| |
Filebeat Notes |
Russell Bateman
December 2018
last update:
Filebeat is a component, in the ELK stack, that sends files, usually logfiles, from the local host (Logstash can just as easily collect them from the local host), or from remote hosts running on those other hosts targeting Logstash's hostname and port.
Filebeat is configured, as to what plug-ins and their settings, via a file, usually named filebeat.yml.
In filebeat.yml (and, likely, other Elastic configuration files), you can use system enviroment variables thus:
${VARIABLE}
Replacement (value injection) occurs at start-up. Replacement is case-sensitive and occurs prior to any YAML parsing. Undefined variables are replaced by empty strings or default values:
${VARIABLE:default_value}
If the system environment changed and you wanted to pick up the new value, Filebeat would have to be bounced.