Elastic Agent Configuration

Logs

Elastic Agent offers a unified approach for seamlessly incorporating monitoring of logs, metrics, and diverse data types to one or more destinations, including Logstash.

Install Integration

Install Elastic Agent

To get started first follow the steps below:

• Install Elastic Agent (opens in a new tab)
• Root access
• Verify the required port "@logstash.sslPort" is open

_Older versions can be found here Elastic Agent 7 (opens in a new tab)

Update Your Configuration File

The configuration file below is pre-configured to send data to your Logit.io Stack via Logstash.

Copy the configuration file below and overwrite the contents of elastic-agent.yml.

For version 7.17+ and above, use the configuration below:

####################### Logit.io Elastic Agent Configuration ########################
# ============================== Elastic Agent inputs ==============================
inputs:
  - type: system/metrics
    id: unique-system-metrics-input
    data_stream.namespace: default
    use_output: default
    streams:
      - metricsets:
          - cpu
        data_stream.dataset: system.cpu
      - metricsets:
          - memory
        data_stream.dataset: system.memory
      - metricsets:
          - network
        data_stream.dataset: system.network
      - metricsets:
          - filesystem
        data_stream.dataset: system.filesystem
 
    # Collecting log files
    # - type: filestream
    #   id: your-input-id
    #   streams:
    #     # Must be unique
    #     - id: your-filestream-stream-id
    #       data_stream:
    #         dataset: generic
    #       paths:
    #         - /var/log/*.log
 
# ================================== Outputs ===================================
# ------------------------------ Logstash Output -------------------------------
outputs:
  default:
    type: logstash
    hosts: ["@logstash.host:@logstash.sslPort"]
    loadbalance: true
    ssl:
      enabled: true
 
# ================================== Logging Settings ===================================
# Send all logging output to stderr, default is false
agent.logging.to_stderr: true

Validate your YAML

It's a good idea to run the configuration file through a YAML validator to rule out indentation errors, clean up extra characters, and check if your YAML file is valid. Yamllint.com (opens in a new tab) is a great choice.

Elastic Agent Inputs (Optional)

1. User and Process Auditing:

   • Regularly examine and assess the actions performed by users and processes on your systems.

2. Operating System and Service Metrics:

   • Gather performance metrics from the operating systems and services running on your servers to track and optimize their functioning.

3. Log Data Forwarding and Centralization:

   • Channel and consolidate log data from various sources to a central location for easier analysis and management.

4. Service Monitoring:

   • Keep track of the status of your services to ensure they are functioning as intended.

5. Network Traffic Monitoring:

   • Monitor the flow of network traffic between servers in your network to identify and address any irregularities or potential security threats.

Start Elastic Agent

Start or Restart elastic-agent (opens in a new tab) to apply the configuration changes.

Launch Logit.io to view your logs

How to diagnose no data in Stack

If you don't see data appearing in your stack after following this integration, take a look at the troubleshooting guide for steps to diagnose and resolve the problem or contact our support team and we'll be happy to assist.