Let us learn more about the Nginx Filebeat Logstash with the support of our Nginx support services at Bobcares.

What is Nginx filebeat logstash?

Nginx, Filebeat, and Logstash are three distinct software tools to tandem to process, analyze, and store log data generated by Nginx web servers.

Nginx creates log files, which Filebeat gather and sent to Logstash. Logstash is in charge of processing and enhancing log data before storing it in a backend data store.

This enables simple analysis and visualization of Nginx log data, which may aid in the identification of performance issues, security concerns, and other critical information regarding web server operations.

How to Configure Filebeat to ship logs from a NGINX web server to Logstash?

Configure Filebeat to send NGINX web server logs to Logstash and Elasticsearch:

STEP 1 – INSTALL FILEBEAT

To begin, go through the following steps:

• Setup filebeat
• Root privileges
• Check that the needed port is open.

STEP 2 – Enable the Ngninx module

We may utilize numerous built-in filebeat modules. The nginx module must be enabled.

deb/rpm
sudo filebeat modules list
sudo filebeat modules enable nginx

macOS

cd
./filebeat modules list
./filebeat modules enable nginx

Windows

cd
.\filebeat.exe modules list
.\filebeat.exe modules enable nginx

This is turned off by default. It might be used to parse ingress-nginx logs in Kubernetes deployments.

ingress_controller:

  enabled: false
# Set custom paths for the log files. If left empty,
# Filebeat will choose the paths depending on your OS.
#var.paths:


step 3 – Update the configuration file

The configuration file below is pre-configured to use Logstash to deliver data to the Logit.io Stack. This is the next step to configure Filebeat to ship NGINX web server logs to Logstash and Elasticsearch seamlessly.

Overwrite the contents of filebeat.yml with the configuration file below:

# ============================== Filebeat modules ==============================
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
#reload.period: 10s

# ================================== Outputs ===================================
# —————————— Logstash Output ——————————-
output.logstash:
hosts: [“your-logstash-host:your-ssl-port”]
loadbalance: true
ssl.enabled: true

# ================================= Processors =================================
processors:
- add_host_metadata:
when.not.contains.tags: forwarded
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~

If we’re using Filebeat 7, we’ll need to add this code block at the end to enable Filebeat to forward NGINX web server logs to Logstash and Elasticsearch.

For Filebeat 7:

filebeat.registry.path: /var/lib/filebeat

Just consider that we are using the Filebeat 6 we have to add the code line given below to the end:

registry_file: /var/lib/filebeat/registry

No we have to move to the next step in the configuration process.

step 4 – Validate Configuration

If we have difficulties launching filebeat in the next step, we may use the following instructions to debug as the nest step to set up Filebeat for sending NGINX web server logs to Logstash and Elasticsearch.

Let’s run Filebeat straight from the terminal to ensure the configuration file is syntactically valid. If the file is invalid, filebeat will display an error loading config file error notice with instructions on how to resolve the issue.

deb/rpm
sudo filebeat -e -c /etc/filebeat/filebeat.yml

For macOS

cd
sudo ./filebeat -e -c filebeat.yml

For Windows

cd EXTRACTED_ARCHIVE
.\filebeat.exe -e -c filebeat.yml

Finally we have to reboot the File beat and this marks the completion of the process.

[Need assistance with similar queries? We are here to help]

Conclusion

To sum up we have now seen more on Nginx filebeat logstash with the support of our tech support team.