsearch
  • Step 5: Set up the Kibana dashboards
  • Step 6: Start Filebeat
  • Step 7: View the sample Kibana dashboards
  • Quick start: modules for common log formats
  • Repositories for APT and YUM
• Setting up and running Filebeat
  • Directory layout
  • Secrets keystore
  • Command reference
  • Running Filebeat on Docker
  • Running Filebeat on Kubernetes
  • Stopping Filebeat
• Upgrading Filebeat
• How Filebeat works
• Configuring Filebeat
  • Specify which modules to run
    • Specify variable settings
    • Advanced settings
  • Configure inputs
    • Log
    • Stdin
    • Redis
    • UDP
    • Docker
    • TCP
    • Syslog
  • Manage multiline messages
    • Examples of multiline configuration
    • Test your regexp pattern for multiline
  • Specify general settings
  • Load external configuration files
    • Live reloading
  • Configure the internal queue
  • Configure the output
    • Elasticsearch
    • Logstash
    • Kafka
    • Redis
    • File
    • Console
    • Cloud
    • Change the output codec
  • Load balance the output hosts
  • Specify SSL settings
  • Filter and enhance the exported data
    • Define processors
    • Add cloud metadata
    • Add the local time zone
    • Decode JSON fields
    • Drop events
    • Drop fields from events
    • Keep fields from events
    • Rename fields from events
    • Add Kubernetes metadata
    • Add Docker metadata
    • Add Host metadata
    • Dissect strings
    • DNS Reverse Lookup
    • Add process metadata
  • Parse data by using ingest node
  • Set up project paths
  • Set up the Kibana endpoint
  • Load the Kibana dashboards
  • Load the Elasticsearch index template
  • Configure logging
  • Use environment variables in the configuration
  • Autodiscover
    • Hints based autodiscover
    • Advanced usage
  • YAML tips and gotchas
  • Regular expression support
  • HTTP Endpoint
  • filebeat.reference.yml
• Beats central management
  • How central management works
  • Enroll Beats in central management
• Modules
  • Modules overview
  • Apache2 module
  • Auditd module
  • Elasticsearch module
  • haproxy module
  • Icinga module
  • IIS module
  • Kafka module
  • Kibana module
  • Logstash module
  • MongoDB module
  • MySQL module
  • Nginx module
  • Osquery module
  • PostgreSQL module
  • Redis module
  • Suricata module
  • System module
  • Traefik module
• Exported fields
  • Apache2 fields
  • Auditd fields
  • Beat fields
  • Cloud provider metadata fields
  • Docker fields
  • elasticsearch fields
  • haproxy fields
  • Host fields
  • Icinga fields
  • IIS fields
  • Kafka fields
  • kibana fields
  • Kubernetes fields
  • Log file content fields
  • logstash fields
  • mongodb fields
  • MySQL fields
  • Nginx fields
  • Osquery fields
  • PostgreSQL fields
  • Redis fields
  • System fields
  • Traefik fields
• Monitoring Filebeat
  • Configuration options
• Securing Filebeat
  • Secure communication with Elasticsearch
  • Secure communication with Logstash by using SSL
  • Use X-Pack security
    • Configure authentication credentials
    • Grant users access to Filebeat indices
    • Configure Filebeat to use encrypted connections
    • Set the password for the built-in monitoring user
  • Use Linux Secure Computing Mode (seccomp)
• Troubleshooting
  • Get help
  • Debug
  • Frequently asked questions
• Migrating from Logstash Forwarder to Filebeat
  • Migrate to the Beats input plugin for Logstash
  • Update the registry file
  • Migrate your configuration
  • Changes to command line options
  • Changes to the output fields
  • Other changes
• Contributing to Beats