Debian/ Ubuntu

Before installing the agent on the operating systems we support below, you need to download the certificate according to the instructions at Initialize Certificate . Information on setting up the agent is in the readme file, and the instruction scripts are also in the downloaded certificate file. Use this information with the instructions below to complete Agent for Log setup.

Setting

Determine the type of agent you want to install and follow that agent's instructions below:

FilebeatLogstash

If using a script prepared in the download folder, run the command

sudo chmod +x filebeat.sh
sudo ./filebeat.sh <path-to-file-log>

If installing manually, run the command

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-8.7.1-amd64.deb
sudo dpkg -i filebeat-8.7.1-amd64.deb

---

Next you need to configure agent log. The configuration files below have been prepared by us in the script when downloading the certificate. The description below helps readers imagine what it would be like if we created a manual.

Configuration

FilebeatLogstash

The configuration file /etc/filebeat/filebeat.yml.below will retrieve all logs in the file /var/log/app.logand push it to vMonitor Platform:

filebeat.inputs:
- type: log
  paths:
    - /var/log/app.log

output.kafka:
  hosts: ["$BOOTSTRAP_SERVERS"]
  topic: "$TOPIC"
  partition.round_robin:
    reachable_only: false
  required_acks: 1
  compression: gzip
  max_message_bytes: 1000000
  ssl.certificate_authorities:
    - $PATH_FILE_VNG_TRUST_PEM
  ssl.certificate: "$PATH_FILE_USER_CER_PEM"
  ssl.key: "$PATH_FILE_USER_KEY_PEM"
  ssl.verification_mode: "none"
logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644

• In there:

  • At inputthe path to the log file

  • At output, the variables you need to fill in are taken from the certificate download step above:

    • $BOOTSTRAP_SERVERS, $TOPICtaken from file info.md

    • $PATH_FILE_VNG_TRUST_PEM,$PATH_FILE_USER_CER_PEM,$PATH_FILE_USER_KEY_PEMis the path to the file VNG.trust.pem user.cer.pem user.key.pem

• Read more advanced configurations atConfigure Filebeat | Filebeat Reference [8.8] | Elastic

---

Administration

If installed manually, by default the agent log after installation will not automatically turn on, you should check the start and enable (start automatically with the machine) for them.

FilebeatLogstash

Start systemctl start filebeat Enable systemctl enable filebeat Stop systemctl stop filebeat Reload systemctl reload filebeat Restart systemctl restart filebeat Observe systemctl status filebeat journalctl -f --unit filebeat tail -f /var/log/filebeat Uninstall tapt remove --purge filebeat

systemctl start filebeat

systemctl enable filebeat

systemctl stop filebeat

systemctl reload filebeat

systemctl restart filebeat

systemctl status filebeat journalctl -f --unit filebeat tail -f /var/log/filebeat

tapt remove --purge filebeat