{"id":3536,"date":"2023-02-22T11:18:39","date_gmt":"2023-02-22T04:18:39","guid":{"rendered":"https:\/\/ton.packetlove.com\/blog\/?p=3536"},"modified":"2023-02-22T12:02:30","modified_gmt":"2023-02-22T05:02:30","slug":"filebeat-lightweight-shipper-for-logs-from-k8s-to-elasticsearch","status":"publish","type":"post","link":"https:\/\/ton.packetlove.com\/blog\/devops\/filebeat-lightweight-shipper-for-logs-from-k8s-to-elasticsearch.html","title":{"rendered":"Filebeat Lightweight shipper for logs from k8s to Elasticsearch"},"content":{"rendered":"<p><figure id=\"attachment_3548\" aria-describedby=\"caption-attachment-3548\" style=\"width: 1028px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/ton.packetlove.com\/blog\/wp-content\/uploads\/2023\/02\/beat.png\" alt=\"\" width=\"1028\" height=\"681\" class=\"size-full wp-image-3548\" \/><figcaption id=\"caption-attachment-3548\" class=\"wp-caption-text\">Beat<\/figcaption><\/figure><br \/>\n\u0e2a\u0e27\u0e31\u0e2a\u0e14\u0e35\u0e04\u0e23\u0e31\u0e1a <strong>DevOps 101<\/strong> \u0e02\u0e2d\u0e07\u0e40\u0e23\u0e32 \u0e27\u0e31\u0e19\u0e19\u0e35\u0e49 \u0e08\u0e30\u0e21\u0e32\u0e1e\u0e39\u0e14\u0e16\u0e36\u0e07 <strong>Filebeat<\/strong> \u0e19\u0e30\u0e04\u0e23\u0e31\u0e1a ..<\/p>\n<p><strong>Filebeat<\/strong> \u0e04\u0e37\u0e2d\u0e2d\u0e30\u0e44\u0e23?<br \/>\n<strong>Filebeat = Lightweight shipper for logs<\/strong><br \/>\n&#8220;Whether you\u2019re collecting from security devices, cloud, containers, hosts, or OT, Filebeat helps you keep the simple things simple by offering a lightweight way to forward and centralize logs and files.&#8221;<\/p>\n<p>\u0e16\u0e49\u0e32\u0e40\u0e2d\u0e32\u0e41\u0e1a\u0e1a\u0e40\u0e02\u0e49\u0e32\u0e43\u0e08\u0e07\u0e48\u0e32\u0e22\u0e46 \u0e01\u0e47\u0e04\u0e37\u0e2d <strong>\u0e15\u0e31\u0e27\u0e01\u0e27\u0e32\u0e14 logs<\/strong> \u0e08\u0e32\u0e01\u0e17\u0e35\u0e48\u0e15\u0e48\u0e32\u0e07\u0e46 \u0e40\u0e02\u0e49\u0e32\u0e21\u0e32\u0e17\u0e35\u0e48 <strong>centralize logs<\/strong> \u0e43\u0e19\u0e17\u0e35\u0e48\u0e19\u0e35\u0e49 \u0e1c\u0e21\u0e08\u0e30\u0e1e\u0e39\u0e14\u0e16\u0e36\u0e07 <strong>k8s cluster (EKS) logs<\/strong> \u0e44\u0e1b\u0e40\u0e01\u0e47\u0e1a\u0e17\u0e35\u0e48 <strong>Elasticsearch<\/strong> \u0e25\u0e30\u0e01\u0e31\u0e19\u0e19\u0e30\u0e04\u0e23\u0e31\u0e1a ..<\/p>\n<p>\u0e08\u0e23\u0e34\u0e07\u0e46 \u0e22\u0e31\u0e07\u0e21\u0e35 \u0e15\u0e31\u0e27\u0e2d\u0e37\u0e48\u0e19\u0e46 \u0e2d\u0e35\u0e01 \u0e19\u0e30\u0e04\u0e23\u0e31\u0e1a \u0e17\u0e35\u0e48\u0e17\u0e33\u0e07\u0e32\u0e19\u0e04\u0e25\u0e49\u0e32\u0e22\u0e46 <strong>Filebeat<\/strong> \u0e40\u0e0a\u0e48\u0e19 <strong>Fluentd<\/strong>, <strong>Fluentbit<\/strong><\/p>\n<p>\u0e43\u0e19\u0e40\u0e21\u0e37\u0e48\u0e2d\u0e40\u0e23\u0e32\u0e43\u0e0a\u0e49 <strong>ELK Stack<\/strong> \u0e43\u0e19 <strong>Ecosystem<\/strong> \u0e02\u0e2d\u0e07\u0e40\u0e23\u0e32\u0e41\u0e25\u0e49\u0e27 \u0e01\u0e32\u0e23\u0e17\u0e35\u0e48\u0e40\u0e23\u0e32\u0e2d\u0e22\u0e32\u0e01 <strong>search logs<\/strong> \u0e15\u0e48\u0e32\u0e07\u0e46 \u0e17\u0e35\u0e48\u0e40\u0e01\u0e34\u0e14\u0e08\u0e32\u0e01 <strong>container<\/strong> \u0e02\u0e2d\u0e07\u0e40\u0e23\u0e32 \u0e44\u0e14\u0e49\u0e07\u0e48\u0e32\u0e22\u0e2a\u0e38\u0e14 \u0e01\u0e47\u0e04\u0e37\u0e2d\u0e01\u0e32\u0e23 <strong>ship logs \u0e08\u0e32\u0e01 k8s cluster<\/strong> \u0e02\u0e2d\u0e07\u0e40\u0e23\u0e32 \u0e44\u0e1b\u0e40\u0e01\u0e47\u0e1a\u0e44\u0e27\u0e49\u0e1a\u0e19 <strong>Elasticsearch<\/strong> \u0e41\u0e25\u0e49\u0e27\u0e17\u0e33\u0e01\u0e32\u0e23 search \u0e1c\u0e48\u0e32\u0e19 <strong>Kibana<\/strong> ..<\/p>\n<h1>\u0e27\u0e34\u0e18\u0e35\u0e01\u0e32\u0e23 Install Filebeat \u0e43\u0e19 k8s cluster<\/h1>\n<p>\u0e17\u0e33\u0e44\u0e14\u0e49\u0e2b\u0e25\u0e32\u0e22\u0e27\u0e34\u0e18\u0e35\u0e04\u0e23\u0e31\u0e1a \u0e43\u0e19\u0e17\u0e35\u0e48\u0e19\u0e35\u0e49 \u0e1c\u0e21\u0e08\u0e30\u0e43\u0e0a\u0e49\u0e27\u0e34\u0e18\u0e35\u0e07\u0e48\u0e32\u0e22\u0e46 \u0e1c\u0e48\u0e32\u0e19 <strong>kubectl<\/strong> \u0e14\u0e31\u0e07\u0e15\u0e48\u0e2d\u0e44\u0e1b\u0e19\u0e35\u0e49<\/p>\n<h2>1. Create Secret \u0e42\u0e14\u0e22\u0e43\u0e2a\u0e48\u0e04\u0e48\u0e32\u0e17\u0e35\u0e48\u0e08\u0e33\u0e40\u0e1b\u0e47\u0e19 \u0e1e\u0e27\u0e01\u0e19\u0e35\u0e49\u0e25\u0e07\u0e44\u0e1b<\/h2>\n<p>&#8211; <strong>ELASTICSEARCH_HOST<\/strong> = <strong>Endpoint<\/strong> \u0e02\u0e2d\u0e07 Elasticsearch \u0e40\u0e23\u0e32<br \/>\n&#8211; <strong>ELASTICSEARCH_PORT<\/strong> = <strong>Port<\/strong> \u0e17\u0e35\u0e48 Elasticsearch \u0e40\u0e23\u0e32\u0e17\u0e33\u0e07\u0e32\u0e19\u0e2d\u0e22\u0e39\u0e48<br \/>\n&#8211; <strong>ELASTICSEARCH_USERNAME<\/strong> = <strong>Username<\/strong> \u0e02\u0e2d\u0e07 Elasticsearch<br \/>\n&#8211; <strong>ELASTICSEARCH_PASSWORD<\/strong> = <strong>Password<\/strong> \u0e02\u0e2d\u0e07 Elasticsearch<br \/>\n&#8211; <strong>ELASTIC_CLOUD_ID<\/strong> = <strong>Cloud ID<\/strong> \u0e43\u0e19\u0e01\u0e23\u0e13\u0e35\u0e17\u0e35\u0e48\u0e40\u0e23\u0e32\u0e43\u0e0a\u0e49\u0e1c\u0e48\u0e32\u0e19 Cloud Service \u0e02\u0e2d\u0e07 Elastic.co<br \/>\n&#8211; <strong>ELASTIC_CLOUD_AUTH<\/strong> = <strong>Username:Password<\/strong> \u0e02\u0e2d\u0e07 Elasticsearch<\/p>\n<p><strong>filebeat-secret.yaml<\/strong><\/p>\n<div class=\"hcb_wrap\">\n<pre class=\"prism line-numbers lang-yaml\" data-lang=\"YAML\"><code>apiVersion: v1\r\nkind: Secret\r\nmetadata:\r\n  name: filebeat\r\n  namespace: kube-system\r\ntype: Opaque\r\ndata:\r\n  ELASTICSEARCH_HOST: aHR0cDovL2xvY2FsaG9zdA==\r\n  ELASTICSEARCH_PASSWORD: \r\n  ELASTICSEARCH_PORT: OTIwMA==\r\n  ELASTICSEARCH_USERNAME: \r\n  ELASTIC_CLOUD_AUTH: \r\n  ELASTIC_CLOUD_ID: \r\n<\/code><\/pre>\n<p>\u0e08\u0e32\u0e01\u0e19\u0e31\u0e49\u0e19 \u0e2a\u0e31\u0e48\u0e07 create secret<\/p>\n<div class=\"hcb_wrap\">\n<pre class=\"prism line-numbers lang-bash\" data-lang=\"Bash\"><code>kubectl create -f filebeat-secret.yaml<\/code><\/pre>\n<\/div>\n<\/div>\n<h2>2. Create Deployment \u0e41\u0e25\u0e30 Resource \u0e2d\u0e37\u0e48\u0e19\u0e46 <\/h2>\n<p><strong>filebeat-kubernetes.yaml<\/strong><\/p>\n<div class=\"hcb_wrap\">\n<pre class=\"prism line-numbers lang-yaml\" data-lang=\"YAML\"><code>---\r\napiVersion: v1\r\nkind: ConfigMap\r\nmetadata:\r\n  name: filebeat-config\r\n  namespace: kube-system\r\n  labels:\r\n    k8s-app: filebeat\r\ndata:\r\n  filebeat.yml: |-\r\n    # To enable hints based autodiscover, remove `filebeat.inputs` configuration and uncomment this:\r\n    filebeat.autodiscover:\r\n      providers:\r\n       - type: kubernetes\r\n         node: ${NODE_NAME}\r\n         hints.enabled: true\r\n         hints.default_config:\r\n           type: container\r\n           paths:\r\n             - \/var\/log\/containers\/*${data.kubernetes.container.id}.log\r\n\r\n    # Filter by container.name\r\n    # filebeat.autodiscover:\r\n    #   providers:\r\n    #     - type: kubernetes\r\n    #       node: ${NODE_NAME}\r\n    #       templates:\r\n    #         - condition:\r\n    #             contains:\r\n    #               kubernetes.container.name: \"container01\"\r\n    #           config:\r\n    #             - type: container\r\n    #               paths:\r\n    #                 - \"\/var\/log\/containers\/*-${data.kubernetes.container.id}.log\"\r\n    #         - condition:\r\n    #             contains:\r\n    #               kubernetes.container.name: \"container02\"\r\n    #           config:\r\n    #             - type: container\r\n    #               paths:\r\n    #                 - \"\/var\/log\/containers\/*-${data.kubernetes.container.id}.log\"\r\n\r\n    processors:\r\n      - add_cloud_metadata:\r\n      - add_host_metadata:\r\n\r\n    cloud.id: ${ELASTIC_CLOUD_ID}\r\n    cloud.auth: ${ELASTIC_CLOUD_AUTH}\r\n\r\n    output.elasticsearch:\r\n      hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']\r\n      #index: \"%{[fields.my_type]}-%{[agent.version]}-%{+yyyy.MM.dd}\" \r\n      username: ${ELASTICSEARCH_USERNAME}\r\n      password: ${ELASTICSEARCH_PASSWORD}\r\n---\r\napiVersion: apps\/v1\r\nkind: DaemonSet\r\nmetadata:\r\n  name: filebeat\r\n  namespace: kube-system\r\n  labels:\r\n    k8s-app: filebeat\r\nspec:\r\n  selector:\r\n    matchLabels:\r\n      k8s-app: filebeat\r\n  template:\r\n    metadata:\r\n      labels:\r\n        k8s-app: filebeat\r\n    spec:\r\n      serviceAccountName: filebeat\r\n      terminationGracePeriodSeconds: 30\r\n      hostNetwork: true\r\n      dnsPolicy: ClusterFirstWithHostNet\r\n      containers:\r\n        - name: filebeat\r\n          image: docker.elastic.co\/beats\/filebeat:8.6.2\r\n          args: [\"-c\", \"\/etc\/filebeat.yml\", \"-e\"]\r\n          env:\r\n            - name: ELASTICSEARCH_HOST\r\n              valueFrom:\r\n                secretKeyRef:\r\n                  name: filebeat\r\n                  key: ELASTICSEARCH_HOST\r\n            - name: ELASTICSEARCH_PORT\r\n              valueFrom:\r\n                secretKeyRef:\r\n                  name: filebeat\r\n                  key: ELASTICSEARCH_PORT\r\n            - name: ELASTICSEARCH_USERNAME\r\n              valueFrom:\r\n                secretKeyRef:\r\n                  name: filebeat\r\n                  key: ELASTICSEARCH_USERNAME\r\n            - name: ELASTICSEARCH_PASSWORD\r\n              valueFrom:\r\n                secretKeyRef:\r\n                  name: filebeat\r\n                  key: ELASTICSEARCH_PASSWORD\r\n            - name: ELASTIC_CLOUD_ID\r\n              valueFrom:\r\n                secretKeyRef:\r\n                  name: filebeat\r\n                  key: ELASTIC_CLOUD_ID\r\n            - name: ELASTIC_CLOUD_AUTH\r\n              valueFrom:\r\n                secretKeyRef:\r\n                  name: filebeat\r\n                  key: ELASTIC_CLOUD_AUTH\r\n            - name: NODE_NAME\r\n              valueFrom:\r\n                fieldRef:\r\n                  fieldPath: spec.nodeName\r\n          securityContext:\r\n            runAsUser: 0\r\n            # If using Red Hat OpenShift uncomment this:\r\n            #privileged: true\r\n          resources:\r\n            limits:\r\n              memory: 200Mi\r\n            requests:\r\n              cpu: 100m\r\n              memory: 100Mi\r\n          volumeMounts:\r\n            - name: config\r\n              mountPath: \/etc\/filebeat.yml\r\n              readOnly: true\r\n              subPath: filebeat.yml\r\n            - name: data\r\n              mountPath: \/usr\/share\/filebeat\/data\r\n            - name: varlibdockercontainers\r\n              mountPath: \/var\/lib\/docker\/containers\r\n              readOnly: true\r\n            - name: varlog\r\n              mountPath: \/var\/log\r\n              readOnly: true\r\n      volumes:\r\n        - name: config\r\n          configMap:\r\n            defaultMode: 0640\r\n            name: filebeat-config\r\n        - name: varlibdockercontainers\r\n          hostPath:\r\n            path: \/var\/lib\/docker\/containers\r\n        - name: varlog\r\n          hostPath:\r\n            path: \/var\/log\r\n        # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart\r\n        - name: data\r\n          hostPath:\r\n            # When filebeat runs as non-root user, this directory needs to be writable by group (g+w).\r\n            path: \/var\/lib\/filebeat-data\r\n            type: DirectoryOrCreate\r\n---\r\napiVersion: rbac.authorization.k8s.io\/v1\r\nkind: ClusterRoleBinding\r\nmetadata:\r\n  name: filebeat\r\nsubjects:\r\n  - kind: ServiceAccount\r\n    name: filebeat\r\n    namespace: kube-system\r\nroleRef:\r\n  kind: ClusterRole\r\n  name: filebeat\r\n  apiGroup: rbac.authorization.k8s.io\r\n---\r\napiVersion: rbac.authorization.k8s.io\/v1\r\nkind: RoleBinding\r\nmetadata:\r\n  name: filebeat\r\n  namespace: kube-system\r\nsubjects:\r\n  - kind: ServiceAccount\r\n    name: filebeat\r\n    namespace: kube-system\r\nroleRef:\r\n  kind: Role\r\n  name: filebeat\r\n  apiGroup: rbac.authorization.k8s.io\r\n---\r\napiVersion: rbac.authorization.k8s.io\/v1\r\nkind: RoleBinding\r\nmetadata:\r\n  name: filebeat-kubeadm-config\r\n  namespace: kube-system\r\nsubjects:\r\n  - kind: ServiceAccount\r\n    name: filebeat\r\n    namespace: kube-system\r\nroleRef:\r\n  kind: Role\r\n  name: filebeat-kubeadm-config\r\n  apiGroup: rbac.authorization.k8s.io\r\n---\r\napiVersion: rbac.authorization.k8s.io\/v1\r\nkind: ClusterRole\r\nmetadata:\r\n  name: filebeat\r\n  labels:\r\n    k8s-app: filebeat\r\nrules:\r\n  - apiGroups: [\"\"] # \"\" indicates the core API group\r\n    resources:\r\n      - namespaces\r\n      - pods\r\n      - nodes\r\n    verbs:\r\n      - get\r\n      - watch\r\n      - list\r\n  - apiGroups: [\"apps\"]\r\n    resources:\r\n      - replicasets\r\n    verbs: [\"get\", \"list\", \"watch\"]\r\n  - apiGroups: [\"batch\"]\r\n    resources:\r\n      - jobs\r\n    verbs: [\"get\", \"list\", \"watch\"]\r\n---\r\napiVersion: rbac.authorization.k8s.io\/v1\r\nkind: Role\r\nmetadata:\r\n  name: filebeat\r\n  # should be the namespace where filebeat is running\r\n  namespace: kube-system\r\n  labels:\r\n    k8s-app: filebeat\r\nrules:\r\n  - apiGroups:\r\n      - coordination.k8s.io\r\n    resources:\r\n      - leases\r\n    verbs: [\"get\", \"create\", \"update\"]\r\n---\r\napiVersion: rbac.authorization.k8s.io\/v1\r\nkind: Role\r\nmetadata:\r\n  name: filebeat-kubeadm-config\r\n  namespace: kube-system\r\n  labels:\r\n    k8s-app: filebeat\r\nrules:\r\n  - apiGroups: [\"\"]\r\n    resources:\r\n      - configmaps\r\n    resourceNames:\r\n      - kubeadm-config\r\n    verbs: [\"get\"]\r\n---\r\napiVersion: v1\r\nkind: ServiceAccount\r\nmetadata:\r\n  name: filebeat\r\n  namespace: kube-system\r\n  labels:\r\n    k8s-app: filebeat\r\n---\r\n\u00a0<\/code><\/pre>\n<\/div>\n<p>\u0e08\u0e32\u0e01\u0e19\u0e31\u0e49\u0e19 \u0e2a\u0e31\u0e48\u0e07 create deployment<\/p>\n<div class=\"hcb_wrap\">\n<pre class=\"prism line-numbers lang-bash\" data-lang=\"Bash\"><code>kubectl create -f filebeat-kubernetes.yaml<\/code><\/pre>\n<\/div>\n<h2>3. Search k8s cluster logs \u0e1c\u0e48\u0e32\u0e19 Kibana <\/h2>\n<p>\u0e16\u0e49\u0e32 config \u0e17\u0e38\u0e01\u0e2d\u0e22\u0e48\u0e32\u0e07\u0e40\u0e23\u0e32\u0e16\u0e39\u0e01\u0e15\u0e49\u0e2d\u0e07 container \u0e17\u0e33\u0e07\u0e32\u0e19\u0e44\u0e14\u0e49 \u0e40\u0e23\u0e32\u0e01\u0e47\u0e08\u0e30\u0e44\u0e14\u0e49 logs \u0e02\u0e2d\u0e07 k8s cluster \u0e40\u0e23\u0e32 \u0e44\u0e1b\u0e40\u0e01\u0e47\u0e1a\u0e1a\u0e19 Elasticsearch \u0e41\u0e25\u0e30\u0e17\u0e33\u0e01\u0e32\u0e23 search \u0e1c\u0e48\u0e32\u0e19 Kibana \u0e44\u0e14\u0e49\u0e40\u0e25\u0e22<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/ton.packetlove.com\/blog\/wp-content\/uploads\/2023\/02\/animated-gif-logs-ui-optimized.gif\" alt=\"Kibana Search\" width=\"1000\" height=\"562\" class=\"alignnone size-full wp-image-3546\" \/><\/p>\n<h2>* \u0e40\u0e23\u0e32\u0e2a\u0e32\u0e21\u0e32\u0e23\u0e16 filter input \u0e02\u0e2d\u0e07 Logs \u0e17\u0e35\u0e48\u0e08\u0e30 ship \u0e44\u0e1b\u0e40\u0e01\u0e47\u0e1a \u0e17\u0e35\u0e48 Elasticsearch \u0e44\u0e14\u0e49<\/h2>\n<p>\u0e15\u0e31\u0e27\u0e2d\u0e22\u0e48\u0e32\u0e07\u0e2d\u0e22\u0e39\u0e48\u0e43\u0e19 <strong>filebeat-kubernetes.yaml<\/strong> \u0e17\u0e35\u0e48 comment \u0e44\u0e27\u0e49<\/p>\n<p>\u0e40\u0e1b\u0e47\u0e19\u0e2d\u0e22\u0e48\u0e32\u0e07\u0e44\u0e23\u0e01\u0e31\u0e19\u0e1a\u0e49\u0e32\u0e07\u0e04\u0e23\u0e31\u0e1a \u0e44\u0e21\u0e48\u0e22\u0e32\u0e01\u0e40\u0e25\u0e22\u0e43\u0e0a\u0e48\u0e44\u0e2b\u0e21\u0e04\u0e23\u0e31\u0e1a \u0e2a\u0e33\u0e2b\u0e23\u0e31\u0e1a\u0e01\u0e32\u0e23 <strong>ship logs \u0e08\u0e32\u0e01 k8s cluster<\/strong> \u0e02\u0e2d\u0e07\u0e40\u0e23\u0e32 \u0e44\u0e1b\u0e40\u0e01\u0e47\u0e1a\u0e1a\u0e19 <strong>Elasticsearch<\/strong> \ud83d\ude42<\/p>\n<p><strong>Git Repo:<\/strong> <a href=\"https:\/\/github.com\/pornpasok\/k8s-logs-es-filebeat\">https:\/\/github.com\/pornpasok\/k8s-logs-es-filebeat<\/a><br \/>\n<strong>Ref:<\/strong> <a href=\"https:\/\/www.elastic.co\/beats\/filebeat\">https:\/\/www.elastic.co\/beats\/filebeat<\/a><\/p>\n<div class=\"fcbkbttn_buttons_block\" id=\"fcbkbttn_left\"><div class=\"fcbkbttn_like \"><fb:like href=\"https:\/\/ton.packetlove.com\/blog\/devops\/filebeat-lightweight-shipper-for-logs-from-k8s-to-elasticsearch.html\" action=\"like\" colorscheme=\"light\" layout=\"button_count\"  size=\"small\"><\/fb:like><\/div><div class=\"fb-share-button  \" data-href=\"https:\/\/ton.packetlove.com\/blog\/devops\/filebeat-lightweight-shipper-for-logs-from-k8s-to-elasticsearch.html\" data-type=\"button_count\" data-size=\"small\"><\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>\u0e2a\u0e27\u0e31\u0e2a\u0e14\u0e35\u0e04\u0e23\u0e31\u0e1a DevOps 101 \u0e02\u0e2d\u0e07\u0e40\u0e23\u0e32 \u0e27\u0e31\u0e19\u0e19\u0e35\u0e49 \u0e08\u0e30\u0e21\u0e32\u0e1e\u0e39\u0e14\u0e16\u0e36\u0e07 Filebeat \u0e19\u0e30\u0e04\u0e23\u0e31\u0e1a .. Filebeat \u0e04\u0e37\u0e2d\u0e2d\u0e30\u0e44\u0e23? Filebeat = Lightweight shipper for logs &#8220;Whether you\u2019re collecting from security devices, cloud, containers, hosts, or OT, Filebeat helps you keep the simple things simple by offering a lightweight way to forward and centralize logs and files.&#8221; \u0e16\u0e49\u0e32\u0e40\u0e2d\u0e32\u0e41\u0e1a\u0e1a\u0e40\u0e02\u0e49\u0e32\u0e43\u0e08\u0e07\u0e48\u0e32\u0e22\u0e46 \u0e01\u0e47\u0e04\u0e37\u0e2d \u0e15\u0e31\u0e27\u0e01\u0e27\u0e32\u0e14 logs \u0e08\u0e32\u0e01\u0e17\u0e35\u0e48\u0e15\u0e48\u0e32\u0e07\u0e46 \u0e40\u0e02\u0e49\u0e32\u0e21\u0e32\u0e17\u0e35\u0e48 centralize [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1080],"tags":[1102,1083,1103,1090,1101,1068,1104],"class_list":["post-3536","post","type-post","status-publish","format-standard","hentry","category-devops","tag-beat","tag-eks","tag-elasticsearch","tag-elk","tag-filebeat","tag-k8s","tag-logs"],"_links":{"self":[{"href":"https:\/\/ton.packetlove.com\/blog\/wp-json\/wp\/v2\/posts\/3536","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ton.packetlove.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ton.packetlove.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ton.packetlove.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ton.packetlove.com\/blog\/wp-json\/wp\/v2\/comments?post=3536"}],"version-history":[{"count":14,"href":"https:\/\/ton.packetlove.com\/blog\/wp-json\/wp\/v2\/posts\/3536\/revisions"}],"predecessor-version":[{"id":3552,"href":"https:\/\/ton.packetlove.com\/blog\/wp-json\/wp\/v2\/posts\/3536\/revisions\/3552"}],"wp:attachment":[{"href":"https:\/\/ton.packetlove.com\/blog\/wp-json\/wp\/v2\/media?parent=3536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ton.packetlove.com\/blog\/wp-json\/wp\/v2\/categories?post=3536"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ton.packetlove.com\/blog\/wp-json\/wp\/v2\/tags?post=3536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}