Beats Central Managementedit

To use Beats Central Management, open the main menu, click Stack Management > Beats Central Management, then define and manage configurations in a central location in Kibana and quickly deploy configuration changes to all Beats running across your enterprise. For more about central management, see the related Beats documentation:

This feature requires an Elastic license that includes Beats central management.

Don’t have a license? You can start a 30-day trial. Open the main menu, then click Stack Management > License Management. At the end of the trial period, you can purchase a subscription to keep using central management. For more information, see and License Management.

Kibana makes it easy for you to use central management by walking you through the enrollment and configuration process step by step the first time you use the Central Management UI.

Required permissionsedit

You must have the beats_admin role assigned to use Beats Central Management

To assign the role, open the menu, then click Stack Management > Users.

Enroll Beatsedit

You need to enroll Beats to register them in central management and establish trust. Enrolled Beats will have the credentials needed to retrieve configurations from Kibana.

Create configuration tagsedit

A configuration tag is a group of configuration blocks that you can apply to one or more Beats. For example, you can create a tag called development to group configurations for Beats running in your development environment.

The first time you walk through the enrollment process, you’ll create a configuration tag that’s applied to the Beats instance you’re enrolling.

After that, under Configuration tags, you can create additional tags and apply them to any enrolled Beats, and the Beats will use the configurations defined in the tag.

Add configuration blocksedit

Add one or more configuration blocks to the tag. A tag can have configuration blocks for different types of Beats. When the enrolled Beats run, they will use the configuration blocks that are valid for their type.

Central management supports configuration settings for:

  • Filebeat modules
  • Metricbeat modules
  • Filebeat inputs
  • Filebeat and Metricbeat outputs

Central management supports the following outputs only: Elasticsearch, Logstash, Kafka, and Redis. Other output types are not supported for Beats that are enrolled in central management.

Use the Central Management UI to define and manage settings for supported configuration blocks. You cannot define those settings in local Beats configuration files. For configuration blocks that are not supported by central management, configure the settings in the local configuration file after enrolling the Beat in central management.

Manage enrolled Beatsedit

Under Enrolled Beats, you can view the list of enrolled Beats to see details, including the type, applied tags, configuration status, and the last configuration update. Click the Beat name or Type column heading to sort the list. To filter the list, enter a search string. If there are errors in a configuration, you’ll see an Error status in the Central Management UI and need to look at Beats logs to troubleshoot the problem.

You can add or remove tags, and the configuration changes are automatically deployed to all Beats that have the tag. Avoid applying tags with conflicting configurations. Because the configurations for all assigned tags are merged, conflicting configurations result in errors.

You can unenroll Beats to remove them from central management.

Manage tagsedit

Under Configuration tags, you can select tags and delete them, or you can drill down into a tag to add, modify, or remove configuration blocks from the tag. When you change the configuration blocks or remove tags, the configuration changes are automatically deployed to all Beats that have the tag.