Posts in Microsoft

Deploy Metricbeat on all your Linux, Windows, and Mac hosts, connect it to Elasticsearch and voila: you get system-level CPU usage, memory, file system, disk IO, and network IO statistics, as well as top-like statistics for every process running on your systems. Metricbeats is an open-source shipping agent used to collect and ship operating system and service metrics to one or more destinations, including Logstash.

Step 1 – Install Metricbeat

deb (Debian/Ubuntu/Mint)

sudo apt-get install apt-transport-https
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
echo 'deb https://artifacts.elastic.co/packages/oss-6.x/apt stable main' | sudo tee /etc/apt/sources.list.d/beats.list
sudo apt-get update && sudo apt-get install metricbeat

rpm (CentOS/RHEL/Fedora)

sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
echo "[elastic-6.x]
name=Elastic repository for 6.x packages
baseurl=https://artifacts.elastic.co/packages/oss-6.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md" | sudo tee /etc/yum.repos.d/elastic-beats.repo

sudo yum install metricbeat

macOS

curl -L -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-oss-6.7.1-darwin-x86_64.tar.gz 
tar xzvf metricbeat-oss-6.7.1-darwin-x86_64.tar.gz

Windows

• Download the Metricbeat Windows zip file from the official downloads page.
• Extract the contents of the zip file into C:\Program Files.
• Rename the metricbeat-<version>-windows directory to Metricbeat.
• Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select Run As Administrator). If you are running Windows XP, you may need to download and install PowerShell.
• Run the following commands to install Metricbeat as a Windows service:PS > cd 'C:\Program Files\Metricbeat' PS C:\Program Files\Metricbeat> .\install-service-metricbeat.ps1`   If script execution is disabled on your system, you need to set the execution policy for the current session to allow the script to run. For example: PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-metricbeat.ps1

My OS isn’t here! Don’t see your system? Check out the official downloads page for more options (including 32-bit versions).

Step 2 – Locate the configuration file

deb/rpm : /etc/metricbeat/metricbeat.yml
mac/win :<EXTRACTED_ARCHIVE>/metricbeat.yml

Step 3 – Configure the Modules

Setup the data you wish to send us, by editing the modules. Examples of these settings are found in, in the same folder as the configuration file. The system status module is enabled by default to collect metrics about your servers, such as CPU usage, memory usage, network IO metrics, and process statistics:

metricbeat.modules:
- module: system
  metricsets:
    - cpu
    - filesystem
    - memory
    - network
    - process
  enabled: true
  period: 10s
  processes: ['.*']
  cpu_ticks: false

  There’s also a large range of modules to collect metrics see here.

Step 4 – Configure output

We’ll be shipping to Logstash so that we have the option to run filters before the data is indexed.
Comment out the elasticsearch output block.

## Comment out elasticsearch output
#output.elasticsearch:
#  hosts: ["localhost:9200"]

Uncomment and change the logstash output to match below.

output.logstash:
    hosts: ["your-logstash-host:your-port"]
    loadbalance: true
    ssl.enabled: true

Step 5 – Validate configuration

Let’s check the configuration file is syntactically correct.

deb/rpm

sudo metricbeat -e -c /etc/metricbeat/metricbeat.yml

macOS

cd <EXTRACTED_ARCHIVE>
./metricbeat -e -c metricbeat.yml

Windows

cd <EXTRACTED_ARCHIVE>
metricbeat.exe -e -c metricbeat.yml

Step 6 – Start metricbeat

Ok, time to start ingesting data!

deb/rpm

sudo systemctl enable metricbeat
sudo systemctl start metricbeat

mac

./metricbeat

Windows

Start-Service metricbeat

With this, you have installed & configured MetricBeat for your environment. Stay tuned for others from the Beats family and also the ElasticSearch Stack Installation.