filebeat.yml

# https://github.com/elastic/beats/blob/master/filebeat/filebeat.reference.yml

filebeat.modules:
- module: system
  syslog:
    enabled: true
  auth:
    enabled: true
- module: auditd
  log:
    # - Does not look like Auditd is supported in Alpine linux: https://github.com/linuxkit/linuxkit/issues/52
    # - CentOS does not need us to install the audit system, it ships as standard. If you are using Ubuntu, though,
    # this is probably something you would want to install. (sudo apt-get install -y auditd audispd-plugins)
    enabled: true

#filebeat.inputs:
#- type: container
#  enabled: true
#  paths:
#    -/var/lib/docker/containers/*/*.log
#  stream: all # can be all, stdout or stderr

#========================== Filebeat autodiscover ==============================
# See this URL on how to run Apache2 Filebeat module: # https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html
filebeat.autodiscover:
  providers:
    - type: docker
      # https://www.elastic.co/guide/en/beats/filebeat/current/configuration-autodiscover-hints.html
      # This URL alos contains instructions on multi-line logs
      hints.enabled: true

#================================ Processors ===================================
processors:
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_locale:
    format: offset
- add_host_metadata:
    netinfo.enabled: true

#========================== Elasticsearch output ===============================
output.elasticsearch:
  hosts: ["${ELASTICSEARCH_HOST}:9200"]
  username: ${ELASTICSEARCH_USERNAME}
  password: ${ELASTICSEARCH_PASSWORD}

#============================== Dashboards =====================================
setup.dashboards:
  enabled: true

#============================== Kibana =========================================
setup.kibana:
  host: "${KIBANA_HOST}:80"
  username: ${ELASTICSEARCH_USERNAME}
  password: ${ELASTICSEARCH_PASSWORD}

#============================== Xpack Monitoring ===============================
xpack.monitoring:
  enabled: true
  elasticsearch: