Filebeat is used to ship logs to logstash or Elastic search to filter and use them as per requirement. Whether you’re collecting from security devices, cloud, containers, hosts, or OT, Filebeat helps you keep the simple things simple by offering a lightweight way to forward and centralize logs and files.
An input is responsible for managing the harvesters and finding all sources to read from.
In this tutorial we will learn how to install filebeat on CentOS 8. Following are 2 methods to install filebeat you can follow either of the following:
Method 1: Install Elastic Stack Repos on CentOS 8
Filebeat is not available on the default CentOS 8 and therefore you need to install Elastic Stack repos.
We will add yum Repositories for Filebeat so that we can install it using yum command which is very easy tools to play with.
Install Elastic Stack repo GPG signing key using following command:
sudo rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch
Next, install Elastic Stack repo on CentOS 8.
cat > /etc/yum.repos.d/elasticstack.repo << EOL [elasticstack] name=Elastic repository for 7.x packages baseurl=https://artifacts.elastic.co/packages/7.x/yum gpgcheck=1 gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch enabled=1 autorefresh=1 type=rpm-md EOL
Once the repos are in place, you can install by running the command below;
dnf install filebeat
Method 2: Install Filebeat using RPM Package
Should you choose to install Filebeat on CentOS 8 using the RPM package, simply grab the link to the latest stable release version of the filebeat RPM package from Filebeat download’s page and run either of the command below;
dnf install https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.7.1-x86_64.rpm
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.7.1-x86_64.rpm rpm -vi filebeat-7.7.1-x86_64.rpm
Start and enable Filebeat to run on system boot;
sudo systemctl start filebeat sudo systemctl enable filebeat sudo systemctl status filebeat
You should see output like shown in the following picture against the command systemctl status filebeat
Filebeat has been installed in your system successfully now you can configure filebeat as per your requirement by editing configuration file using command “sudo nano /etc/filebeat/filebeat.yml”