Beats

lastmod 2021-03-03created 2018-07-314 edits

Beats - Lightweight shippers for Elasticsearch & Logstash

Docker service integration

• Collecting Docker logs with ELK

There seem to be several possible ways to collect Docker container logs in ELK.

• Using the Autodiscovery feature
• Using the Syslog log driver
• Sending logs to elasticsearch through Fluentd
• Using a volume mount
• Using the add_docker_metadata processor in Filebeat

Officially supported Beats

• Auditbeat - Collect your Linux audit framework data and monitor the integrity of your files.
• Filebeat - Tails and ships log files
• Functionbeat - Read and ships events from serverless infrastructure.
• Heartbeat - Ping remote services for availability
• Journalbeat - Read and ships event from Journald.
• Metricbeat - Fetches sets of metrics from the operating system and services
• Packetbeat - Monitors the network and applications by sniffing packets
• Winlogbeat - Fetches and ships Windows Event logs

ELK Stack

• Elasticsearch
• Logstash
• Kibana

Favorite site

• Beats Platform Reference (6.3) > Overview
• Building a logging system with Docker-ELK, Filebeat, and Node.js
• A Filebeat Tutorial: Getting Started