6
votes
Accepted
Should I use multiple beats input in Logstash?
So still not benchmarked much, but after a quick code inspection and a bunch of reading about netty and logstash in version 5 the input is not the bottleneck to worry about.
Logstash team did put a ...
- 11.3k
5
votes
Accepted
Should I use filebeat or an app-logging module with lumberjack capabilities to collect my logs
Both are common and comes with their own pro and cons.
It depends if you can accept loosing logs if logstash is dead and your app restart and on the other hand if you can write logs to disk and ...
- 11.3k
3
votes
Accepted
Where is the apache2 filebeat module configured?
After looking a bit further, I found it in the sample called filebeat.full.yml
So I added this section to the filebeat.yml
Restarted filebeat
After running at 100% CPU for minute, Kibana is now ...
- 249
2
votes
Do I use Filebeat, Ingest or Pipelines to get rid of Logstash in my ELK stack?
You might be able to use Filebeat directly. Newer versions of filebeat has a concept of "modules", which is custom parsers you can apply. There are built-in ones for stuff like nginx, apache2, redis ...
- 381
2
votes
Logstash multiple pipelines going into same index
There are two ways to accomplish this, though one of them was only available recently.
The old-school version, the one you can do as far back as Logstash 1.5, is to pay attention to tags and use ...
- 206
2
votes
How to monitor ELK using metricbeat on kubernetes (v8 compatible and simple solution)
I propose the following solution although it will require 1 extra metricbeat running per monitored entity, it's simple, not optimized. The approach will also work for other non-kubernetes contexts ...
- 131
1
vote
Store and analyize logs data from diffenrent application
Can you not use Kibana with Elasticsearch or does that not give you the 'advanced' features you need?
Have you looked at this connector for ES and Tableau? https://www.dremio.com/tutorials/unlocking-...
- 66
1
vote
Multiple Logstash Pipelines outputting into same index
"I have two Filebeat pipes inputting into Logstash."
---I assume this means that you have conditional logic and/or prospectors in your filebeat config to ship to the multiple logstash (5044 and 5043)...
- 11
1
vote
Accepted
How effective is ELK than other Monitoring tools?
ELK is pretty ineffective as a monitoring tool in a default configuration as it doesn't do monitoring - only reporting. ELK can only provide monitoring and alerting abilities if you configure ...
- 3,724
1
vote
Is it possible to load balance TLS/SSL based logstash communication to elasticsearch?
You can do this a couple of ways, but I have never seen anyone do this with a CNAME.
One option, if you have control over your IP addressing is to use BGP to fail-over (or load balance) an IP to ...
- 3,724
1
vote
Do I use Filebeat, Ingest or Pipelines to get rid of Logstash in my ELK stack?
I am not sure if you are open to commercial solutions, but Sumo Logic is an excellent ingest-type solution. I also tried Logly and LogDNA which were nice but not as powerful and feature rich as Sumo. ...
- 181
1
vote
Data sent from Logstash via elastic output plugin not showing in Kibana, but file output plugin works fine - what am I doing wrong?
Being unfamiliar with Kibana, I was not aware of the time constraint on data on the default search/display of just 15 minutes. The data coming in was timestamped (@timestamp key) via the 'date' plugin ...
- 41
Only top scored, non community-wiki answers of a minimum length are eligible