4. Configuring Logstash

Configuration files

Logstash configuration files are located in /usr/share/logstash/pipeline
The volume of the Logstash containerhas to be mapped accordingly on the host server.

i.e.:
/srv/logstash/etc:/usr/share/logstash/pipeline

You can find useful configuration files templates on the Logstash directory of this Github:
https://github.com/Alexandre-Guth/Elastic-Stack-FileBeat-Logspout/tree/master/Logstash
And also some configuration examples on the Elastic website:
https://www.elastic.co/guide/en/logstash/6.1/logstash-config-for-filebeat-modules.html#parsing-system

Beat plugins

Install Beats plugin in logstash

sudo /opt/logstash/bin/logstash-plugin install logstash-input-beats

Output:

Validating logstash-input-beats
Installing logstash-input-beats
Installation successful