Configuration of Metricbeat


(Tras2) #1

Hi everyone.

I have a question about Metricbeat

I’m using a Graylog 2.2.3 standalone virtual appliance (proof-of-concept environment). When I go to System->Collectors->Manage Configurations and create a new configuration, on the inputs I only see [FileBeat] and [WinLogBeat] as options (i.e. missing MetricBeat)

The node’s installed plugins show ‘Elastic Beats Input 2.2.3’ and according to https://github.com/Graylog2/graylog-plugin-beats, that version includes Metricbeat (along with Packetbeat which is also missing)

What am I doing wrong or missing?

Or does the Graylog UI currently not support collector-sidecar configuration of the Metricbeat?

Thanks


(Jochen) #2

The Graylog Collector Sidecar currently only supports Filebeat, Winlogbeat, and nxlog.

You can use any other beat with the Graylog Beats input, though.


(Tras2) #3

Thanks for the clarification - my searching couldn’t find an answer one way or another

While I was waiting for a reply I manually configured a metricbeat on a windows server and I have the data coming in. I’ll have to consider how to manage the Metricbeat configuration as it’s now separate to the management of the File/WinLog beat configuration (I’m liking the collector-sidecar)

For anyone who’s interested, (rightly or wrongly!) this is what I did:-

  1. Goto System->Inputs. Add a ‘Beats’ input to a node (or add globally). Make a note of the port number

  2. Install metricbeat on a server as per https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-installation.html

  3. Configure metricbeat.yml on the server as required. Make sure the logstash output is enabled and points to the Graylog Beats input (example below)

    Metricbeat output

    output.logstash:

    hosts: [":<beats listening port"]

    for example

    hosts: [“1.2.3.4:5044”]

  4. (re)start the Metricbeat service/process


#4

Is there any plan to manage this in the sidecar itself? would be so nice


(Jochen) #5