Overview

Use the Logstash source to send logs to Observability Pipelines with Filebeat.

Setup

1. Set up Filebeat if you haven’t already.

2. In the filebeat.yml file:
   a. Comment out the Elasticsearch Output configuration section.
   b. Uncomment and configure the Logstash Output section:

   # ------------------------------ Logstash Output -------------------------------
   output.logstash:
   # The Logstash hosts
   hosts: ["<OPW_HOST>:9997"]
   

   <OPW_HOST> is the host IP address or the load balancer URL associated with the Observability Pipelines Worker.

   For CloudFormation installs, use the LoadBalancerDNS CloudFormation output for the URL.

   For Kubernetes installs, you can use the internal DNS record of the Observability Pipelines Worker service. For example: opw-observability-pipelines-worker.default.svc.cluster.local.

3. Set up a pipeline with the Logstash source.