diff --git a/filebeat/docs/getting-started.asciidoc b/filebeat/docs/getting-started.asciidoc index 3691b73bc761..2387c64a0e61 100644 --- a/filebeat/docs/getting-started.asciidoc +++ b/filebeat/docs/getting-started.asciidoc @@ -145,7 +145,7 @@ TIP: To test your configuration file, run Filebeat in the foreground with the fo See <> for more details about each configuration option. [[config-filebeat-logstash]] -=== Step 3 (Optional): Configuring Filebeat to Use Logstash +=== Step 3: Configuring Filebeat to Use Logstash include::../../libbeat/docs/shared-logstash-config.asciidoc[] diff --git a/libbeat/docs/shared-logstash-config.asciidoc b/libbeat/docs/shared-logstash-config.asciidoc index c8d9b71512cd..2ca8ca1ad20c 100644 --- a/libbeat/docs/shared-logstash-config.asciidoc +++ b/libbeat/docs/shared-logstash-config.asciidoc @@ -23,8 +23,11 @@ output.logstash: hosts: ["127.0.0.1:5044"] ------------------------------------------------------------------------------ -In this configuration, `hosts` specifies the Logstash server and the port (`5044`) -where Logstash is configured to listen for incoming Beats connections. +The `hosts` option specifies the Logstash server and the port (`5044`) where Logstash is configured to listen for incoming +Beats connections. + +For this configuration, you must <> +because the options for auto loading the template are only available for the Elasticsearch output. TIP: To test your configuration file, run {beatname_uc} in the foreground with the following options specified: +./{beatname_lc} -configtest -e+. diff --git a/libbeat/docs/shared-template-load.asciidoc b/libbeat/docs/shared-template-load.asciidoc index 615a5e47261e..25faaeaafbd5 100644 --- a/libbeat/docs/shared-template-load.asciidoc +++ b/libbeat/docs/shared-template-load.asciidoc @@ -16,7 +16,7 @@ ////////////////////////////////////////////////////////////////////////// -In Elasticsearch, http://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html[index +In Elasticsearch, {elasticsearch}/indices-templates.html[index templates] are used to define settings and mappings that determine how fields should be analyzed. The recommended index template file for {beatname_uc} is installed by the {beatname_uc} packages. If you accept @@ -29,14 +29,14 @@ you can change the settings for template loading in the {beatname_uc} configurat choose to disable automatic template loading, you need to load the template manually. For more information, see: -* <> -* <> +* <> - supported for Elasticsearch output only +* <> - required for Logstash output [[load-template-auto]] ==== Configuring Template Loading By default, {beatname_uc} automatically loads the recommended template file, +{beatname_lc}.template.json+, -if elasticsearch output is enabled. You can configure {beatname_lc} to load a different template +if Elasticsearch output is enabled. You can configure {beatname_lc} to load a different template by adjusting the `template.name` and `template.path` options in +{beatname_lc}.yml+ file: ["source","yaml",subs="attributes,callouts"] @@ -51,7 +51,10 @@ output.elasticsearch: By default, if a template already exists in the index, it is not overwritten. To overwrite an existing template, set `template.overwrite: true` in the configuration file. -To disable automatic template loading, comment out the template part under elasticsearch output. +To disable automatic template loading, comment out the template part under the Elasticsearch output. + +The options for auto loading the template are not supported if you are using the +Logstash output. [[load-template-manually]] ==== Loading the Template Manually