Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 0 additions & 5 deletions auditbeat/docs/modules.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,4 @@ This section contains detailed information about the metric collecting modules
contained in {beatname_uc}. More details about each module can be found under
the links below.

//pass macro block used here to remove Edit links from modules documentation because it is generated
pass::[<?edit_url?>]
include::modules_list.asciidoc[]



54 changes: 27 additions & 27 deletions filebeat/docs/autodiscover-hints.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -40,29 +40,29 @@ Instead of using raw `docker` input, specifies the module to use to parse logs f
When module is configured, map container logs to module filesets. You can either configure
a single fileset like this:

["source","yaml",subs="attributes"]
-------------------------------------------------------------------------------------
[source,yaml]
-----
co.elastic.logs/fileset: access
-------------------------------------------------------------------------------------
-----

Or configure a fileset per stream in the container (stdout and stderr):

["source","yaml",subs="attributes"]
-------------------------------------------------------------------------------------
[source,yaml]
-----
co.elastic.logs/fileset.stdout: access
co.elastic.logs/fileset.stderr: error
-------------------------------------------------------------------------------------
-----

[float]
===== `co.elastic.logs/raw`
When an entire input/module configuration needs to be completely set the `raw` hint can be used. You can provide a
stringified JSON of the input configuration. `raw` overrides every other hint and can be used to create bot a single or
a list of configurations.

["source","yaml",subs="attributes"]
-------------------------------------------------------------------------------------
[source,yaml]
-----
co.elastic.logs/raw: "[{\"containers\":{\"ids\":[\"${data.container.id}\"]},\"multiline\":{\"negate\":\"true\",\"pattern\":\"^test\"},\"type\":\"docker\"}]"
-------------------------------------------------------------------------------------
-----

[float]
===== `co.elastic.logs/processors`
Expand All @@ -73,11 +73,11 @@ of supported processors.
In order to provide ordering of the processor definition, numbers can be provided. If not, the hints builder will do
arbitrary ordering:

["source","yaml"]
-------------------------------------------------------------------------------------
[source,yaml]
-----
co.elastic.logs/processors.1.dissect.tokenizer: "%{key1} %{key2}"
co.elastic.logs/processors.dissect.tokenizer: "%{key2} %{key1}"
-------------------------------------------------------------------------------------
-----

In the above sample the processor definition tagged with `1` would be executed first.

Expand All @@ -86,23 +86,23 @@ In the above sample the processor definition tagged with `1` would be executed f

Kubernetes autodiscover provider supports hints in Pod annotations. To enable it just set `hints.enabled`:

["source","yaml",subs="attributes"]
-------------------------------------------------------------------------------------
[source,yaml]
-----
filebeat.autodiscover:
providers:
- type: kubernetes
hints.enabled: true
-------------------------------------------------------------------------------------
-----

You can annotate Kubernetes Pods with useful info to spin up {beatname_uc} inputs or modules:

["source","yaml",subs="attributes"]
-------------------------------------------------------------------------------------
[source,yaml]
-----
annotations:
co.elastic.logs/multiline.pattern: '^\['
co.elastic.logs/multiline.negate: true
co.elastic.logs/multiline.match: after
-------------------------------------------------------------------------------------
-----


[float]
Expand All @@ -113,14 +113,14 @@ hint. For example, these hints configure multiline settings for all containers i
specific `exclude_lines` hint for the container called `sidecar`.


["source","yaml",subs="attributes"]
-------------------------------------------------------------------------------------
[source,yaml]
-----
annotations:
co.elastic.logs/multiline.pattern: '^\['
co.elastic.logs/multiline.negate: true
co.elastic.logs/multiline.match: after
co.elastic.logs.sidecar/exclude_lines: '^DBG'
-------------------------------------------------------------------------------------
-----



Expand All @@ -129,22 +129,22 @@ annotations:

Docker autodiscover provider supports hints in labels. To enable it just set `hints.enabled`:

["source","yaml",subs="attributes"]
-------------------------------------------------------------------------------------
[source,yaml]
-----
filebeat.autodiscover:
providers:
- type: docker
hints.enabled: true
-------------------------------------------------------------------------------------
-----

You can label Docker containers with useful info to spin up {beatname_uc} inputs, for example:

["source","yaml",subs="attributes"]
-------------------------------------------------------------------------------------
[source,yaml]
-----
co.elastic.logs/module: nginx
co.elastic.logs/fileset.stdout: access
co.elastic.logs/fileset.stderr: error
-------------------------------------------------------------------------------------
-----

The above labels configure {beatname_uc} to use the Nginx module to harvest logs for this container.
Access logs will be retrieved from stdout stream, and error logs from stderr.
2 changes: 1 addition & 1 deletion filebeat/docs/filebeat-general-options.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ filebeat.registry_file_permissions: 0600
[float]
==== `config_dir`

deprecated[6.0.0, Use <<load-input-config>> instead.]
deprecated:[6.0.0, Use <<load-input-config>> instead.]

The full path to the directory that contains additional input configuration files.
Each configuration file must end with `.yml`. Each config file must also specify the full Filebeat
Expand Down
2 changes: 1 addition & 1 deletion filebeat/docs/inputs/input-redis.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ Example configuration:
{beatname_lc}.inputs:
- type: redis
hosts: ["localhost:6379"]
password: "$\{redis_pwd\}"
password: "${redis_pwd}"
----


Expand Down
2 changes: 0 additions & 2 deletions filebeat/docs/modules.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,4 @@ modules.

Filebeat modules require Elasticsearch 5.2 or later.

//pass macro block used here to remove Edit links from modules documentation because it is generated
pass::[<?edit_url?>]
include::modules_list.asciidoc[]
2 changes: 2 additions & 0 deletions filebeat/docs/modules/osquery.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,8 @@ To specify the same settings at the command line, you use:
-M "osquery.result.var.paths=[/path/to/osqueryd.results.log*]"
-----

//set the fileset name used in the included example
:fileset_ex: result
include::../include/config-option-intro.asciidoc[]

[float]
Expand Down
2 changes: 2 additions & 0 deletions filebeat/module/osquery/_meta/docs.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,8 @@ To specify the same settings at the command line, you use:
-M "osquery.result.var.paths=[/path/to/osqueryd.results.log*]"
-----

//set the fileset name used in the included example
:fileset_ex: result
include::../include/config-option-intro.asciidoc[]

[float]
Expand Down
4 changes: 2 additions & 2 deletions heartbeat/docs/heartbeat-options.asciidoc
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[[configuration-heartbeat-options]]
== Set up monitors
== Set up {beatname_uc} monitors

++++
<titleabbrev>Set up Heartbeat monitors</titleabbrev>
<titleabbrev>Set up monitors</titleabbrev>
++++

The `heartbeat.monitors` section of the +heartbeat.yml+ config file specifies
Expand Down
Loading