6 votes
Accepted

Should I use multiple beats input in Logstash?

So still not benchmarked much, but after a quick code inspection and a bunch of reading about netty and logstash in version 5 the input is not the bottleneck to worry about. Logstash team did put a ...
Tensibai's user avatar
  • 11.3k
5 votes
Accepted

Should I use filebeat or an app-logging module with lumberjack capabilities to collect my logs

Both are common and comes with their own pro and cons. It depends if you can accept loosing logs if logstash is dead and your app restart and on the other hand if you can write logs to disk and ...
Tensibai's user avatar
  • 11.3k
3 votes
Accepted

Where is the apache2 filebeat module configured?

After looking a bit further, I found it in the sample called filebeat.full.yml So I added this section to the filebeat.yml Restarted filebeat After running at 100% CPU for minute, Kibana is now ...
scipilot's user avatar
  • 249
2 votes

Do I use Filebeat, Ingest or Pipelines to get rid of Logstash in my ELK stack?

You might be able to use Filebeat directly. Newer versions of filebeat has a concept of "modules", which is custom parsers you can apply. There are built-in ones for stuff like nginx, apache2, redis ...
Trondh's user avatar
  • 381
2 votes

Logstash multiple pipelines going into same index

There are two ways to accomplish this, though one of them was only available recently. The old-school version, the one you can do as far back as Logstash 1.5, is to pay attention to tags and use ...
sysadmin1138's user avatar
2 votes

How to monitor ELK using metricbeat on kubernetes (v8 compatible and simple solution)

I propose the following solution although it will require 1 extra metricbeat running per monitored entity, it's simple, not optimized. The approach will also work for other non-kubernetes contexts ...
Kristofer's user avatar
  • 131
1 vote

Store and analyize logs data from diffenrent application

Can you not use Kibana with Elasticsearch or does that not give you the 'advanced' features you need? Have you looked at this connector for ES and Tableau? https://www.dremio.com/tutorials/unlocking-...
MonkeyMagic's user avatar
1 vote

Multiple Logstash Pipelines outputting into same index

"I have two Filebeat pipes inputting into Logstash." ---I assume this means that you have conditional logic and/or prospectors in your filebeat config to ship to the multiple logstash (5044 and 5043)...
satsujinsha's user avatar
1 vote
Accepted

How effective is ELK than other Monitoring tools?

ELK is pretty ineffective as a monitoring tool in a default configuration as it doesn't do monitoring - only reporting. ELK can only provide monitoring and alerting abilities if you configure ...
James Shewey's user avatar
  • 3,724
1 vote

Is it possible to load balance TLS/SSL based logstash communication to elasticsearch?

You can do this a couple of ways, but I have never seen anyone do this with a CNAME. One option, if you have control over your IP addressing is to use BGP to fail-over (or load balance) an IP to ...
James Shewey's user avatar
  • 3,724
1 vote

Do I use Filebeat, Ingest or Pipelines to get rid of Logstash in my ELK stack?

I am not sure if you are open to commercial solutions, but Sumo Logic is an excellent ingest-type solution. I also tried Logly and LogDNA which were nice but not as powerful and feature rich as Sumo. ...
Darf Nader's user avatar
1 vote

Data sent from Logstash via elastic output plugin not showing in Kibana, but file output plugin works fine - what am I doing wrong?

Being unfamiliar with Kibana, I was not aware of the time constraint on data on the default search/display of just 15 minutes. The data coming in was timestamped (@timestamp key) via the 'date' plugin ...
Brendan's user avatar
  • 41

Only top scored, non community-wiki answers of a minimum length are eligible