Step 2: Configure Heartbeatedit

To configure Heartbeat, you edit the configuration file. For rpm and deb, you’ll find the configuration file at /etc/heartbeat/heartbeat.yml. Under Docker, it’s located at /usr/share/heartbeat/heartbeat.yml. For mac and win, look in the archive that you just extracted. There’s also a full example configuration file called heartbeat.reference.yml that shows all non-deprecated options.

See the Config File Format section of the Beats Platform Reference for more about the structure of the config file.

Heartbeat provides monitors to check the status of hosts at set intervals. You configure each monitor individually. Heartbeat currently provides monitors for ICMP, TCP, and HTTP (see Overview for more about these monitors). Here is an example that configures Heartbeat to use an icmp monitor:

heartbeat.monitors:
- type: icmp
  schedule: '*/5 * * * * * *'
  hosts: ["myhost"]
output.elasticsearch:
  hosts: ["myEShost:9200"]

To configure Heartbeat:

  1. Specify the list of monitors that you want to enable. Each item in the list begins with a dash (-). The following example configures Heartbeat to use two monitors, an icmp monitor and a tcp monitor:

    heartbeat.monitors:
    - type: icmp
      schedule: '*/5 * * * * * *' 
      hosts: ["myhost"]
    - type: tcp
      schedule: '@every 5s' 
      hosts: ["myhost:12345"]
      mode: any 

    The icmp monitor is scheduled to run exactly every 5 seconds (10:00:00, 10:00:05, and so on). The schedule option uses a cron-like syntax based on this cronexpr implementation.

    The tcp monitor is set to run every 5 seconds from the time when Heartbeat was started. Heartbeat adds the @every keyword to the syntax provided by the cronexpr package.

    The mode specifies whether to ping one IP (any) or all resolvable IPs (all).

    See Configuring Heartbeat for a full description of each configuration option.

  2. If you are sending output directly to Elasticsearch (and not using Logstash), set the IP address and port where Heartbeat can find the Elasticsearch installation:

    output.elasticsearch:
      hosts: ["192.168.1.42:9200"]

    If you are sending output to Logstash, make sure you Configure the Logstash output instead.

  3. If you plan to use the sample Kibana dashboards provided with Heartbeat, configure the Kibana endpoint:

    setup.kibana:
      host: "localhost:5601"

    Where host is the hostname and port of the machine where Kibana is running, for example, localhost:5601.

    Note

    If you specify a path after the port number, you need to include the scheme and port: http://localhost:5601/path.

  4. If you’ve secured Elasticsearch and Kibana, you need to specify credentials in the config file before you run the commands that set up and start Heartbeat. For example:

    output.elasticsearch:
      hosts: ["myEShost:9200"]
      username: "elastic"
      password: "elastic"
    setup.kibana:
      host: "mykibanahost:5601"
      username: "elastic" 
      password: "elastic"

    The username and password settings for Kibana are optional. If you don’t specify credentials for Kibana, Heartbeat uses the username and password specified for the Elasticsearch output.

    Also see the security-related options described in Set up the Kibana endpoint and Configure the Elasticsearch output.

Before starting heartbeat, you should look at the configuration options in the configuration file. For more information about these options, see Configuring Heartbeat.