Step 5: Set up the Kibana dashboardsedit

For deeper observability into your infrastructure, use the Infrastructure and Logs UIs in Kibana. For setup details, see the Infrastructure Monitoring Guide.

Filebeat comes packaged with example Kibana dashboards, visualizations, and searches for visualizing Filebeat data in Kibana. Before you can use the dashboards, you need to create the index pattern, filebeat-*, and load the dashboards into Kibana. To do this, you can either run the setup command (as described here) or configure dashboard loading in the filebeat.yml config file.

This requires a Kibana endpoint configuration. If you didn’t already configure a Kibana endpoint, see configure Filebeat.

Make sure Kibana is running before you perform this step. If you are accessing a secured Kibana instance, make sure you’ve configured credentials as described in Step 2: Configure Filebeat.

To set up the Kibana dashboards for Filebeat, use the appropriate command for your system. The command shown here loads the dashboards from the Filebeat package. For more options, such as loading customized dashboards, see Importing Existing Beat Dashboards in the Beats Developer Guide. If you’ve configured the Logstash output, see Set up dashboards for Logstash output.

deb and rpm:

filebeat setup --dashboards

mac:

./filebeat setup --dashboards

linux:

./filebeat setup --dashboards

docker:

docker run --net="host" docker.elastic.co/beats/filebeat:6.7.2 setup --dashboards

win:

Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select Run As Administrator).

From the PowerShell prompt, change to the directory where you installed Filebeat, and run:

PS > .\filebeat.exe setup --dashboards

Set up dashboards for Logstash outputedit

During dashboard loading, Filebeat connects to Elasticsearch to check version information. To load dashboards when the Logstash output is enabled, you need to temporarily disable the Logstash output and enable Elasticsearch. To connect to a secured Elasticsearch cluster, you also need to pass Elasticsearch credentials.

The example shows a hard-coded password, but you should store sensitive values in the secrets keystore.

deb and rpm:

filebeat setup -e \
  -E output.logstash.enabled=false \
  -E output.elasticsearch.hosts=['localhost:9200'] \
  -E output.elasticsearch.username=filebeat_internal \
  -E output.elasticsearch.password=YOUR_PASSWORD \
  -E setup.kibana.host=localhost:5601

mac:

./filebeat setup -e \
  -E output.logstash.enabled=false \
  -E output.elasticsearch.hosts=['localhost:9200'] \
  -E output.elasticsearch.username=filebeat_internal \
  -E output.elasticsearch.password=YOUR_PASSWORD \
  -E setup.kibana.host=localhost:5601

linux:

./filebeat setup -e \
  -E output.logstash.enabled=false \
  -E output.elasticsearch.hosts=['localhost:9200'] \
  -E output.elasticsearch.username=filebeat_internal \
  -E output.elasticsearch.password=YOUR_PASSWORD \
  -E setup.kibana.host=localhost:5601

docker:

docker run --net="host" docker.elastic.co/beats/filebeat:6.7.2 setup -e \
  -E output.logstash.enabled=false \
  -E output.elasticsearch.hosts=['localhost:9200'] \
  -E output.elasticsearch.username=filebeat_internal \
  -E output.elasticsearch.password=YOUR_PASSWORD \
  -E setup.kibana.host=localhost:5601

win:

Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select Run As Administrator).

From the PowerShell prompt, change to the directory where you installed Filebeat, and run:

PS > .\filebeat.exe setup -e `
  -E output.logstash.enabled=false `
  -E output.elasticsearch.hosts=['localhost:9200'] `
  -E output.elasticsearch.username=filebeat_internal `
  -E output.elasticsearch.password=YOUR_PASSWORD `
  -E setup.kibana.host=localhost:5601