On Sun, Nov 10, 2019 at 11:45:58AM +0100, Landry Breuil wrote:
> Hi,
>
> struggling a bit with filebeat, i think the current rc script lacks
> -path.home ${PREFIX}/share/filebeat as it seems that's where it looks
> for modules.
>
> if i dont specify it, with the default config and the default daemon
> args:
>
> [11:41] c64:~/mystuff/sysutils/beats/ $doas filebeat -path.config
> /etc/filebeat -e
> ...
> 2019-11-10T11:41:59.383+0100 ERROR fileset/modules.go:125 Not loading
> modules. Module directory not found:
> /home/landry/mystuff/sysutils/beats/module
>
> if i specify it, seems much better.
>
> [11:42] c64:~/mystuff/sysutils/beats/ $doas filebeat -path.config
> /etc/filebeat -path.home /usr/local/share/filebeat -
> 2019-11-10T11:42:33.196+0100 INFO instance/beat.go:607 Home path:
> [/usr/local/share/filebeat] Config path: [/etc/filebeat] Data path:
> [/usr/local/share/filebeat/data] Logs path: [/usr/local/share/filebeat/logs]
>
> so i wonder if daemon_flags should be amended in
> sysutils/beats/filebeat/pkg/filebeat.rc ?
>
> according to
> https://www.elastic.co/guide/en/beats/filebeat/master/configuration-path.html
> maybe logs & data paths should be specified so that this thing works 'better'
> out of the box ? or i'm missing something ? does this have smth to do with the
> BEATS_MODULES var, which is true only for filebeat and not the other beats ?
here's a diff that fixes path.home, and while at it installs the default
provided sample dashboards. played a bit with them on a 6.6 kibana
install (not current, i know) and i had to use the
libbeat/scripts/unpack_dashboards.py script provided in beats source to
massage them, but once installed 'filebeat/metricbeat setup' managed to
push the dashboards to kibana and i finally got some shiny graphs from
my nginx/system logs.
Landry
? beats-dashboards.diff
? data
? filebeat-startup-dashboards.diff
Index: Makefile.inc
===================================================================
RCS file: /cvs/ports/sysutils/beats/Makefile.inc,v
retrieving revision 1.11
diff -u -r1.11 Makefile.inc
--- Makefile.inc 13 Jul 2019 10:59:27 -0000 1.11
+++ Makefile.inc 10 Nov 2019 18:06:43 -0000
@@ -43,5 +43,5 @@
${INSTALL_DATA_DIR} ${PREFIX}/share/${BEAT}/module/
cd ${WRKSRC}/module && \
find . -type f -name \*.yml -o -name \*.json -a \! -name
\*expected\.json | \
- grep -v _meta | pax -rw ${PREFIX}/share/${BEAT}/module/
+ egrep -v _meta.*yml | pax -rw ${PREFIX}/share/${BEAT}/module/
.endif
Index: filebeat/Makefile
===================================================================
RCS file: /cvs/ports/sysutils/beats/filebeat/Makefile,v
retrieving revision 1.35
diff -u -r1.35 Makefile
--- filebeat/Makefile 2 Nov 2019 17:07:05 -0000 1.35
+++ filebeat/Makefile 10 Nov 2019 18:06:43 -0000
@@ -4,6 +4,7 @@
BEAT = filebeat
VERSION = 7.4.2
+REVISION = 0
GH_ACCOUNT = elastic
GH_PROJECT = beats
Index: filebeat/pkg/PLIST
===================================================================
RCS file: /cvs/ports/sysutils/beats/filebeat/pkg/PLIST,v
retrieving revision 1.9
diff -u -r1.9 PLIST
--- filebeat/pkg/PLIST 24 Oct 2019 14:37:09 -0000 1.9
+++ filebeat/pkg/PLIST 10 Nov 2019 18:06:43 -0000
@@ -11,6 +11,11 @@
share/filebeat/
share/filebeat/module/
share/filebeat/module/apache/
+share/filebeat/module/apache/_meta/
+share/filebeat/module/apache/_meta/kibana/
+share/filebeat/module/apache/_meta/kibana/7/
+share/filebeat/module/apache/_meta/kibana/7/dashboard/
+share/filebeat/module/apache/_meta/kibana/7/dashboard/Filebeat-apache.json
share/filebeat/module/apache/access/
share/filebeat/module/apache/access/config/
share/filebeat/module/apache/access/config/access.yml
@@ -27,6 +32,11 @@
share/filebeat/module/apache2/
share/filebeat/module/apache2/module.yml
share/filebeat/module/auditd/
+share/filebeat/module/auditd/_meta/
+share/filebeat/module/auditd/_meta/kibana/
+share/filebeat/module/auditd/_meta/kibana/7/
+share/filebeat/module/auditd/_meta/kibana/7/dashboard/
+share/filebeat/module/auditd/_meta/kibana/7/dashboard/Filebeat-auditd.json
share/filebeat/module/auditd/log/
share/filebeat/module/auditd/log/config/
share/filebeat/module/auditd/log/config/log.yml
@@ -75,6 +85,11 @@
share/filebeat/module/elasticsearch/slowlog/ingest/pipeline.json
share/filebeat/module/elasticsearch/slowlog/manifest.yml
share/filebeat/module/haproxy/
+share/filebeat/module/haproxy/_meta/
+share/filebeat/module/haproxy/_meta/kibana/
+share/filebeat/module/haproxy/_meta/kibana/7/
+share/filebeat/module/haproxy/_meta/kibana/7/dashboard/
+share/filebeat/module/haproxy/_meta/kibana/7/dashboard/Filebeat-haproxy-overview.json
share/filebeat/module/haproxy/log/
share/filebeat/module/haproxy/log/config/
share/filebeat/module/haproxy/log/config/file.yml
@@ -84,6 +99,13 @@
share/filebeat/module/haproxy/log/manifest.yml
share/filebeat/module/haproxy/module.yml
share/filebeat/module/icinga/
+share/filebeat/module/icinga/_meta/
+share/filebeat/module/icinga/_meta/kibana/
+share/filebeat/module/icinga/_meta/kibana/7/
+share/filebeat/module/icinga/_meta/kibana/7/dashboard/
+share/filebeat/module/icinga/_meta/kibana/7/dashboard/Filebeat-icinga-debug-log.json
+share/filebeat/module/icinga/_meta/kibana/7/dashboard/Filebeat-icinga-main-log.json
+share/filebeat/module/icinga/_meta/kibana/7/dashboard/Filebeat-icinga-startup-errors.json
share/filebeat/module/icinga/debug/
share/filebeat/module/icinga/debug/config/
share/filebeat/module/icinga/debug/config/debug.yml
@@ -104,6 +126,11 @@
share/filebeat/module/icinga/startup/ingest/pipeline.json
share/filebeat/module/icinga/startup/manifest.yml
share/filebeat/module/iis/
+share/filebeat/module/iis/_meta/
+share/filebeat/module/iis/_meta/kibana/
+share/filebeat/module/iis/_meta/kibana/7/
+share/filebeat/module/iis/_meta/kibana/7/dashboard/
+share/filebeat/module/iis/_meta/kibana/7/dashboard/Filebeat-iis.json
share/filebeat/module/iis/access/
share/filebeat/module/iis/access/config/
share/filebeat/module/iis/access/config/iis-access.yml
@@ -117,6 +144,11 @@
share/filebeat/module/iis/error/ingest/default.json
share/filebeat/module/iis/error/manifest.yml
share/filebeat/module/kafka/
+share/filebeat/module/kafka/_meta/
+share/filebeat/module/kafka/_meta/kibana/
+share/filebeat/module/kafka/_meta/kibana/7/
+share/filebeat/module/kafka/_meta/kibana/7/dashboard/
+share/filebeat/module/kafka/_meta/kibana/7/dashboard/Filebeat-Kafka-overview.json
share/filebeat/module/kafka/log/
share/filebeat/module/kafka/log/config/
share/filebeat/module/kafka/log/config/log.yml
@@ -133,6 +165,12 @@
share/filebeat/module/kibana/log/manifest.yml
share/filebeat/module/kibana/module.yml
share/filebeat/module/logstash/
+share/filebeat/module/logstash/_meta/
+share/filebeat/module/logstash/_meta/kibana/
+share/filebeat/module/logstash/_meta/kibana/7/
+share/filebeat/module/logstash/_meta/kibana/7/dashboard/
+share/filebeat/module/logstash/_meta/kibana/7/dashboard/Filebeat-logstash-log.json
+share/filebeat/module/logstash/_meta/kibana/7/dashboard/Filebeat-logstash-slowlog.json
share/filebeat/module/logstash/log/
share/filebeat/module/logstash/log/config/
share/filebeat/module/logstash/log/config/log.yml
@@ -149,6 +187,11 @@
share/filebeat/module/logstash/slowlog/ingest/pipeline-plain.json
share/filebeat/module/logstash/slowlog/manifest.yml
share/filebeat/module/mongodb/
+share/filebeat/module/mongodb/_meta/
+share/filebeat/module/mongodb/_meta/kibana/
+share/filebeat/module/mongodb/_meta/kibana/7/
+share/filebeat/module/mongodb/_meta/kibana/7/dashboard/
+share/filebeat/module/mongodb/_meta/kibana/7/dashboard/Filebeat-Mongodb-overview.json
share/filebeat/module/mongodb/log/
share/filebeat/module/mongodb/log/config/
share/filebeat/module/mongodb/log/config/log.yml
@@ -157,6 +200,11 @@
share/filebeat/module/mongodb/log/manifest.yml
share/filebeat/module/mongodb/module.yml
share/filebeat/module/mysql/
+share/filebeat/module/mysql/_meta/
+share/filebeat/module/mysql/_meta/kibana/
+share/filebeat/module/mysql/_meta/kibana/7/
+share/filebeat/module/mysql/_meta/kibana/7/dashboard/
+share/filebeat/module/mysql/_meta/kibana/7/dashboard/Filebeat-mysql.json
share/filebeat/module/mysql/error/
share/filebeat/module/mysql/error/config/
share/filebeat/module/mysql/error/config/error.yml
@@ -171,6 +219,11 @@
share/filebeat/module/mysql/slowlog/ingest/pipeline.json
share/filebeat/module/mysql/slowlog/manifest.yml
share/filebeat/module/nats/
+share/filebeat/module/nats/_meta/
+share/filebeat/module/nats/_meta/kibana/
+share/filebeat/module/nats/_meta/kibana/7/
+share/filebeat/module/nats/_meta/kibana/7/dashboard/
+share/filebeat/module/nats/_meta/kibana/7/dashboard/Filebeat-nats-overview.json
share/filebeat/module/nats/log/
share/filebeat/module/nats/log/config/
share/filebeat/module/nats/log/config/log.yml
@@ -179,6 +232,12 @@
share/filebeat/module/nats/log/manifest.yml
share/filebeat/module/nats/module.yml
share/filebeat/module/nginx/
+share/filebeat/module/nginx/_meta/
+share/filebeat/module/nginx/_meta/kibana/
+share/filebeat/module/nginx/_meta/kibana/7/
+share/filebeat/module/nginx/_meta/kibana/7/dashboard/
+share/filebeat/module/nginx/_meta/kibana/7/dashboard/Filebeat-nginx-logs.json
+share/filebeat/module/nginx/_meta/kibana/7/dashboard/Filebeat-nginx-overview.json
share/filebeat/module/nginx/access/
share/filebeat/module/nginx/access/config/
share/filebeat/module/nginx/access/config/nginx-access.yml
@@ -193,6 +252,12 @@
share/filebeat/module/nginx/error/manifest.yml
share/filebeat/module/nginx/module.yml
share/filebeat/module/osquery/
+share/filebeat/module/osquery/_meta/
+share/filebeat/module/osquery/_meta/kibana/
+share/filebeat/module/osquery/_meta/kibana/7/
+share/filebeat/module/osquery/_meta/kibana/7/dashboard/
+share/filebeat/module/osquery/_meta/kibana/7/dashboard/osquery-compliance.json
+share/filebeat/module/osquery/_meta/kibana/7/dashboard/osquery-rootkit.json
share/filebeat/module/osquery/module.yml
share/filebeat/module/osquery/result/
share/filebeat/module/osquery/result/config/
@@ -201,6 +266,12 @@
share/filebeat/module/osquery/result/ingest/pipeline.json
share/filebeat/module/osquery/result/manifest.yml
share/filebeat/module/postgresql/
+share/filebeat/module/postgresql/_meta/
+share/filebeat/module/postgresql/_meta/kibana/
+share/filebeat/module/postgresql/_meta/kibana/7/
+share/filebeat/module/postgresql/_meta/kibana/7/dashboard/
+share/filebeat/module/postgresql/_meta/kibana/7/dashboard/Filebeat-Postgresql-overview.json
+share/filebeat/module/postgresql/_meta/kibana/7/dashboard/Filebeat-Postgresql-slowlogs.json
share/filebeat/module/postgresql/log/
share/filebeat/module/postgresql/log/config/
share/filebeat/module/postgresql/log/config/log.yml
@@ -209,6 +280,11 @@
share/filebeat/module/postgresql/log/manifest.yml
share/filebeat/module/postgresql/module.yml
share/filebeat/module/redis/
+share/filebeat/module/redis/_meta/
+share/filebeat/module/redis/_meta/kibana/
+share/filebeat/module/redis/_meta/kibana/7/
+share/filebeat/module/redis/_meta/kibana/7/dashboard/
+share/filebeat/module/redis/_meta/kibana/7/dashboard/Filebeat-redis.json
share/filebeat/module/redis/log/
share/filebeat/module/redis/log/config/
share/filebeat/module/redis/log/config/log.yml
@@ -223,6 +299,11 @@
share/filebeat/module/redis/slowlog/ingest/pipeline.json
share/filebeat/module/redis/slowlog/manifest.yml
share/filebeat/module/santa/
+share/filebeat/module/santa/_meta/
+share/filebeat/module/santa/_meta/kibana/
+share/filebeat/module/santa/_meta/kibana/7/
+share/filebeat/module/santa/_meta/kibana/7/dashboard/
+share/filebeat/module/santa/_meta/kibana/7/dashboard/filebeat-santa-log-overview.json
share/filebeat/module/santa/log/
share/filebeat/module/santa/log/config/
share/filebeat/module/santa/log/config/file.yml
@@ -231,6 +312,14 @@
share/filebeat/module/santa/log/manifest.yml
share/filebeat/module/santa/module.yml
share/filebeat/module/system/
+share/filebeat/module/system/_meta/
+share/filebeat/module/system/_meta/kibana/
+share/filebeat/module/system/_meta/kibana/7/
+share/filebeat/module/system/_meta/kibana/7/dashboard/
+share/filebeat/module/system/_meta/kibana/7/dashboard/Filebeat-auth-sudo-commands.json
+share/filebeat/module/system/_meta/kibana/7/dashboard/Filebeat-new-users-and-groups.json
+share/filebeat/module/system/_meta/kibana/7/dashboard/Filebeat-ssh-login-attempts.json
+share/filebeat/module/system/_meta/kibana/7/dashboard/Filebeat-syslog.json
share/filebeat/module/system/auth/
share/filebeat/module/system/auth/config/
share/filebeat/module/system/auth/config/auth.yml
@@ -245,6 +334,11 @@
share/filebeat/module/system/syslog/ingest/pipeline.json
share/filebeat/module/system/syslog/manifest.yml
share/filebeat/module/traefik/
+share/filebeat/module/traefik/_meta/
+share/filebeat/module/traefik/_meta/kibana/
+share/filebeat/module/traefik/_meta/kibana/7/
+share/filebeat/module/traefik/_meta/kibana/7/dashboard/
+share/filebeat/module/traefik/_meta/kibana/7/dashboard/Filebeat-traefik-overview.json
share/filebeat/module/traefik/access/
share/filebeat/module/traefik/access/config/
share/filebeat/module/traefik/access/config/traefik-access.yml
Index: filebeat/pkg/filebeat.rc
===================================================================
RCS file: /cvs/ports/sysutils/beats/filebeat/pkg/filebeat.rc,v
retrieving revision 1.5
diff -u -r1.5 filebeat.rc
--- filebeat/pkg/filebeat.rc 11 Jan 2018 19:27:09 -0000 1.5
+++ filebeat/pkg/filebeat.rc 10 Nov 2019 18:06:43 -0000
@@ -3,7 +3,7 @@
# $OpenBSD: filebeat.rc,v 1.5 2018/01/11 19:27:09 rpe Exp $
daemon="${PREFIX}/bin/filebeat"
-daemon_flags="-path.config ${SYSCONFDIR}/filebeat"
+daemon_flags="-path.config ${SYSCONFDIR}/filebeat -path.home
${PREFIX}/share/filebeat"
. /etc/rc.d/rc.subr
