Configuration of Metricbeat

Graylog Central (peer support)
,
1

Hi everyone.

I have a question about Metricbeat

I’m using a Graylog 2.2.3 standalone virtual appliance (proof-of-concept environment). When I go to System->Collectors->Manage Configurations and create a new configuration, on the inputs I only see [FileBeat] and [WinLogBeat] as options (i.e. missing MetricBeat)

The node’s installed plugins show ‘Elastic Beats Input 2.2.3’ and according to https://github.com/Graylog2/graylog-plugin-beats, that version includes Metricbeat (along with Packetbeat which is also missing)

What am I doing wrong or missing?

Or does the Graylog UI currently not support collector-sidecar configuration of the Metricbeat?

Thanks

2

The Graylog Collector Sidecar currently only supports Filebeat, Winlogbeat, and nxlog.

You can use any other beat with the Graylog Beats input, though.

3

Thanks for the clarification - my searching couldn’t find an answer one way or another

While I was waiting for a reply I manually configured a metricbeat on a windows server and I have the data coming in. I’ll have to consider how to manage the Metricbeat configuration as it’s now separate to the management of the File/WinLog beat configuration (I’m liking the collector-sidecar)

For anyone who’s interested, (rightly or wrongly!) this is what I did:-

  1. Goto System->Inputs. Add a ‘Beats’ input to a node (or add globally). Make a note of the port number

  2. Install metricbeat on a server as per https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-installation.html

  3. Configure metricbeat.yml on the server as required. Make sure the logstash output is enabled and points to the Graylog Beats input (example below)

    Metricbeat output

    output.logstash:

    hosts: [":<beats listening port"]

    for example

    hosts: [“1.2.3.4:5044”]

  4. (re)start the Metricbeat service/process

1 Like
4

Is there any plan to manage this in the sidecar itself? would be so nice

5

https://github.com/Graylog2/collector-sidecar/issues/103

6

I do believe this was shown in the Graylog 3.0 demo :slight_smile:

@jan, could it be that the linked Github issue hasn’t been updated yet?

7

@jan, could it be that the linked Github issue hasn’t been updated yet?

yes - it is very likely. After the 3.0 we need to clean up all issues, check feature issues and similar. But currently we decide to actually work on the product and if all is finished, use the RC phase to clean up.

1 Like