Elastic Beats Input Plugin

Plugin 2.4.0-beta.1

[DEPRECATED] Elastic Beats Input plugin for Graylog

joschi

free!

Download from Github View on Github 3 16

Published

20 Oct 10:28

Last Push

28 May 08:16

Marketplace Rating

Discussion

3 Comments

Readme from Github

DEPRECATION NOTICE

This project has been merged into graylog2-server, see #28

Please use the issue tracker in the graylog2-server repository for any feature requests or bug reports.

Elastic Beats Input Plugin for Graylog

Required Graylog version: 2.2.0 and later

This plugin provides an input for the Elastic Beats (formerly Lumberjack) protocol in Graylog which can be used to receive data by log shippers from the logstash-forwards and the Beats family, like Filebeat, Metricbeat, Packetbeat, or Winlogbeat.

Installation

Download the plugin and place the JAR file in your Graylog plugin directory. By default the plugin directory is the plugins/ directory relative to your Graylog installation directory and can be configured in your graylog.conf file.

Restart Graylog and you are done.

Build

This project is using Maven and requires Java 8 or higher.

You can build the plugin (JAR) with mvn package.

DEB and RPM packages can be build with mvn jdeb:jdeb and mvn rpm:rpm respectively.

Plugin Release

In order to release a new version of the plugin, run the following commands:

$ mvn release:prepare
$ mvn release:perform

This sets the version numbers, creates a tag and pushes to GitHub.

Travis CI will build the release artifacts and upload to GitHub automatically.

License

This library is licensed under the GNU General Public License, Version 3.0.

See https://www.gnu.org/licenses/gpl-3.0.html or the LICENSE.txt file in this repository for the full license text.

Your Rating

Please sign in to rate this add-on.

Comments

javrllerenas almost 2 years ago

I can see my dedicated input is receiving messages, but when I click on "See Messages" for that input, it does not find any. Any ideas why?

joschi about 3 years ago

@alpha-centauri: "logstash" is the correct output for Filebeat. The plugin simply didn't index the "count" and "offset" fields, but that has been fixed in version 1.0.3.

Please file a bug report on GitHub if you find any other issues: https://github.com/Graylog2/graylog-plugin-beats/issues

alpha-centauri about 3 years ago

Very useful plugin! What is the recommended Beats output? When using "logstash" output in filebeat.yml, Graylog does not receive the standard fields Logstash would receive, in particular the field "offset" Filebeat usually sends.

Please sign in to comment.

Back to listing