# Filebeat Configuration

Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to [Elasticsearch](https://www.elastic.co/elasticsearch) or [Logstash](https://www.elastic.co/logstash) for indexing.

For more information on Filebeat, see Elastic documentation starting with [Filebeat Overview](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html).

## Helm Installation

1. Get the IP for the Kloudfuse endpoint using the `kubectl` command.

|     |     |
   | --- | --- |
   |  | If the Kloudfuse stack installs with a DNS or VPC endpoint, use that address instead of the IP address. |
   
   
   Pick the ingress-external IP.

```console
   kubectl get services | grep -i "ingress".
   ```
   
   Copied!

2. Create a `custom_values.yaml` file. Alternatively, update an existing yaml file used to install filebeat, if modifying an existing filebeat installation.

Add the `filebeatConfig` section.

|     |     |
   | --- | --- |
   |  | - Copy over existing `filebeatConfig`, such as [elastic/helm-charts](https://github.com/elastic/helm-charts/blob/2fd64d0af65f14df7aa01da591919460dabac4b3/filebeat/values.yaml#L38), because this step overwrites the `filebeat.yml` file.<br>     <br>   - Use http (port 80) or https (port 443), depending on whether Kloudfuse has https enabled. |
   
   
   ```yaml
   daemonset: # Use deployment, instead of daemonset, if filebeat is configured to run in deployment-mode.
        filebeatConfig:
          filebeat.yml: |
            ...
            setup.ilm.enabled: false
            setup.template.enabled: false
            output.elasticsearch:
            hosts: ["http://<ingress-ip or DNS>:443/ingester/api/v1/filebeat"] # use http (port 80) or https (port 443), depending on whether Kloudfuse has https enabled.
   ```
   
   yamlCopied!

3. Add the helm repository.

```console
   helm repo add elastic https://helm.elastic.co
   ```
   
   Copied!

4. Install the filebeat agent using `custom-values.yaml` file.

```console
   helm upgrade --install filebeat elastic/filebeat -f custom_values.yaml
   ```
   
   Copied!