Filebeat

Since we are going to use Filebeat to ship logs from our Client Servers to our ELK Server, we need to create an SSL certificate and key pair. The certificate is used by Filebeat to verify the identity of ELK Server. Create the directories that will store the certificiate and private key with the following commands

mkdir -p /etc/pki/tls/certs
mkdir /etc/pki/tls/private

/etc/ssl/openssl.cnf 여기에서 SSL key value 페어를 만들고 이것을

/etc/pki/tls 여기에 저장함. private과 certs로.. /etc/pki/tls/certs > logstash-forwarder.crt /etc/pki/tls/private > logstash-forwarder.key

The logstash-forwarder.crt file will be copied to all of the servers that will send logs to Logstash but we will do that a little later.

Configure Filebeat On Client Server, create and edit Filebeat configuration file: vi /etc/filebeat/filebeat.yml

!Note! Filebeat's configuration file is in YAML format, which means that indentation is very important!

다시 시작하려면 servie filebeat restart update-rc.d filebeat defualts 95 10 //To configure the beat to start automatically during boot, run: