diff --git a/solutions/observability/apps/api-keys.md b/solutions/observability/apps/api-keys.md index b0b18da13f..83951bfdca 100644 --- a/solutions/observability/apps/api-keys.md +++ b/solutions/observability/apps/api-keys.md @@ -146,7 +146,7 @@ APM Server provides a command line interface for creating, retrieving, invalidat The user requesting to create an API Key needs to have APM privileges used by the APM Server. A superuser, by default, has these privileges. - ::::{dropdown} **Expand for more information on assigning these privileges to other users** + ::::{dropdown} Expand for more information on assigning these privileges to other users To create an APM Server user with the required privileges for creating and managing API keys: 1. Create an **API key role**, called something like `apm_api_key`, that has the following `cluster` level privileges: diff --git a/solutions/observability/logs/add-service-name-to-logs.md b/solutions/observability/logs/add-service-name-to-logs.md index 3e78fdf6b3..81791ed5d6 100644 --- a/solutions/observability/logs/add-service-name-to-logs.md +++ b/solutions/observability/logs/add-service-name-to-logs.md @@ -2,6 +2,9 @@ mapped_urls: - https://www.elastic.co/guide/en/observability/current/add-logs-service-name.html - https://www.elastic.co/guide/en/serverless/current/observability-add-logs-service-name.html +applies_to: + stack: all + serverless: all --- # Add a service name to logs [observability-add-logs-service-name] @@ -42,7 +45,7 @@ For more on defining processors, refer to [define processors](asciidocalypse://d For logs that with an existing field being used to represent the service name, map that field to the `service.name` field using the [alias field type](asciidocalypse://docs/elasticsearch/docs/reference/elasticsearch/mapping-reference/field-alias.md). Follow these steps to update your mapping: -1. find **Stack Management** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). +1. Find **Stack Management** in the main menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). 2. Select **Index Templates**. 3. Search for the index template you want to update. 4. From the **Actions** menu for that template, select **edit**. @@ -58,13 +61,5 @@ For more ways to add a field to your mapping, refer to [add a field to an existi The {{stack}} provides additional ways to process your data: -* **https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html[Ingest pipelines]:** convert data to ECS, normalize field data, or enrich incoming data. -* **https://www.elastic.co/guide/en/logstash/current/introduction.html[Logstash]:** enrich your data using input, output, and filter plugins. - - -% What needs to be done: Align serverless/stateful - -% Use migrated content from existing pages that map to this page: - -% - [ ] ./raw-migrated-files/observability-docs/observability/add-logs-service-name.md -% - [ ] ./raw-migrated-files/docs-content/serverless/observability-add-logs-service-name.md \ No newline at end of file +* **[Ingest pipelines](../../../manage-data/ingest/transform-enrich/ingest-pipelines.md):** convert data to ECS, normalize field data, or enrich incoming data. +* **[Logstash](https://www.elastic.co/guide/en/logstash/current):** enrich your data using input, output, and filter plugins. \ No newline at end of file diff --git a/solutions/observability/logs/apm-agent-log-sending.md b/solutions/observability/logs/apm-agent-log-sending.md index cdf1af4862..21c0e80910 100644 --- a/solutions/observability/logs/apm-agent-log-sending.md +++ b/solutions/observability/logs/apm-agent-log-sending.md @@ -2,6 +2,9 @@ mapped_urls: - https://www.elastic.co/guide/en/observability/current/logs-send-application.html - https://www.elastic.co/guide/en/serverless/current/observability-send-application-logs.html +applies_to: + stack: all + serverless: all --- # APM agent log sending [observability-send-application-logs] diff --git a/solutions/observability/logs/categorize-log-entries.md b/solutions/observability/logs/categorize-log-entries.md index 343cd2539f..1c706421a8 100644 --- a/solutions/observability/logs/categorize-log-entries.md +++ b/solutions/observability/logs/categorize-log-entries.md @@ -1,6 +1,8 @@ --- mapped_pages: - https://www.elastic.co/guide/en/observability/current/categorize-logs.html +applies_to: + stack: all --- # Categorize log entries [categorize-logs] diff --git a/solutions/observability/logs/configure-data-sources.md b/solutions/observability/logs/configure-data-sources.md index f56f6c20ce..35ddaf8863 100644 --- a/solutions/observability/logs/configure-data-sources.md +++ b/solutions/observability/logs/configure-data-sources.md @@ -1,11 +1,16 @@ --- mapped_pages: - https://www.elastic.co/guide/en/observability/current/configure-data-sources.html +applies_to: + stack: all --- # Configure data sources [configure-data-sources] -::::{admonition} There’s a new, better way to explore your logs! +::::{Note} + +**There’s a new, better way to explore your logs!** + These settings only apply to the Logs Stream app. The Logs Stream app and dashboard panel are deactivated by default. We recommend viewing and inspecting your logs with [Logs Explorer](logs-explorer.md) as it provides more features, better performance, and more intuitive navigation. To activate the Logs Stream app, refer to [Activate Logs Stream](logs-stream.md#activate-logs-stream). diff --git a/solutions/observability/logs/ecs-formatted-application-logs.md b/solutions/observability/logs/ecs-formatted-application-logs.md index 1c641fc046..294736f7b7 100644 --- a/solutions/observability/logs/ecs-formatted-application-logs.md +++ b/solutions/observability/logs/ecs-formatted-application-logs.md @@ -2,6 +2,9 @@ mapped_urls: - https://www.elastic.co/guide/en/observability/current/logs-ecs-application.html - https://www.elastic.co/guide/en/serverless/current/observability-ecs-application-logs.html +applies_to: + stack: all + serverless: all --- # ECS formatted application logs [logs-ecs-application] @@ -73,20 +76,20 @@ Install {{filebeat}} on the server you want to monitor by running the commands t ::::::{tab-item} DEB ```sh -curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-9.0.0-beta1-darwin-x86_64.tar.gz -tar xzvf filebeat-9.0.0-beta1-darwin-x86_64.tar.gz +curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-{{version}}-darwin-x86_64.tar.gz +tar xzvf filebeat-{{version}}-darwin-x86_64.tar.gz ``` :::::: ::::::{tab-item} RPM ```sh -curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-9.0.0-beta1-linux-x86_64.tar.gz -tar xzvf filebeat-9.0.0-beta1-linux-x86_64.tar.gz +curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-{{version}}-linux-x86_64.tar.gz +tar xzvf filebeat-{{version}}-linux-x86_64.tar.gz ``` :::::: ::::::{tab-item} macOS -1. Download the {{filebeat}} Windows zip file: https\://artifacts.elastic.co/downloads/beats/filebeat/filebeat-9.0.0-beta1-windows-x86_64.zip[https\://artifacts.elastic.co/downloads/beats/filebeat/filebeat-9.0.0-beta1-windows-x86_64.zip] +1. Download the {{filebeat}} Windows zip file: `https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-{{version}}-windows-x86_64.zip` 2. Extract the contents of the zip file into `C:\Program Files`. 3. Rename the `filebeat-{{version}}-windows-x86_64` directory to `{{filebeat}}`. 4. Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select **Run As Administrator**). @@ -103,15 +106,15 @@ If script execution is disabled on your system, you need to set the execution po ::::::{tab-item} Linux ```sh -curl -L -O https\://artifacts.elastic.co/downloads/beats/filebeat/filebeat-9.0.0-beta1-amd64.deb -sudo dpkg -i filebeat-9.0.0-beta1-amd64.deb +curl -L -O https\://artifacts.elastic.co/downloads/beats/filebeat/filebeat-{{version}}-amd64.deb +sudo dpkg -i filebeat-{{version}}-amd64.deb ``` :::::: ::::::{tab-item} Windows ```sh -curl -L -O https\://artifacts.elastic.co/downloads/beats/filebeat/filebeat-9.0.0-beta1-x86_64.rpm -sudo rpm -vi filebeat-9.0.0-beta1-x86_64.rpm +curl -L -O https\://artifacts.elastic.co/downloads/beats/filebeat/filebeat-{{version}}-x86_64.rpm +sudo rpm -vi filebeat-{{version}}-x86_64.rpm ``` :::::: diff --git a/solutions/observability/logs/explore-logs.md b/solutions/observability/logs/explore-logs.md index 0cc069b6b0..1bd1833852 100644 --- a/solutions/observability/logs/explore-logs.md +++ b/solutions/observability/logs/explore-logs.md @@ -11,7 +11,7 @@ Logs Explorer allows you to quickly search and filter your log data, get informa Logs Explorer also provides {{ml}} to detect specific [log anomalies](inspect-log-anomalies.md) automatically and [categorize log messages](categorize-log-entries.md) to quickly identify patterns in your log events. -To view Logs Explorer, find `Logs Explorer` in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md)) +To view Logs Explorer, find **Logs Explorer** in the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md)) diff --git a/solutions/observability/logs/filter-aggregate-logs.md b/solutions/observability/logs/filter-aggregate-logs.md index 86b3eb4fd4..efd72947ac 100644 --- a/solutions/observability/logs/filter-aggregate-logs.md +++ b/solutions/observability/logs/filter-aggregate-logs.md @@ -2,6 +2,9 @@ mapped_urls: - https://www.elastic.co/guide/en/observability/current/logs-filter-and-aggregate.html - https://www.elastic.co/guide/en/serverless/current/observability-filter-and-aggregate-logs.html +applies_to: + stack: all + serverless: all --- # Filter and aggregate logs [observability-filter-and-aggregate-logs] @@ -16,8 +19,7 @@ This guide shows you how to: ## Before you get started [logs-filter-and-aggregate-prereq] -::::{admonition} Required role -:class: note +::::{note} **For Observability serverless projects**, the **Admin** role or higher is required to create ingest pipelines and set the index template. To learn more, refer to [Assign user roles and privileges](../../../deploy-manage/users-roles/cloud-organization/user-roles.md#general-assign-user-roles). diff --git a/solutions/observability/logs/get-started-with-system-logs.md b/solutions/observability/logs/get-started-with-system-logs.md index 8257f39436..4589fa30ec 100644 --- a/solutions/observability/logs/get-started-with-system-logs.md +++ b/solutions/observability/logs/get-started-with-system-logs.md @@ -1,14 +1,16 @@ --- mapped_pages: - https://www.elastic.co/guide/en/serverless/current/observability-get-started-with-logs.html +applies_to: + stack: all + serverless: all --- # Get started with system logs [observability-get-started-with-logs] -::::{admonition} Required role -:class: note +::::{note} -The **Admin** role or higher is required to onboard log data. To learn more, refer to [Assign user roles and privileges](../../../deploy-manage/users-roles/cloud-organization/manage-users.md#general-assign-user-roles). +**For Observability Serverless projects**, the **Admin** role or higher is required to onboard log data. To learn more, refer to [Assign user roles and privileges](../../../deploy-manage/users-roles/cloud-organization/manage-users.md#general-assign-user-roles). :::: @@ -17,8 +19,8 @@ In this guide you’ll learn how to onboard system log data from a machine or se To onboard system log data: -1. [Create a new {{obs-serverless}} project](../get-started/create-an-observability-project.md), or open an existing one. -2. In your {{obs-serverless}} project, go to **Add data**. +1. Open an [{{obs-serverless}} project](../get-started/create-an-observability-project.md) or Elastic Stack deployment. +2. From the Observability UI, go to **Add data**. 3. Under **What do you want to monitor?**, select **Host** → **Elastic Agent: Logs & Metrics**. 4. Follow the in-product steps to auto-detect your logs and install and configure the {{agent}}. diff --git a/solutions/observability/logs/inspect-log-anomalies.md b/solutions/observability/logs/inspect-log-anomalies.md index ff6eccf8c5..d04ca76b49 100644 --- a/solutions/observability/logs/inspect-log-anomalies.md +++ b/solutions/observability/logs/inspect-log-anomalies.md @@ -1,6 +1,8 @@ --- mapped_pages: - https://www.elastic.co/guide/en/observability/current/inspect-log-anomalies.html +applies_to: + stack: all --- # Inspect log anomalies [inspect-log-anomalies] diff --git a/solutions/observability/logs/logs-explorer.md b/solutions/observability/logs/logs-explorer.md index c0b4a74068..196a8c3550 100644 --- a/solutions/observability/logs/logs-explorer.md +++ b/solutions/observability/logs/logs-explorer.md @@ -2,6 +2,9 @@ mapped_urls: - https://www.elastic.co/guide/en/observability/current/explore-logs.html - https://www.elastic.co/guide/en/serverless/current/observability-discover-and-explore-logs.html +applies_to: + stack: all + serverless: all --- # Logs Explorer [explore-logs] diff --git a/solutions/observability/logs/logs-index-template-reference.md b/solutions/observability/logs/logs-index-template-reference.md index c61bd555f9..607964cb12 100644 --- a/solutions/observability/logs/logs-index-template-reference.md +++ b/solutions/observability/logs/logs-index-template-reference.md @@ -1,6 +1,9 @@ --- mapped_pages: - https://www.elastic.co/guide/en/observability/current/logs-index-template.html +applies_to: + stack: all + serverless: all --- # Logs index template reference [logs-index-template] diff --git a/solutions/observability/logs/logs-stream.md b/solutions/observability/logs/logs-stream.md index 8e88982b41..79ab250bab 100644 --- a/solutions/observability/logs/logs-stream.md +++ b/solutions/observability/logs/logs-stream.md @@ -5,7 +5,9 @@ mapped_pages: # Logs Stream [tail-logs] -::::{admonition} There’s a new, better way to explore your logs! +::::{note} +**There’s a new, better way to explore your logs!** + The Logs Stream app and dashboard panel are deactivated by default. We recommend viewing and inspecting your logs with [Logs Explorer](logs-explorer.md) as it provides more features, better performance, and more intuitive navigation. To activate the Logs Stream app, refer to [Activate Logs Stream](#activate-logs-stream). diff --git a/solutions/observability/logs/parse-route-logs.md b/solutions/observability/logs/parse-route-logs.md index 9aa248b8e3..d3e3236784 100644 --- a/solutions/observability/logs/parse-route-logs.md +++ b/solutions/observability/logs/parse-route-logs.md @@ -2,12 +2,14 @@ mapped_urls: - https://www.elastic.co/guide/en/observability/current/logs-parse.html - https://www.elastic.co/guide/en/serverless/current/observability-parse-log-data.html +applies_to: + stack: all + serverless: all --- # Parse and route logs [observability-parse-log-data] -::::{admonition} Required role -:class: note +::::{note} **For Observability serverless projects**, the **Admin** role or higher is required to create ingest pipelines that parse and route logs. To learn more, refer to [Assign user roles and privileges](../../../deploy-manage/users-roles/cloud-organization/user-roles.md#general-assign-user-roles). diff --git a/solutions/observability/logs/plaintext-application-logs.md b/solutions/observability/logs/plaintext-application-logs.md index 1a1e1321ea..0770e1fd66 100644 --- a/solutions/observability/logs/plaintext-application-logs.md +++ b/solutions/observability/logs/plaintext-application-logs.md @@ -2,6 +2,9 @@ mapped_urls: - https://www.elastic.co/guide/en/observability/current/logs-plaintext.html - https://www.elastic.co/guide/en/serverless/current/observability-plaintext-application-logs.html +applies_to: + stack: all + serverless: all --- # Plaintext application logs [logs-plaintext] @@ -41,27 +44,27 @@ Install {{filebeat}} on the server you want to monitor by running the commands t ::::::{tab-item} DEB ```sh -curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-9.0.0-beta1-darwin-x86_64.tar.gz -tar xzvf filebeat-9.0.0-beta1-darwin-x86_64.tar.gz +curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-{{version}}-darwin-x86_64.tar.gz +tar xzvf filebeat-{{version}}-darwin-x86_64.tar.gz ``` :::::: ::::::{tab-item} RPM ```sh -curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-9.0.0-beta1-linux-x86_64.tar.gz -tar xzvf filebeat-9.0.0-beta1-linux-x86_64.tar.gz +curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-{{version}}-linux-x86_64.tar.gz +tar xzvf filebeat-{{version}}-linux-x86_64.tar.gz ``` :::::: ::::::{tab-item} macOS -1. Download the {{filebeat}} Windows zip file: https\://artifacts.elastic.co/downloads/beats/filebeat/filebeat-9.0.0-beta1-windows-x86_64.zip[https\://artifacts.elastic.co/downloads/beats/filebeat/filebeat-9.0.0-beta1-windows-x86_64.zip] +1. Download the {{filebeat}} Windows zip file: `https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-{{version}}-windows-x86_64.zip` 2. Extract the contents of the zip file into `C:\Program Files`. 3. Rename the `filebeat-{{version}}-windows-x86_64` directory to `{{filebeat}}`. 4. Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select **Run As Administrator**). 5. From the PowerShell prompt, run the following commands to install {{filebeat}} as a Windows service: ```powershell - PS > cd 'C:\Program Files\{filebeat}' + PS > cd 'C:\Program Files\{{filebeat}}' PS C:\Program Files\{filebeat}> .\install-service-filebeat.ps1 ``` @@ -71,15 +74,15 @@ If script execution is disabled on your system, you need to set the execution po ::::::{tab-item} Linux ```sh -curl -L -O https\://artifacts.elastic.co/downloads/beats/filebeat/filebeat-9.0.0-beta1-amd64.deb -sudo dpkg -i filebeat-9.0.0-beta1-amd64.deb +curl -L -O https\://artifacts.elastic.co/downloads/beats/filebeat/filebeat-{{version}}-amd64.deb +sudo dpkg -i filebeat-{{version}}-amd64.deb ``` :::::: ::::::{tab-item} Windows ```sh -curl -L -O https\://artifacts.elastic.co/downloads/beats/filebeat/filebeat-9.0.0-beta1-x86_64.rpm -sudo rpm -vi filebeat-9.0.0-beta1-x86_64.rpm +curl -L -O https\://artifacts.elastic.co/downloads/beats/filebeat/filebeat-{{version}}-x86_64.rpm +sudo rpm -vi filebeat-{{version}}-x86_64.rpm ``` :::::: diff --git a/solutions/observability/logs/run-pattern-analysis-on-log-data.md b/solutions/observability/logs/run-pattern-analysis-on-log-data.md index b375b1f3a7..e9ec125c35 100644 --- a/solutions/observability/logs/run-pattern-analysis-on-log-data.md +++ b/solutions/observability/logs/run-pattern-analysis-on-log-data.md @@ -1,6 +1,8 @@ --- mapped_pages: - https://www.elastic.co/guide/en/serverless/current/observability-run-log-pattern-analysis.html +applies_to: + stack: all --- # Run a pattern analysis on log data [observability-run-log-pattern-analysis] diff --git a/solutions/observability/logs/stream-any-log-file.md b/solutions/observability/logs/stream-any-log-file.md index 0e59890c02..5d25fa1622 100644 --- a/solutions/observability/logs/stream-any-log-file.md +++ b/solutions/observability/logs/stream-any-log-file.md @@ -2,6 +2,9 @@ mapped_urls: - https://www.elastic.co/guide/en/observability/current/logs-stream.html - https://www.elastic.co/guide/en/serverless/current/observability-stream-log-files.html +applies_to: + stack: all + serverless: all --- # Stream any log file [logs-stream] @@ -60,23 +63,67 @@ On your host, download and extract the installation package that corresponds wit :::::::{tab-set} ::::::{tab-item} macOS -Version 9.0.0-beta1 of {{agent}} has not yet been released. + +```shell + +curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-{{version}}-darwin-x86_64.tar.gz +tar xzvf elastic-agent-{{version}}-darwin-x86_64.tar.gz + +``` :::::: ::::::{tab-item} Linux -Version 9.0.0-beta1 of {{agent}} has not yet been released. + +```shell + +curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-{{version}}-linux-x86_64.tar.gz +tar xzvf elastic-agent-{{version}}-linux-x86_64.tar.gz + +``` + :::::: ::::::{tab-item} Windows -Version 9.0.0-beta1 of {{agent}} has not yet been released. + +```powershell + +# PowerShell 5.0+ +wget https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-{{version}}-windows-x86_64.zip -OutFile elastic-agent-{{version}}-windows-x86_64.zip +Expand-Archive .\elastic-agent-{version}-windows-x86_64.zip + +``` + + :::::: ::::::{tab-item} DEB -Version 9.0.0-beta1 of {{agent}} has not yet been released. + +:::tip +To simplify upgrading to future versions of Elastic Agent, we recommended that you use the tarball distribution instead of the RPM distribution. +You can install Elastic Agent in an unprivileged mode that does not require root privileges. +::: + +```shell + +curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-{{version}}-amd64.deb +sudo dpkg -i elastic-agent-{{version}}-amd64.deb + +``` :::::: ::::::{tab-item} RPM -Version 9.0.0-beta1 of {{agent}} has not yet been released. + +:::tip +To simplify upgrading to future versions of Elastic Agent, we recommended that you use the tarball distribution instead of the RPM distribution. +You can install Elastic Agent in an unprivileged mode that does not require root privileges. +::: + +```shell + +curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-{{version}}-x86_64.rpm +sudo rpm -vi elastic-agent-{{version}}-x86_64.rpm + +``` :::::: ::::::: @@ -86,7 +133,7 @@ Version 9.0.0-beta1 of {{agent}} has not yet been released. After downloading and extracting the installation package, you’re ready to install the {{agent}}. From the agent directory, run the install command that corresponds with your system: ::::{note} -On macOS, Linux (tar package), and Windows, run the `install` command to install and start {{agent}} as a managed service and start the service. The DEB and RPM packages include a service unit for Linux systems with systemd, For these systems, you must enable and start the service. +On macOS, Linux (tar package), and Windows, run the `install` command to install and start {{agent}} as a managed service and start the service. The DEB and RPM packages include a service unit for Linux systems with systemd. For these systems, you must enable and start the service. :::: diff --git a/solutions/observability/logs/stream-application-logs.md b/solutions/observability/logs/stream-application-logs.md index 0a5e3c7a15..d8fa39055c 100644 --- a/solutions/observability/logs/stream-application-logs.md +++ b/solutions/observability/logs/stream-application-logs.md @@ -2,6 +2,9 @@ mapped_urls: - https://www.elastic.co/guide/en/observability/current/application-logs.html - https://www.elastic.co/guide/en/serverless/current/observability-correlate-application-logs.html +applies_to: + stack: all + serverless: all --- # Stream application logs [observability-correlate-application-logs]