diff --git a/filebeat/etc/beat.short.yml b/filebeat/etc/beat.short.yml new file mode 100644 index 00000000000..8ac24e02c7e --- /dev/null +++ b/filebeat/etc/beat.short.yml @@ -0,0 +1,58 @@ +###################### Filebeat Configuration Example ######################### + +# This file is an example configuration file highlighting only the most common +# options. The filebeat.full.yml file from the same directory contains all the +# supported options with more comments. You can use it as a reference. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/filebeat/index.html + +#=========================== Filebeat prospectors ============================= + +filebeat.prospectors: + +# Each - is a prospector. Most options can be set at the prospector level, so +# you can use different prospectors for various configurations. +# Below are the prospector specific configurations. + +- input_type: log + + # Paths that should be crawled and fetched. Glob based paths. + paths: + - /var/log/*.log + #- c:\programdata\elasticsearch\logs\* + + # Exclude lines. A list of regular expressions to match. It drops the lines that are + # matching any regular expression from the list. + #exclude_lines: ["^DBG"] + + # Include lines. A list of regular expressions to match. It exports the lines that are + # matching any regular expression from the list. + #include_lines: ["^ERR", "^WARN"] + + # Exclude files. A list of regular expressions to match. Filebeat drops the files that + # are matching any regular expression from the list. By default, no files are dropped. + #exclude_files: [".gz$"] + + # Optional additional fields. These field can be freely picked + # to add additional information to the crawled log files for filtering + #fields: + # level: debug + # review: 1 + + ### Multiline options + + # Mutiline can be used for log messages spanning multiple lines. This is common + # for Java Stack Traces or C-Line Continuation + + # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [ + #multiline.pattern: ^\[ + + # Defines if the pattern set under pattern should be negated or not. Default is false. + #multiline.negate: false + + # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern + # that was (not) matched before or after or as long as a pattern is not matched based on negate. + # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash + #multiline.match: after + diff --git a/filebeat/etc/beat.yml b/filebeat/etc/beat.yml index a226fc23d4b..28aed2b3208 100644 --- a/filebeat/etc/beat.yml +++ b/filebeat/etc/beat.yml @@ -1,10 +1,19 @@ -###################### Filebeat Configuration Example ######################### +##################$$$###### Filebeat Configuration ############################ + +# This file is a full configuration example documenting all non-deprecated +# options in comments. For a shorter configuration example, that contains only +# the most common options, please see filebeat.short.yml in the same directory. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/filebeat/index.html #=========================== Filebeat prospectors ============================= # List of prospectors to fetch data. filebeat.prospectors: -# Each - is a prospector. Below are the prospector specific configurations +# Each - is a prospector. Most options can be set at the prospector level, so +# you can use different prospectors for various configurations. +# Below are the prospector specific configurations. # Type of the files. Based on this the way the file is read is decided. # The different types cannot be mixed in one prospector @@ -32,25 +41,6 @@ filebeat.prospectors: # hz-gb-2312, euc-kr, euc-jp, iso-2022-jp, shift-jis, ... #encoding: plain - # Decode JSON options. Enable this if your logs are structured in JSON. - # JSON key on which to apply the line filtering and multiline settings. This key - # must be top level and its value must be string, otherwise it is ignored. If - # no text key is defined, the line filtering and multiline features cannot be used. - #json.message_key: - - # By default, the decoded JSON is placed under a "json" key in the output document. - # If you enable this setting, the keys are copied top level in the output document. - #json.keys_under_root: false - - # If keys_under_root and this setting are enabled, then the values from the decoded - # JSON object overwrite the fields that Filebeat normally adds (type, source, offset, etc.) - # in case of conflicts. - #json.overwrite_keys: false - - # If this setting is enabled, Filebeat adds a "json_error" key in case of JSON - # unmarshaling errors or when a text key is defined in the configuration but cannot - # be used. - #json.add_error_key: false # Exclude lines. A list of regular expressions to match. It drops the lines that are # matching any regular expression from the list. The include_lines is called before @@ -106,9 +96,33 @@ filebeat.prospectors: # This is especially useful for multiline log messages which can get large. #max_bytes: 10485760 + ### JSON configuration + + # Decode JSON options. Enable this if your logs are structured in JSON. + # JSON key on which to apply the line filtering and multiline settings. This key + # must be top level and its value must be string, otherwise it is ignored. If + # no text key is defined, the line filtering and multiline features cannot be used. + #json.message_key: + + # By default, the decoded JSON is placed under a "json" key in the output document. + # If you enable this setting, the keys are copied top level in the output document. + #json.keys_under_root: false + + # If keys_under_root and this setting are enabled, then the values from the decoded + # JSON object overwrite the fields that Filebeat normally adds (type, source, offset, etc.) + # in case of conflicts. + #json.overwrite_keys: false + + # If this setting is enabled, Filebeat adds a "json_error" key in case of JSON + # unmarshaling errors or when a text key is defined in the configuration but cannot + # be used. + #json.add_error_key: false + + ### Multiline options + # Mutiline can be used for log messages spanning multiple lines. This is common # for Java Stack Traces or C-Line Continuation - + # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [ #multiline.pattern: ^\[ diff --git a/filebeat/filebeat.short.yml b/filebeat/filebeat.short.yml new file mode 100644 index 00000000000..33dbac3be7b --- /dev/null +++ b/filebeat/filebeat.short.yml @@ -0,0 +1,113 @@ +###################### Filebeat Configuration Example ######################### + +# This file is an example configuration file highlighting only the most common +# options. The filebeat.full.yml file from the same directory contains all the +# supported options with more comments. You can use it as a reference. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/filebeat/index.html + +#=========================== Filebeat prospectors ============================= + +filebeat.prospectors: + +# Each - is a prospector. Most options can be set at the prospector level, so +# you can use different prospectors for various configurations. +# Below are the prospector specific configurations. + +- input_type: log + + # Paths that should be crawled and fetched. Glob based paths. + paths: + - /var/log/*.log + #- c:\programdata\elasticsearch\logs\* + + # Exclude lines. A list of regular expressions to match. It drops the lines that are + # matching any regular expression from the list. + #exclude_lines: ["^DBG"] + + # Include lines. A list of regular expressions to match. It exports the lines that are + # matching any regular expression from the list. + #include_lines: ["^ERR", "^WARN"] + + # Exclude files. A list of regular expressions to match. Filebeat drops the files that + # are matching any regular expression from the list. By default, no files are dropped. + #exclude_files: [".gz$"] + + # Optional additional fields. These field can be freely picked + # to add additional information to the crawled log files for filtering + #fields: + # level: debug + # review: 1 + + ### Multiline options + + # Mutiline can be used for log messages spanning multiple lines. This is common + # for Java Stack Traces or C-Line Continuation + + # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [ + #multiline.pattern: ^\[ + + # Defines if the pattern set under pattern should be negated or not. Default is false. + #multiline.negate: false + + # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern + # that was (not) matched before or after or as long as a pattern is not matched based on negate. + # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash + #multiline.match: after + + +#================================ General ===================================== + +# The name of the shipper that publishes the network data. It can be used to group +# all the transactions sent by a single shipper in the web interface. +#name: + +# The tags of the shipper are included in their own field with each +# transaction published. +#tags: ["service-X", "web-tier"] + +# Optional fields that you can specify to add additional information to the +# output. +#fields: +# env: staging + +#================================ Outputs ===================================== + +# Configure what outputs to use when sending the data collected by the beat. +# Multiple outputs may be used. + +#-------------------------- Elasticsearch output ------------------------------ +output.elasticsearch: + # Array of hosts to connect to. + hosts: ["localhost:9200"] + + # Template name. By default the template name is filebeat. + template.name: "filebeat" + + # Path to template file + template.path: "filebeat.template.json" + + # Overwrite existing template + template.overwrite: false + +#----------------------------- Logstash output -------------------------------- +#output.logstash: + # The Logstash hosts + #hosts: ["localhost:5044"] + + # Optional TLS. By default is off. + # List of root certificates for HTTPS server verifications + #tls.certificate_authorities: ["/etc/pki/root/ca.pem"] + + # Certificate for TLS client authentication + #tls.certificate: "/etc/pki/client/cert.pem" + + # Client Certificate Key + #tls.certificate_key: "/etc/pki/client/cert.key" + +#================================ Logging ===================================== + +# Sets log level. The default log level is error. +# Available log levels are: critical, error, warning, info, debug +#logging.level: error diff --git a/filebeat/filebeat.yml b/filebeat/filebeat.yml index 35b32bf4e0d..4b35cb96627 100644 --- a/filebeat/filebeat.yml +++ b/filebeat/filebeat.yml @@ -1,10 +1,19 @@ -###################### Filebeat Configuration Example ######################### +##################$$$###### Filebeat Configuration ############################ + +# This file is a full configuration example documenting all non-deprecated +# options in comments. For a shorter configuration example, that contains only +# the most common options, please see filebeat.short.yml in the same directory. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/filebeat/index.html #=========================== Filebeat prospectors ============================= # List of prospectors to fetch data. filebeat.prospectors: -# Each - is a prospector. Below are the prospector specific configurations +# Each - is a prospector. Most options can be set at the prospector level, so +# you can use different prospectors for various configurations. +# Below are the prospector specific configurations. # Type of the files. Based on this the way the file is read is decided. # The different types cannot be mixed in one prospector @@ -32,25 +41,6 @@ filebeat.prospectors: # hz-gb-2312, euc-kr, euc-jp, iso-2022-jp, shift-jis, ... #encoding: plain - # Decode JSON options. Enable this if your logs are structured in JSON. - # JSON key on which to apply the line filtering and multiline settings. This key - # must be top level and its value must be string, otherwise it is ignored. If - # no text key is defined, the line filtering and multiline features cannot be used. - #json.message_key: - - # By default, the decoded JSON is placed under a "json" key in the output document. - # If you enable this setting, the keys are copied top level in the output document. - #json.keys_under_root: false - - # If keys_under_root and this setting are enabled, then the values from the decoded - # JSON object overwrite the fields that Filebeat normally adds (type, source, offset, etc.) - # in case of conflicts. - #json.overwrite_keys: false - - # If this setting is enabled, Filebeat adds a "json_error" key in case of JSON - # unmarshaling errors or when a text key is defined in the configuration but cannot - # be used. - #json.add_error_key: false # Exclude lines. A list of regular expressions to match. It drops the lines that are # matching any regular expression from the list. The include_lines is called before @@ -106,9 +96,33 @@ filebeat.prospectors: # This is especially useful for multiline log messages which can get large. #max_bytes: 10485760 + ### JSON configuration + + # Decode JSON options. Enable this if your logs are structured in JSON. + # JSON key on which to apply the line filtering and multiline settings. This key + # must be top level and its value must be string, otherwise it is ignored. If + # no text key is defined, the line filtering and multiline features cannot be used. + #json.message_key: + + # By default, the decoded JSON is placed under a "json" key in the output document. + # If you enable this setting, the keys are copied top level in the output document. + #json.keys_under_root: false + + # If keys_under_root and this setting are enabled, then the values from the decoded + # JSON object overwrite the fields that Filebeat normally adds (type, source, offset, etc.) + # in case of conflicts. + #json.overwrite_keys: false + + # If this setting is enabled, Filebeat adds a "json_error" key in case of JSON + # unmarshaling errors or when a text key is defined in the configuration but cannot + # be used. + #json.add_error_key: false + + ### Multiline options + # Mutiline can be used for log messages spanning multiple lines. This is common # for Java Stack Traces or C-Line Continuation - + # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [ #multiline.pattern: ^\[ @@ -336,7 +350,6 @@ output.elasticsearch: #----------------------------- Logstash output -------------------------------- -### Logstash as output #output.logstash: # The Logstash hosts #hosts: ["localhost:5044"] @@ -411,15 +424,14 @@ output.elasticsearch: # Under Windows systems, the log files are per default sent to the file output, # under all other system per default to syslog. +# Sets log level. The default log level is error. +# Available log levels are: critical, error, warning, info, debug +#logging.level: error - # Enable debug output for selected components. To enable all selectors use ["*"] - # Other available selectors are beat, publish, service - # Multiple selectors can be chained. - #selectors: [ ] - - # Sets log level. The default log level is error. - # Available log levels are: critical, error, warning, info, debug - #level: error +# Enable debug output for selected components. To enable all selectors use ["*"] +# Other available selectors are beat, publish, service +# Multiple selectors can be chained. +#logging.selectors: [ ] # Send all logging output to syslog. The default is false. #logging.to_syslog: true diff --git a/libbeat/_beat/config.short.yml b/libbeat/_beat/config.short.yml new file mode 100644 index 00000000000..75037838d9b --- /dev/null +++ b/libbeat/_beat/config.short.yml @@ -0,0 +1,55 @@ + +#================================ General ===================================== + +# The name of the shipper that publishes the network data. It can be used to group +# all the transactions sent by a single shipper in the web interface. +#name: + +# The tags of the shipper are included in their own field with each +# transaction published. +#tags: ["service-X", "web-tier"] + +# Optional fields that you can specify to add additional information to the +# output. +#fields: +# env: staging + +#================================ Outputs ===================================== + +# Configure what outputs to use when sending the data collected by the beat. +# Multiple outputs may be used. + +#-------------------------- Elasticsearch output ------------------------------ +output.elasticsearch: + # Array of hosts to connect to. + hosts: ["localhost:9200"] + + # Template name. By default the template name is beatname. + template.name: "beatname" + + # Path to template file + template.path: "beatname.template.json" + + # Overwrite existing template + template.overwrite: false + +#----------------------------- Logstash output -------------------------------- +#output.logstash: + # The Logstash hosts + #hosts: ["localhost:5044"] + + # Optional TLS. By default is off. + # List of root certificates for HTTPS server verifications + #tls.certificate_authorities: ["/etc/pki/root/ca.pem"] + + # Certificate for TLS client authentication + #tls.certificate: "/etc/pki/client/cert.pem" + + # Client Certificate Key + #tls.certificate_key: "/etc/pki/client/cert.key" + +#================================ Logging ===================================== + +# Sets log level. The default log level is error. +# Available log levels are: critical, error, warning, info, debug +#logging.level: error diff --git a/libbeat/_beat/config.yml b/libbeat/_beat/config.yml index daecba47262..76fe64fd3d4 100644 --- a/libbeat/_beat/config.yml +++ b/libbeat/_beat/config.yml @@ -147,7 +147,6 @@ output.elasticsearch: #----------------------------- Logstash output -------------------------------- -### Logstash as output #output.logstash: # The Logstash hosts #hosts: ["localhost:5044"] @@ -222,15 +221,14 @@ output.elasticsearch: # Under Windows systems, the log files are per default sent to the file output, # under all other system per default to syslog. +# Sets log level. The default log level is error. +# Available log levels are: critical, error, warning, info, debug +#logging.level: error - # Enable debug output for selected components. To enable all selectors use ["*"] - # Other available selectors are beat, publish, service - # Multiple selectors can be chained. - #selectors: [ ] - - # Sets log level. The default log level is error. - # Available log levels are: critical, error, warning, info, debug - #level: error +# Enable debug output for selected components. To enable all selectors use ["*"] +# Other available selectors are beat, publish, service +# Multiple selectors can be chained. +#logging.selectors: [ ] # Send all logging output to syslog. The default is false. #logging.to_syslog: true diff --git a/libbeat/scripts/Makefile b/libbeat/scripts/Makefile index 924aef0e344..330190ded6f 100755 --- a/libbeat/scripts/Makefile +++ b/libbeat/scripts/Makefile @@ -221,6 +221,8 @@ update: python-env echo "Update config file" rm -f etc/${BEATNAME}.yml cat etc/beat.yml ${ES_BEATS}/libbeat/_beat/config.yml | sed -e "s/beatname/${BEATNAME}/g" > ${BEATNAME}.yml + rm -f etc/${BEATNAME}.short.yml + cat etc/beat.short.yml ${ES_BEATS}/libbeat/_beat/config.short.yml | sed -e "s/beatname/${BEATNAME}/g" > ${BEATNAME}.short.yml # Update fields echo "Update fields" diff --git a/metricbeat/Makefile b/metricbeat/Makefile index 468b7d62e2d..d2a75611446 100644 --- a/metricbeat/Makefile +++ b/metricbeat/Makefile @@ -38,6 +38,7 @@ docs: .PHONY: configs configs: python ${ES_BEATS}/metricbeat/scripts/config_collector.py > etc/beat.yml + python ${ES_BEATS}/metricbeat/scripts/config_collector.py --short > etc/beat.short.yml # This is called by the beats packer before building starts .PHONY: before-build diff --git a/metricbeat/etc/beat.short.yml b/metricbeat/etc/beat.short.yml new file mode 100644 index 00000000000..b5e6ab1aaa6 --- /dev/null +++ b/metricbeat/etc/beat.short.yml @@ -0,0 +1,47 @@ +########################## Metricbeat Configuration ########################### + +# This file is a full configuration example documenting all non-deprecated +# options in comments. For a shorter configuration example, that contains only +# the most common options, please see metricbeat.short.yml in the same directory. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/metricbeat/index.html + +#========================== Modules configuration ============================ +metricbeat.modules: + +#----------------------------- Apache Module ---------------------------------- +- module: apache + metricsets: ["status"] + enabled: true + period: 1s + + # Apache hosts + hosts: ["http://127.0.0.1/"] + +#------------------------------- Mysql Module --------------------------------- +- module: mysql + metricsets: ["status"] + enabled: true + period: 2s + + # Host DSN should be defined as "tcp(127.0.0.1:3306)/" + # The username and password can either be set in the DSN or for all hosts in username and password config option + hosts: ["root@tcp(127.0.0.1:3306)/"] + +#------------------------------- Redis Module --------------------------------- +- module: redis + metricsets: ["info"] + enabled: true + period: 1s + + # Redis hosts + hosts: ["127.0.0.1:6379"] + +#------------------------------ System Module --------------------------------- +- module: system + metricsets: ["cpu", "cores", "filesystem", "fsstats", "memory", "process"] + enabled: true + period: 2s + + diff --git a/metricbeat/etc/beat.yml b/metricbeat/etc/beat.yml index db44859b015..4a243e7f8ab 100644 --- a/metricbeat/etc/beat.yml +++ b/metricbeat/etc/beat.yml @@ -1,4 +1,11 @@ -###################### Metricbeat Configuration Example ####################### +########################## Metricbeat Configuration ########################### + +# This file is a full configuration example documenting all non-deprecated +# options in comments. For a shorter configuration example, that contains only +# the most common options, please see metricbeat.short.yml in the same directory. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/metricbeat/index.html #========================== Modules configuration ============================ metricbeat.modules: diff --git a/metricbeat/metricbeat.short.yml b/metricbeat/metricbeat.short.yml new file mode 100644 index 00000000000..79070359892 --- /dev/null +++ b/metricbeat/metricbeat.short.yml @@ -0,0 +1,102 @@ +########################## Metricbeat Configuration ########################### + +# This file is a full configuration example documenting all non-deprecated +# options in comments. For a shorter configuration example, that contains only +# the most common options, please see metricbeat.short.yml in the same directory. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/metricbeat/index.html + +#========================== Modules configuration ============================ +metricbeat.modules: + +#----------------------------- Apache Module ---------------------------------- +- module: apache + metricsets: ["status"] + enabled: true + period: 1s + + # Apache hosts + hosts: ["http://127.0.0.1/"] + +#------------------------------- Mysql Module --------------------------------- +- module: mysql + metricsets: ["status"] + enabled: true + period: 2s + + # Host DSN should be defined as "tcp(127.0.0.1:3306)/" + # The username and password can either be set in the DSN or for all hosts in username and password config option + hosts: ["root@tcp(127.0.0.1:3306)/"] + +#------------------------------- Redis Module --------------------------------- +- module: redis + metricsets: ["info"] + enabled: true + period: 1s + + # Redis hosts + hosts: ["127.0.0.1:6379"] + +#------------------------------ System Module --------------------------------- +- module: system + metricsets: ["cpu", "cores", "filesystem", "fsstats", "memory", "process"] + enabled: true + period: 2s + + + +#================================ General ===================================== + +# The name of the shipper that publishes the network data. It can be used to group +# all the transactions sent by a single shipper in the web interface. +#name: + +# The tags of the shipper are included in their own field with each +# transaction published. +#tags: ["service-X", "web-tier"] + +# Optional fields that you can specify to add additional information to the +# output. +#fields: +# env: staging + +#================================ Outputs ===================================== + +# Configure what outputs to use when sending the data collected by the beat. +# Multiple outputs may be used. + +#-------------------------- Elasticsearch output ------------------------------ +output.elasticsearch: + # Array of hosts to connect to. + hosts: ["localhost:9200"] + + # Template name. By default the template name is metricbeat. + template.name: "metricbeat" + + # Path to template file + template.path: "metricbeat.template.json" + + # Overwrite existing template + template.overwrite: false + +#----------------------------- Logstash output -------------------------------- +#output.logstash: + # The Logstash hosts + #hosts: ["localhost:5044"] + + # Optional TLS. By default is off. + # List of root certificates for HTTPS server verifications + #tls.certificate_authorities: ["/etc/pki/root/ca.pem"] + + # Certificate for TLS client authentication + #tls.certificate: "/etc/pki/client/cert.pem" + + # Client Certificate Key + #tls.certificate_key: "/etc/pki/client/cert.key" + +#================================ Logging ===================================== + +# Sets log level. The default log level is error. +# Available log levels are: critical, error, warning, info, debug +#logging.level: error diff --git a/metricbeat/metricbeat.yml b/metricbeat/metricbeat.yml index e12b31c1c96..e93678a8d86 100644 --- a/metricbeat/metricbeat.yml +++ b/metricbeat/metricbeat.yml @@ -1,4 +1,11 @@ -###################### Metricbeat Configuration Example ####################### +########################## Metricbeat Configuration ########################### + +# This file is a full configuration example documenting all non-deprecated +# options in comments. For a shorter configuration example, that contains only +# the most common options, please see metricbeat.short.yml in the same directory. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/metricbeat/index.html #========================== Modules configuration ============================ metricbeat.modules: @@ -235,7 +242,6 @@ output.elasticsearch: #----------------------------- Logstash output -------------------------------- -### Logstash as output #output.logstash: # The Logstash hosts #hosts: ["localhost:5044"] @@ -310,15 +316,14 @@ output.elasticsearch: # Under Windows systems, the log files are per default sent to the file output, # under all other system per default to syslog. +# Sets log level. The default log level is error. +# Available log levels are: critical, error, warning, info, debug +#logging.level: error - # Enable debug output for selected components. To enable all selectors use ["*"] - # Other available selectors are beat, publish, service - # Multiple selectors can be chained. - #selectors: [ ] - - # Sets log level. The default log level is error. - # Available log levels are: critical, error, warning, info, debug - #level: error +# Enable debug output for selected components. To enable all selectors use ["*"] +# Other available selectors are beat, publish, service +# Multiple selectors can be chained. +#logging.selectors: [ ] # Send all logging output to syslog. The default is false. #logging.to_syslog: true diff --git a/metricbeat/module/apache/_beat/config.short.yml b/metricbeat/module/apache/_beat/config.short.yml new file mode 100644 index 00000000000..e7438e503f3 --- /dev/null +++ b/metricbeat/module/apache/_beat/config.short.yml @@ -0,0 +1,8 @@ +#----------------------------- Apache Module ---------------------------------- +- module: apache + metricsets: ["status"] + enabled: true + period: 1s + + # Apache hosts + hosts: ["http://127.0.0.1/"] diff --git a/metricbeat/module/mysql/_beat/config.short.yml b/metricbeat/module/mysql/_beat/config.short.yml new file mode 100644 index 00000000000..3d57dbccf2d --- /dev/null +++ b/metricbeat/module/mysql/_beat/config.short.yml @@ -0,0 +1,9 @@ +#------------------------------- Mysql Module --------------------------------- +- module: mysql + metricsets: ["status"] + enabled: true + period: 2s + + # Host DSN should be defined as "tcp(127.0.0.1:3306)/" + # The username and password can either be set in the DSN or for all hosts in username and password config option + hosts: ["root@tcp(127.0.0.1:3306)/"] diff --git a/metricbeat/module/redis/_beat/config.short.yml b/metricbeat/module/redis/_beat/config.short.yml new file mode 100644 index 00000000000..da65f001989 --- /dev/null +++ b/metricbeat/module/redis/_beat/config.short.yml @@ -0,0 +1,8 @@ +#------------------------------- Redis Module --------------------------------- +- module: redis + metricsets: ["info"] + enabled: true + period: 1s + + # Redis hosts + hosts: ["127.0.0.1:6379"] diff --git a/metricbeat/module/system/_beat/config.short.yml b/metricbeat/module/system/_beat/config.short.yml new file mode 100644 index 00000000000..3c86bc82aac --- /dev/null +++ b/metricbeat/module/system/_beat/config.short.yml @@ -0,0 +1,5 @@ +#------------------------------ System Module --------------------------------- +- module: system + metricsets: ["cpu", "cores", "filesystem", "fsstats", "memory", "process"] + enabled: true + period: 2s diff --git a/metricbeat/scripts/config_collector.py b/metricbeat/scripts/config_collector.py index 5a1f31757d0..3dbe3eec4e7 100644 --- a/metricbeat/scripts/config_collector.py +++ b/metricbeat/scripts/config_collector.py @@ -1,8 +1,30 @@ import os +import argparse # Collects config for all modules -header = """###################### Metricbeat Configuration Example ####################### +header = """########################## Metricbeat Configuration ########################### + +# This file is a full configuration example documenting all non-deprecated +# options in comments. For a shorter configuration example, that contains only +# the most common options, please see metricbeat.short.yml in the same directory. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/metricbeat/index.html + +#========================== Modules configuration ============================ +metricbeat.modules: + +""" + +header_short = """###################### Metricbeat Configuration Example ####################### + +# This file is an example configuration file highlighting only the most common +# options. The metricbeat.yml file from the same directory contains all the +# supported options with more comments. You can use it as a reference. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/metricbeat/index.html #========================== Modules configuration ============================ metricbeat.modules: @@ -10,7 +32,7 @@ """ -def collect(): +def collect(short=False): base_dir = "module" path = os.path.abspath("module") @@ -21,7 +43,10 @@ def collect(): # Iterate over all modules for module in os.listdir(base_dir): - module_configs = path + "/" + module + "/_beat/config.yml" + if short: + module_configs = path + "/" + module + "/_beat/config.short.yml" + else: + module_configs = path + "/" + module + "/_beat/config.yml" # Only check folders where fields.yml exists if not os.path.isfile(module_configs): @@ -37,4 +62,9 @@ def collect(): print config_yml if __name__ == "__main__": - collect() + parser = argparse.ArgumentParser( + description="Collects modules docs") + parser.add_argument("--short", action="store_true", + help="Collect the short versions") + args = parser.parse_args() + collect(args.short) diff --git a/packetbeat/etc/beat.short.yml b/packetbeat/etc/beat.short.yml new file mode 100644 index 00000000000..af442db6a70 --- /dev/null +++ b/packetbeat/etc/beat.short.yml @@ -0,0 +1,89 @@ +#################### Packetbeat Configuration Example ######################### + +# This file is an example configuration file highlighting only the most common +# options. The packetbeat.yml file from the same directory contains all the +# supported options with more comments. You can use it as a reference. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/packetbeat/index.html + +#============================== Network device ================================ + +# Select the network interface to sniff the data. You can use the "any" +# keyword to sniff on all connected interfaces. +packetbeat.interfaces.device: any + +#================================== Flows ===================================== + +# Comment out all options to disable flows reporting. + +# Set network flow timeout. Flow is killed if no packet is received before being +# timed out. +packetbeat.flows.timeout: 30s + +# Configure reporting period. If set to -1, only killed flows will be reported +packetbeat.flows.period: 10s + +#========================== Transaction protocols ============================= + +packetbeat.protocols.icmp: + # Enable ICMPv4 and ICMPv6 monitoring. Default: false + enabled: true + +packetbeat.protocols.amqp: + # Configure the ports where to listen for AMQP traffic. You can disable + # the AMQP protocol by commenting out the list of ports. + ports: [5672] + +packetbeat.protocols.dns: + # Configure the ports where to listen for DNS traffic. You can disable + # the DNS protocol by commenting out the list of ports. + ports: [53] + + # include_authorities controls whether or not the dns.authorities field + # (authority resource records) is added to messages. + include_authorities: true + + # include_additionals controls whether or not the dns.additionals field + # (additional resource records) is added to messages. + include_additionals: true + +packetbeat.protocols.http: + # Configure the ports where to listen for HTTP traffic. You can disable + # the HTTP protocol by commenting out the list of ports. + ports: [80, 8080, 8000, 5000, 8002] + +packetbeat.protocols.memcache: + # Configure the ports where to listen for memcache traffic. You can disable + # the Memcache protocol by commenting out the list of ports. + ports: [11211] + +packetbeat.protocols.mysql: + # Configure the ports where to listen for MySQL traffic. You can disable + # the MySQL protocol by commenting out the list of ports. + ports: [3306] + +packetbeat.protocols.pgsql: + # Configure the ports where to listen for Pgsql traffic. You can disable + # the Pgsql protocol by commenting out the list of ports. + ports: [5432] + +packetbeat.protocols.redis: + # Configure the ports where to listen for Redis traffic. You can disable + # the Redis protocol by commenting out the list of ports. + ports: [6379] + +packetbeat.protocols.thrift: + # Configure the ports where to listen for Thrift-RPC traffic. You can disable + # the Thrift-RPC protocol by commenting out the list of ports. + ports: [9090] + +packetbeat.protocols.mongodb: + # Configure the ports where to listen for MongoDB traffic. You can disable + # the MongoDB protocol by commenting out the list of ports. + ports: [27017] + +packetbeat.protocols.nfs: + # Configure the ports where to listen for NFS traffic. You can disable + # the NFS protocol by commenting out the list of ports. + ports: [2049] diff --git a/packetbeat/etc/beat.yml b/packetbeat/etc/beat.yml index 1418e6960ca..63c57142626 100644 --- a/packetbeat/etc/beat.yml +++ b/packetbeat/etc/beat.yml @@ -1,16 +1,15 @@ ###################### Packetbeat Configuration Example ####################### -# This file contains an overview of various configuration settings. Please consult -# the docs at https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-configuration.html -# for more details. - -# The Packetbeat shipper works by sniffing the network traffic between your -# application components. It inserts meta-data about each transaction into -# Elasticsearch. +# This file is a full configuration example documenting all non-deprecated +# options in comments. For a shorter configuration example, that contains only +# the most common options, please see packetbeat.short.yml in the same directory. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/packetbeat/index.html -#================================ Interfaces ================================== +#============================== Network device ================================ -# Select the network interfaces to sniff the data. You can use the "any" +# Select the network interface to sniff the data. You can use the "any" # keyword to sniff on all connected interfaces. packetbeat.interfaces.device: any diff --git a/packetbeat/packetbeat.short.yml b/packetbeat/packetbeat.short.yml new file mode 100644 index 00000000000..a7ed37b7544 --- /dev/null +++ b/packetbeat/packetbeat.short.yml @@ -0,0 +1,144 @@ +#################### Packetbeat Configuration Example ######################### + +# This file is an example configuration file highlighting only the most common +# options. The packetbeat.yml file from the same directory contains all the +# supported options with more comments. You can use it as a reference. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/packetbeat/index.html + +#============================== Network device ================================ + +# Select the network interface to sniff the data. You can use the "any" +# keyword to sniff on all connected interfaces. +packetbeat.interfaces.device: any + +#================================== Flows ===================================== + +# Comment out all options to disable flows reporting. + +# Set network flow timeout. Flow is killed if no packet is received before being +# timed out. +packetbeat.flows.timeout: 30s + +# Configure reporting period. If set to -1, only killed flows will be reported +packetbeat.flows.period: 10s + +#========================== Transaction protocols ============================= + +packetbeat.protocols.icmp: + # Enable ICMPv4 and ICMPv6 monitoring. Default: false + enabled: true + +packetbeat.protocols.amqp: + # Configure the ports where to listen for AMQP traffic. You can disable + # the AMQP protocol by commenting out the list of ports. + ports: [5672] + +packetbeat.protocols.dns: + # Configure the ports where to listen for DNS traffic. You can disable + # the DNS protocol by commenting out the list of ports. + ports: [53] + + # include_authorities controls whether or not the dns.authorities field + # (authority resource records) is added to messages. + include_authorities: true + + # include_additionals controls whether or not the dns.additionals field + # (additional resource records) is added to messages. + include_additionals: true + +packetbeat.protocols.http: + # Configure the ports where to listen for HTTP traffic. You can disable + # the HTTP protocol by commenting out the list of ports. + ports: [80, 8080, 8000, 5000, 8002] + +packetbeat.protocols.memcache: + # Configure the ports where to listen for memcache traffic. You can disable + # the Memcache protocol by commenting out the list of ports. + ports: [11211] + +packetbeat.protocols.mysql: + # Configure the ports where to listen for MySQL traffic. You can disable + # the MySQL protocol by commenting out the list of ports. + ports: [3306] + +packetbeat.protocols.pgsql: + # Configure the ports where to listen for Pgsql traffic. You can disable + # the Pgsql protocol by commenting out the list of ports. + ports: [5432] + +packetbeat.protocols.redis: + # Configure the ports where to listen for Redis traffic. You can disable + # the Redis protocol by commenting out the list of ports. + ports: [6379] + +packetbeat.protocols.thrift: + # Configure the ports where to listen for Thrift-RPC traffic. You can disable + # the Thrift-RPC protocol by commenting out the list of ports. + ports: [9090] + +packetbeat.protocols.mongodb: + # Configure the ports where to listen for MongoDB traffic. You can disable + # the MongoDB protocol by commenting out the list of ports. + ports: [27017] + +packetbeat.protocols.nfs: + # Configure the ports where to listen for NFS traffic. You can disable + # the NFS protocol by commenting out the list of ports. + ports: [2049] + +#================================ General ===================================== + +# The name of the shipper that publishes the network data. It can be used to group +# all the transactions sent by a single shipper in the web interface. +#name: + +# The tags of the shipper are included in their own field with each +# transaction published. +#tags: ["service-X", "web-tier"] + +# Optional fields that you can specify to add additional information to the +# output. +#fields: +# env: staging + +#================================ Outputs ===================================== + +# Configure what outputs to use when sending the data collected by the beat. +# Multiple outputs may be used. + +#-------------------------- Elasticsearch output ------------------------------ +output.elasticsearch: + # Array of hosts to connect to. + hosts: ["localhost:9200"] + + # Template name. By default the template name is packetbeat. + template.name: "packetbeat" + + # Path to template file + template.path: "packetbeat.template.json" + + # Overwrite existing template + template.overwrite: false + +#----------------------------- Logstash output -------------------------------- +#output.logstash: + # The Logstash hosts + #hosts: ["localhost:5044"] + + # Optional TLS. By default is off. + # List of root certificates for HTTPS server verifications + #tls.certificate_authorities: ["/etc/pki/root/ca.pem"] + + # Certificate for TLS client authentication + #tls.certificate: "/etc/pki/client/cert.pem" + + # Client Certificate Key + #tls.certificate_key: "/etc/pki/client/cert.key" + +#================================ Logging ===================================== + +# Sets log level. The default log level is error. +# Available log levels are: critical, error, warning, info, debug +#logging.level: error diff --git a/packetbeat/packetbeat.yml b/packetbeat/packetbeat.yml index 0ed8554ae4f..046b1e8d4e7 100644 --- a/packetbeat/packetbeat.yml +++ b/packetbeat/packetbeat.yml @@ -1,16 +1,15 @@ ###################### Packetbeat Configuration Example ####################### -# This file contains an overview of various configuration settings. Please consult -# the docs at https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-configuration.html -# for more details. - -# The Packetbeat shipper works by sniffing the network traffic between your -# application components. It inserts meta-data about each transaction into -# Elasticsearch. +# This file is a full configuration example documenting all non-deprecated +# options in comments. For a shorter configuration example, that contains only +# the most common options, please see packetbeat.short.yml in the same directory. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/packetbeat/index.html -#================================ Interfaces ================================== +#============================== Network device ================================ -# Select the network interfaces to sniff the data. You can use the "any" +# Select the network interface to sniff the data. You can use the "any" # keyword to sniff on all connected interfaces. packetbeat.interfaces.device: any @@ -324,7 +323,6 @@ output.elasticsearch: #----------------------------- Logstash output -------------------------------- -### Logstash as output #output.logstash: # The Logstash hosts #hosts: ["localhost:5044"] @@ -399,15 +397,14 @@ output.elasticsearch: # Under Windows systems, the log files are per default sent to the file output, # under all other system per default to syslog. +# Sets log level. The default log level is error. +# Available log levels are: critical, error, warning, info, debug +#logging.level: error - # Enable debug output for selected components. To enable all selectors use ["*"] - # Other available selectors are beat, publish, service - # Multiple selectors can be chained. - #selectors: [ ] - - # Sets log level. The default log level is error. - # Available log levels are: critical, error, warning, info, debug - #level: error +# Enable debug output for selected components. To enable all selectors use ["*"] +# Other available selectors are beat, publish, service +# Multiple selectors can be chained. +#logging.selectors: [ ] # Send all logging output to syslog. The default is false. #logging.to_syslog: true diff --git a/topbeat/etc/beat.short.yml b/topbeat/etc/beat.short.yml new file mode 100644 index 00000000000..58291336111 --- /dev/null +++ b/topbeat/etc/beat.short.yml @@ -0,0 +1,31 @@ +###################### Topbeat Configuration Example ########################## + +# This file is an example configuration file highlighting only the most common +# options. The topbeat.yml file from the same directory contains all the +# supported options with more comments. You can use it as a reference. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/topbeat/index.html + +#======================== Topbeat specific options ============================ + +# In seconds, defines how often to read server statistics +topbeat.period: 10 + +# Regular expression to match the processes that are monitored +# By default, all the processes are monitored +topbeat.procs: [".*"] + +# Statistics to collect (all enabled by default) +topbeat.stats: + # per system statistics, by default is true + system: true + + # per process statistics, by default is true + process: true + + # file system information, by default is true + filesystem: true + + # cpu usage per core, by default is false + cpu_per_core: false diff --git a/topbeat/etc/beat.yml b/topbeat/etc/beat.yml index 74f8a888d6e..7ab9460d7ea 100644 --- a/topbeat/etc/beat.yml +++ b/topbeat/etc/beat.yml @@ -1,4 +1,11 @@ -###################### Topbeat Configuration Example ########################## +########################### Topbeat Configuration ############################# + +# This file is a full configuration example documenting all non-deprecated +# options in comments. For a shorter configuration example, that contains only +# the most common options, please see topbeat.short.yml in the same directory. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/topbeat/index.html #======================== Topbeat specific options ============================ @@ -13,7 +20,7 @@ topbeat.procs: [".*"] topbeat.stats: # per system statistics, by default is true system: true - + # per process statistics, by default is true process: true @@ -22,4 +29,3 @@ topbeat.stats: # cpu usage per core, by default is false cpu_per_core: false - diff --git a/topbeat/topbeat.short.yml b/topbeat/topbeat.short.yml new file mode 100644 index 00000000000..9c4ae2ba048 --- /dev/null +++ b/topbeat/topbeat.short.yml @@ -0,0 +1,86 @@ +###################### Topbeat Configuration Example ########################## + +# This file is an example configuration file highlighting only the most common +# options. The topbeat.yml file from the same directory contains all the +# supported options with more comments. You can use it as a reference. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/topbeat/index.html + +#======================== Topbeat specific options ============================ + +# In seconds, defines how often to read server statistics +topbeat.period: 10 + +# Regular expression to match the processes that are monitored +# By default, all the processes are monitored +topbeat.procs: [".*"] + +# Statistics to collect (all enabled by default) +topbeat.stats: + # per system statistics, by default is true + system: true + + # per process statistics, by default is true + process: true + + # file system information, by default is true + filesystem: true + + # cpu usage per core, by default is false + cpu_per_core: false + +#================================ General ===================================== + +# The name of the shipper that publishes the network data. It can be used to group +# all the transactions sent by a single shipper in the web interface. +#name: + +# The tags of the shipper are included in their own field with each +# transaction published. +#tags: ["service-X", "web-tier"] + +# Optional fields that you can specify to add additional information to the +# output. +#fields: +# env: staging + +#================================ Outputs ===================================== + +# Configure what outputs to use when sending the data collected by the beat. +# Multiple outputs may be used. + +#-------------------------- Elasticsearch output ------------------------------ +output.elasticsearch: + # Array of hosts to connect to. + hosts: ["localhost:9200"] + + # Template name. By default the template name is topbeat. + template.name: "topbeat" + + # Path to template file + template.path: "topbeat.template.json" + + # Overwrite existing template + template.overwrite: false + +#----------------------------- Logstash output -------------------------------- +#output.logstash: + # The Logstash hosts + #hosts: ["localhost:5044"] + + # Optional TLS. By default is off. + # List of root certificates for HTTPS server verifications + #tls.certificate_authorities: ["/etc/pki/root/ca.pem"] + + # Certificate for TLS client authentication + #tls.certificate: "/etc/pki/client/cert.pem" + + # Client Certificate Key + #tls.certificate_key: "/etc/pki/client/cert.key" + +#================================ Logging ===================================== + +# Sets log level. The default log level is error. +# Available log levels are: critical, error, warning, info, debug +#logging.level: error diff --git a/topbeat/topbeat.yml b/topbeat/topbeat.yml index 9d948a6e9a9..83437c50241 100644 --- a/topbeat/topbeat.yml +++ b/topbeat/topbeat.yml @@ -1,4 +1,11 @@ -###################### Topbeat Configuration Example ########################## +########################### Topbeat Configuration ############################# + +# This file is a full configuration example documenting all non-deprecated +# options in comments. For a shorter configuration example, that contains only +# the most common options, please see topbeat.short.yml in the same directory. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/topbeat/index.html #======================== Topbeat specific options ============================ @@ -13,7 +20,7 @@ topbeat.procs: [".*"] topbeat.stats: # per system statistics, by default is true system: true - + # per process statistics, by default is true process: true @@ -23,7 +30,6 @@ topbeat.stats: # cpu usage per core, by default is false cpu_per_core: false - #================================ General ===================================== # The name of the shipper that publishes the network data. It can be used to group @@ -172,7 +178,6 @@ output.elasticsearch: #----------------------------- Logstash output -------------------------------- -### Logstash as output #output.logstash: # The Logstash hosts #hosts: ["localhost:5044"] @@ -247,15 +252,14 @@ output.elasticsearch: # Under Windows systems, the log files are per default sent to the file output, # under all other system per default to syslog. +# Sets log level. The default log level is error. +# Available log levels are: critical, error, warning, info, debug +#logging.level: error - # Enable debug output for selected components. To enable all selectors use ["*"] - # Other available selectors are beat, publish, service - # Multiple selectors can be chained. - #selectors: [ ] - - # Sets log level. The default log level is error. - # Available log levels are: critical, error, warning, info, debug - #level: error +# Enable debug output for selected components. To enable all selectors use ["*"] +# Other available selectors are beat, publish, service +# Multiple selectors can be chained. +#logging.selectors: [ ] # Send all logging output to syslog. The default is false. #logging.to_syslog: true diff --git a/winlogbeat/etc/beat.short.yml b/winlogbeat/etc/beat.short.yml new file mode 100644 index 00000000000..8b877a6c6db --- /dev/null +++ b/winlogbeat/etc/beat.short.yml @@ -0,0 +1,24 @@ +###################### Winlogbeat Configuration Example ########################## + +# This file is an example configuration file highlighting only the most common +# options. The winlogbeat.yml file from the same directory contains all the +# supported options with more comments. You can use it as a reference. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/winlogbeat/index.html + +#======================= Winlogbeat specific options ========================== + +# event_logs specifies a list of event logs to monitor as well as any +# accompanying options. The YAML data type of event_logs is a list of +# dictionaries. +# +# The supported keys are name (required), tags, fields, fields_under_root, +# ignore_older, level, event_id, provider, and include_xml. Please visit the +# documentation for the complete details of each option. +# https://go.es.io/WinlogbeatConfig +winlogbeat.event_logs: + - name: Application + ignore_older: 72h + - name: Security + - name: System diff --git a/winlogbeat/etc/beat.yml b/winlogbeat/etc/beat.yml index d80ea07a2bc..99de7413385 100644 --- a/winlogbeat/etc/beat.yml +++ b/winlogbeat/etc/beat.yml @@ -1,4 +1,13 @@ -###################### Winlogbeat Configuration Example ####################### +########################## Winlogbeat Configuration ########################### + +# This file is a full configuration example documenting all non-deprecated +# options in comments. For a shorter configuration example, that contains only +# the most common options, please see winlogbeat.short.yml in the same directory. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/winlogbeat/index.html + +#======================= Winlogbeat specific options ========================== # The registry file is where Winlogbeat persists its state so that the beat # can resume after shutdown or an outage. The default is .winlogbeat.yml @@ -24,5 +33,3 @@ winlogbeat.event_logs: ignore_older: 72h - name: Security - name: System - - diff --git a/winlogbeat/winlogbeat.short.yml b/winlogbeat/winlogbeat.short.yml new file mode 100644 index 00000000000..360f3a89002 --- /dev/null +++ b/winlogbeat/winlogbeat.short.yml @@ -0,0 +1,79 @@ +###################### Winlogbeat Configuration Example ########################## + +# This file is an example configuration file highlighting only the most common +# options. The winlogbeat.yml file from the same directory contains all the +# supported options with more comments. You can use it as a reference. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/winlogbeat/index.html + +#======================= Winlogbeat specific options ========================== + +# event_logs specifies a list of event logs to monitor as well as any +# accompanying options. The YAML data type of event_logs is a list of +# dictionaries. +# +# The supported keys are name (required), tags, fields, fields_under_root, +# ignore_older, level, event_id, provider, and include_xml. Please visit the +# documentation for the complete details of each option. +# https://go.es.io/WinlogbeatConfig +winlogbeat.event_logs: + - name: Application + ignore_older: 72h + - name: Security + - name: System + +#================================ General ===================================== + +# The name of the shipper that publishes the network data. It can be used to group +# all the transactions sent by a single shipper in the web interface. +#name: + +# The tags of the shipper are included in their own field with each +# transaction published. +#tags: ["service-X", "web-tier"] + +# Optional fields that you can specify to add additional information to the +# output. +#fields: +# env: staging + +#================================ Outputs ===================================== + +# Configure what outputs to use when sending the data collected by the beat. +# Multiple outputs may be used. + +#-------------------------- Elasticsearch output ------------------------------ +output.elasticsearch: + # Array of hosts to connect to. + hosts: ["localhost:9200"] + + # Template name. By default the template name is winlogbeat. + template.name: "winlogbeat" + + # Path to template file + template.path: "winlogbeat.template.json" + + # Overwrite existing template + template.overwrite: false + +#----------------------------- Logstash output -------------------------------- +#output.logstash: + # The Logstash hosts + #hosts: ["localhost:5044"] + + # Optional TLS. By default is off. + # List of root certificates for HTTPS server verifications + #tls.certificate_authorities: ["/etc/pki/root/ca.pem"] + + # Certificate for TLS client authentication + #tls.certificate: "/etc/pki/client/cert.pem" + + # Client Certificate Key + #tls.certificate_key: "/etc/pki/client/cert.key" + +#================================ Logging ===================================== + +# Sets log level. The default log level is error. +# Available log levels are: critical, error, warning, info, debug +#logging.level: error diff --git a/winlogbeat/winlogbeat.yml b/winlogbeat/winlogbeat.yml index 084813750f6..4169d1930eb 100644 --- a/winlogbeat/winlogbeat.yml +++ b/winlogbeat/winlogbeat.yml @@ -1,4 +1,13 @@ -###################### Winlogbeat Configuration Example ####################### +########################## Winlogbeat Configuration ########################### + +# This file is a full configuration example documenting all non-deprecated +# options in comments. For a shorter configuration example, that contains only +# the most common options, please see winlogbeat.short.yml in the same directory. +# +# You can find the full configuration reference here: +# https://www.elastic.co/guide/en/beats/winlogbeat/index.html + +#======================= Winlogbeat specific options ========================== # The registry file is where Winlogbeat persists its state so that the beat # can resume after shutdown or an outage. The default is .winlogbeat.yml @@ -25,8 +34,6 @@ winlogbeat.event_logs: - name: Security - name: System - - #================================ General ===================================== # The name of the shipper that publishes the network data. It can be used to group @@ -175,7 +182,6 @@ output.elasticsearch: #----------------------------- Logstash output -------------------------------- -### Logstash as output #output.logstash: # The Logstash hosts #hosts: ["localhost:5044"] @@ -250,15 +256,14 @@ output.elasticsearch: # Under Windows systems, the log files are per default sent to the file output, # under all other system per default to syslog. +# Sets log level. The default log level is error. +# Available log levels are: critical, error, warning, info, debug +#logging.level: error - # Enable debug output for selected components. To enable all selectors use ["*"] - # Other available selectors are beat, publish, service - # Multiple selectors can be chained. - #selectors: [ ] - - # Sets log level. The default log level is error. - # Available log levels are: critical, error, warning, info, debug - #level: error +# Enable debug output for selected components. To enable all selectors use ["*"] +# Other available selectors are beat, publish, service +# Multiple selectors can be chained. +#logging.selectors: [ ] # Send all logging output to syslog. The default is false. #logging.to_syslog: true