• Packetbeat Reference: other versions:
  • Overview
  • Getting started with Packetbeat
    • Step 1: Install Packetbeat
    • Step 2: Configure Packetbeat
    • Step 3: Load the index template in Elasticsearch
    • Step 4: Set up the Kibana dashboards
    • Step 5: Start Packetbeat
    • Step 6: View the sample Kibana dashboards
    • Repositories for APT and YUM
  • Setting up and running Packetbeat
    • Directory layout
    • Secrets keystore
    • Command reference
    • Running Packetbeat on Docker
    • Stopping Packetbeat
  • Upgrading Packetbeat
  • Configuring Packetbeat
    • Set traffic capturing options
    • Set up flows to monitor network traffic
    • Specify which transaction protocols to monitor
      • Common protocol options
      • ICMP
      • DNS
      • HTTP
      • AMQP
      • Cassandra
      • Memcache
      • MySQL and PgSQL
      • Thrift
      • MongoDB
      • TLS
      • Redis
    • Specify which processes to monitor
    • Specify general settings
    • Configure the internal queue
    • Configure the output
      • Elasticsearch
      • Logstash
      • Kafka
      • Redis
      • File
      • Console
      • Cloud
      • Change the output codec
    • Set up index lifecycle management
    • Specify SSL settings
    • Filter and enhance the exported data
      • Define processors
      • Add cloud metadata
      • Add the local time zone
      • Decode JSON fields
      • Drop events
      • Drop fields from events
      • Keep fields from events
      • Rename fields from events
      • Add Kubernetes metadata
      • Add Docker metadata
      • Add Host metadata
      • Dissect strings
      • DNS Reverse Lookup
      • Add process metadata
    • Parse data by using ingest node
    • Enrich events with geoIP information
    • Set up project paths
    • Set up the Kibana endpoint
    • Load the Kibana dashboards
    • Load the Elasticsearch index template
    • Configure logging
    • Use environment variables in the configuration
    • YAML tips and gotchas
    • HTTP Endpoint
    • packetbeat.reference.yml
  • Exported fields
    • Alias fields
    • AMQP fields
    • Beat fields
    • Cassandra fields
    • Cloud provider metadata fields
    • Common fields
    • DHCPv4 fields
    • DNS fields
    • Docker fields
    • Flow Event fields
    • Host fields
    • HTTP fields
    • ICMP fields
    • Kubernetes fields
    • Memcache fields
    • MongoDb fields
    • MySQL fields
    • NFS fields
    • PostgreSQL fields
    • Raw fields
    • Redis fields
    • Thrift-RPC fields
    • TLS fields
    • Transaction Event fields
    • Measurements (Transactions) fields
  • Monitoring Packetbeat
    • Configuration options
  • Securing Packetbeat
    • Secure communication with Elasticsearch
    • Secure communication with Logstash by using SSL
    • Use X-Pack security
      • Packetbeat features that require authorization
      • Configure authentication credentials
      • Grant users access to Packetbeat indices
      • Configure Packetbeat to use encrypted connections
      • Set the password for the built-in monitoring user
    • Use Linux Secure Computing Mode (seccomp)
  • Visualizing Packetbeat data in Kibana
    • Customize the Discover page
    • Kibana queries and filters
  • Troubleshooting
    • Get help
    • Debug
    • Record a trace
    • Frequently asked questions
  • Contributing to Beats