Filebeat on OpenBSD 6.2

I recently installed a new of OpenBSD 6.2 server. As part of that install, I needed to install Filebeat to forward logs to an ELK server (Elasticsearch, Logstash and Kibana).

The process to install and configure are much simpler then previous OpenBSD versions (as covered here) because Go 1.7 is now a simple binary package install.

The following steps assumes you have installed OpenBSD 6.2 and will cover dependent package and Filebeat installation, and configuration of Filebeat.

The most current version of OpenBSD is 6.3
I have not tested these steps on OpenBSD 6.3, but I would expect them to work without too much modification.

Install Go, git and gmake

First, configure pkg_add to use the closest binary packages mirror. Select the closest / fastest mirror here:

https://www.openbsd.org/ftp.html

Next edit /etc/installurl to set the mirror:

Then install Go, git and gmake:

Install Filebeat

Set up the Go build environment and get the Filebeat source:

List the branches and switch to the appropriate branch, in this example release v6.2.1:

Build Filebeat:

Install Filebeat and set permissions:

Copy Filebeat config files:

Copy TLS Cert

If you are using TLS (https) to secure the connection, copy the cert from the ELK server to the OpenBSD server running Filebeat:

On the OpenBSD server running Filebeat:

Configure Filebeat

Filebeat can be configured to log to Elasticsearch or Logstash, in this example we are logging to Logstash.

Below is an example filebeat.yml, please note that this will need to be customized to include what you want to forward. Sections that are not changed are omitted with [...]:

Test config file:

For details on further configuration please see:

https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration.html

https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html

For details on setting up TLS/SSL please see:

https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ssl-logstash.html

Debugging Filebeat

If you having issues with the configuration, enable debugging by adding the following to the end of filebeat.yml:

This will log too:

Filebeat rc File

Create the filebeat rc file to automatically start at boot:

Set permissions:

Add a reference to the rc file to rc.conf.local so that it starts up on boot:

Reference for the rc file:

http://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/ports/sysutils/beats/filebeat/pkg/filebeat.rc?rev=1.1.1.1&content-type=text/plain

Manage Filebeat

Use rc script to manage:

Conclusion

Thats it, hope that you have found this useful, having the Go version in the ports makes this trivial compared to previous versions of OpenBSD.

Leave a Reply

You must be logged in to post a comment.