# Filebeat Configuration

Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to [Elasticsearch](https://www.elastic.co/elasticsearch) or [Logstash](https://www.elastic.co/logstash) for indexing.

For more information on Filebeat, see Elastic documentation starting with [Filebeat Overview](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html).

## Helm Installation

1. Get the IP for the Kloudfuse endpoint using the `kubectl` command.

|     |     |
| --- | --- |
|  | If the Kloudfuse stack installs with a DNS or VPC endpoint, use that address instead of the IP address. |

Pick the ingress-external IP.

```console
kubectl get services | grep -i "ingress".
```

Copied!

2. Create a `custom_values.yaml` file. Alternatively, update an existing yaml file used to install filebeat, if modifying an existing filebeat installation.

Add the `filebeatConfig` section.

|     |     |
| --- | --- |
|  | - Copy over existing `filebeatConfig`, such as [elastic/helm-charts](https://github.com/elastic/helm-charts/blob/2fd64d0af65f14df7aa01da591919460dabac4b3/filebeat/values.yaml#L38), because this step overwrites the `filebeat.yml` file.<br>     <br>   - Use http (port 80) or https (port 443), depending on whether Kloudfuse has https enabled. |

```yaml
daemonset: # Use deployment, instead of daemonset, if filebeat is configured to run in deployment-mode.
     filebeatConfig:
       filebeat.yml: |
         ...
         setup.ilm.enabled: false
         setup.template.enabled: false
         output.elasticsearch:
         hosts: ["http://<ingress-ip or DNS>:443/ingester/api/v1/filebeat"] # use http (port 80) or https (port 443), depending on whether Kloudfuse has https enabled.
```

yamlCopied!

3. Add the helm repository.

```console
helm repo add elastic https://helm.elastic.co
```

Copied!

4. Install the filebeat agent using `custom-values.yaml` file.

```console
helm upgrade --install filebeat elastic/filebeat -f custom_values.yaml
```

Copied!