diff --git a/docs/copied-from-beats/command-reference.asciidoc b/docs/copied-from-beats/command-reference.asciidoc index 57638a5302c..6a038bbfe60 100644 --- a/docs/copied-from-beats/command-reference.asciidoc +++ b/docs/copied-from-beats/command-reference.asciidoc @@ -36,7 +36,7 @@ ifdef::has_ml_jobs[] endif::[] ifdef::no_dashboards[] -:setup-command-short-desc: Sets up the initial environment, including the ES index template. +:setup-command-short-desc: Sets up the initial environment, including the ES index template endif::no_dashboards[] ifndef::has_ml_jobs,no_dashboards[] @@ -548,20 +548,6 @@ the end of the file is reached. By default harvesters are closed after `close_inactive` is reached. endif::[] -*`--setup`*:: -Loads the initial setup, including: - -* Elasticsearch template -ifdef::has_ml_jobs[] -* Machine learning jobs -endif::has_ml_jobs[] -ifndef::no_dashboards[] -* {kib} index pattern -* {kib} dashboards -endif::no_dashboards[] - -If you want to use the command without running {beatname_uc}, use the <> command instead. - ifeval::["{beatname_lc}"=="metricbeat"] *`--system.hostfs MOUNT_POINT`*:: @@ -582,14 +568,14 @@ endif::[] ["source","sh",subs="attributes"] ----- -{beatname_lc} run -e --setup +{beatname_lc} run -e ----- Or: ["source","sh",subs="attributes"] ----- -{beatname_lc} -e --setup +{beatname_lc} -e ----- [[setup-command]] @@ -609,8 +595,8 @@ ifdef::has_ml_jobs[] necessary to analyze data for anomalies. endif::[] -Use this command instead of `run --setup` when you want to set up the -environment without actually running {beatname_uc} and ingesting data. +Use this command if you want to set up the environment without actually running +{beatname_uc} and ingesting data. *SYNOPSIS* diff --git a/docs/copied-from-beats/loggingconfig.asciidoc b/docs/copied-from-beats/loggingconfig.asciidoc index e0e87f66296..62b0577763e 100644 --- a/docs/copied-from-beats/loggingconfig.asciidoc +++ b/docs/copied-from-beats/loggingconfig.asciidoc @@ -19,6 +19,7 @@ ifndef::serverless[] The logging system can write logs to the syslog or rotate log files. If logging is not explicitly configured the file output is used. +ifndef::win_only[] ["source","yaml",subs="attributes"] ---- logging.level: info @@ -29,6 +30,20 @@ logging.files: keepfiles: 7 permissions: 0644 ---- +endif::win_only[] + +ifdef::win_only[] +["source","yaml",subs="attributes"] +---- +logging.level: info +logging.to_files: true +logging.files: + path: C:{backslash}ProgramData{backslash}{beatname_lc}{backslash}Logs + name: {beatname_lc} + keepfiles: 7 + permissions: 0644 +---- +endif::win_only[] TIP: In addition to setting logging options in the config file, you can modify the logging output configuration from the command line. See diff --git a/docs/copied-from-beats/outputconfig.asciidoc b/docs/copied-from-beats/outputconfig.asciidoc index bfeff903112..c6254625434 100644 --- a/docs/copied-from-beats/outputconfig.asciidoc +++ b/docs/copied-from-beats/outputconfig.asciidoc @@ -817,7 +817,7 @@ NOTE: Events bigger than <> will be [[kafka-compatibility]] ==== Compatibility -This output works with all Kafka versions in between 0.11 and 2.0.0. Older versions +This output works with all Kafka versions in between 0.11 and 2.1.0. Older versions might work as well, but are not supported. ==== Configuration options diff --git a/docs/copied-from-beats/security/basic-auth.asciidoc b/docs/copied-from-beats/security/basic-auth.asciidoc index eaf3b21801e..986b277d630 100644 --- a/docs/copied-from-beats/security/basic-auth.asciidoc +++ b/docs/copied-from-beats/security/basic-auth.asciidoc @@ -29,7 +29,7 @@ You can create roles from the **Management / Roles** UI in {kib} or through the ifeval::["{beatname_lc}"!="filebeat"] ["source","sh",subs="attributes,callouts"] --------------------------------------------------------------- -POST _xpack/security/role/{beat_default_index_prefix}_writer +POST _security/role/{beat_default_index_prefix}_writer { "cluster": ["manage_index_templates","monitor"], "indices": [ @@ -40,13 +40,14 @@ POST _xpack/security/role/{beat_default_index_prefix}_writer ] } --------------------------------------------------------------- +// CONSOLE <1> If you use a custom {beatname_uc} index pattern, specify that pattern instead of the default ++{beat_default_index_prefix}-*++ pattern. endif::[] ifeval::["{beatname_lc}"=="filebeat"] ["source","sh",subs="attributes,callouts"] --------------------------------------------------------------- -POST _xpack/security/role/{beat_default_index_prefix}_writer +POST _security/role/{beat_default_index_prefix}_writer { "cluster": ["manage_index_templates","monitor","manage_ingest_pipelines"], <1> "indices": [ @@ -65,6 +66,34 @@ instead of the default ++{beat_default_index_prefix}-*++ pattern. endif::[] -- +ifndef::no_ilm[] +. If you plan to use {ref}/getting-started-index-lifecycle-management.html[index +lifecycle management], create a role that has the following privileges. These +privileges are required to load index lifecycle policies and create and manage +rollover indices: ++ +* *Cluster:* `manage_ilm` +* *Index:* `write`, `create_index`, `manage`, and `manage_ilm` on the +{beatname_uc} indices ++ +-- +["source","sh",subs="attributes"] +--------------------------------------------------------------- +POST _xpack/security/role/{beat_default_index_prefix}_ilm +{ + "cluster": ["manage_ilm"], + "indices": [ + { + "names": [ "{beat_default_index_prefix}-*","shrink-{beat_default_index_prefix}-*"], + "privileges": ["write","create_index","manage","manage_ilm"] + } + ] +} +--------------------------------------------------------------- +// CONSOLE +-- +endif::no_ilm[] + . Assign the writer role to the user that {beatname_uc} will use to connect to {es}. Make sure you also assign any roles that are required for specific features. For the list of features and required roles, see <>. @@ -81,7 +110,7 @@ named ++{beat_default_index_prefix}_internal++ that has the -- ["source","sh",subs="attributes,callouts"] --------------------------------------------------------------- -POST /_xpack/security/user/{beat_default_index_prefix}_internal +POST /_security/user/{beat_default_index_prefix}_internal { "password" : "{pwd}", "roles" : [ "{beat_default_index_prefix}_writer","kibana_user"], diff --git a/docs/copied-from-beats/security/securing-beats.asciidoc b/docs/copied-from-beats/security/securing-beats.asciidoc index 48dd7a87f41..3db1c1c80ba 100644 --- a/docs/copied-from-beats/security/securing-beats.asciidoc +++ b/docs/copied-from-beats/security/securing-beats.asciidoc @@ -44,40 +44,50 @@ password, set it up now. For more information about {security}, see {xpack-ref}/elasticsearch-security.html[Securing the {stack}]. -[float] [[feature-roles]] === {beatname_uc} features that require authorization After securing {beatname_uc}, make sure your users have the roles (or associated -privileges) required to use these {beatname_uc} features. You must create the -++{beat_default_index_prefix}_writer++ and -++{beat_default_index_prefix}_reader++ roles (see <> and -<>). The other roles are -{xpack-ref}/built-in-roles.html[built-in]. +privileges) required to use these {beatname_uc} features. Note that some of the +roles shown here are {xpack-ref}/built-in-roles.html[built-in], and some +are user-defined. [options="header"] |======= |Feature | Role -|Send data to a secured cluster | ++{beat_default_index_prefix}_writer++ +|Send data to a secured cluster | ++{beat_default_index_prefix}_writer++ footnoteref:[noteA,These roles are user-defined.] ifeval::["{beatname_lc}"=="filebeat"] -|Run Filebeat modules | ++{beat_default_index_prefix}_writer++ +|Run Filebeat modules | ++{beat_default_index_prefix}_writer++ footnoteref:[noteA] endif::[] -|Load index templates | ++{beat_default_index_prefix}_writer++ and `kibana_user` +|Load index templates | ++{beat_default_index_prefix}_writer++ footnoteref:[noteA] and `kibana_user` ifndef::no_dashboards[] -|Load {beatname_uc} dashboards into {kib} | ++{beat_default_index_prefix}_writer++ and `kibana_user` +|Load {beatname_uc} dashboards into {kib} | ++{beat_default_index_prefix}_writer++ footnoteref:[noteA] and `kibana_user` endif::[] ifdef::has_ml_jobs[] |Load machine learning jobs | `machine_learning_admin` endif::[] -|Read indices created by {beatname_uc} | ++{beat_default_index_prefix}_reader++ +ifndef::apm-server[] +|Read indices created by {beatname_uc} | ++{beat_default_index_prefix}_reader++ footnoteref:[noteA] +endif::[] +ifdef::apm-server[] +|Read indices created by {beatname_uc} | ++{beat_default_index_prefix}_user++ +|View {beatname_uc} dashboards in {kib} | `kibana_user` +endif::[] ifndef::no_dashboards[] |View {beatname_uc} dashboards in {kib} | `kibana_user` endif::[] ifdef::has_central_config[] |Store and manage configurations in a central location in {kib} | `beats_admin` endif::[] +ifndef::no_ilm[] +|Load index lifecycle policies and use index lifecycle management | +{beatname_lc}_ilm+ footnoteref:[noteA] +endif::[] |======= +To create the user-defined roles shown here, see <> and +<>. You may want to define additional roles to provide more +restrictive access. + include::basic-auth.asciidoc[] include::user-access.asciidoc[] diff --git a/docs/copied-from-beats/shared-docker.asciidoc b/docs/copied-from-beats/shared-docker.asciidoc index 43c3dc1d54c..eda2b026e27 100644 --- a/docs/copied-from-beats/shared-docker.asciidoc +++ b/docs/copied-from-beats/shared-docker.asciidoc @@ -5,8 +5,7 @@ Docker images for {beatname_uc} are available from the Elastic Docker registry. The base image is https://hub.docker.com/_/centos/[centos:7]. A list of all published Docker images and tags is available at -https://www.docker.elastic.co[www.docker.elastic.co]. The source code is in -{dockergithub}[GitHub]. +https://www.docker.elastic.co[www.docker.elastic.co]. These images are free to use under the Elastic license. They contain open source and free commercial features and access to paid commercial features. diff --git a/docs/copied-from-beats/shared-logstash-config.asciidoc b/docs/copied-from-beats/shared-logstash-config.asciidoc index e849f619504..68d05155c56 100644 --- a/docs/copied-from-beats/shared-logstash-config.asciidoc +++ b/docs/copied-from-beats/shared-logstash-config.asciidoc @@ -22,7 +22,7 @@ the {stack} getting started tutorial. Also see the documentation for the If you want to use {ls} to perform additional processing on the data collected by {beatname_uc}, you need to configure {beatname_uc} to use {ls}. -To do this, you edit the {beatname_uc} configuration file to disable the Elasticsearch +To do this, you edit the {beatname_uc} configuration file to disable the {es} output by commenting it out and enable the {ls} output by uncommenting the logstash section: @@ -36,8 +36,14 @@ output.logstash: The `hosts` option specifies the {ls} server and the port (`5044`) where {ls} is configured to listen for incoming Beats connections. -For this configuration, you must <> -because the options for auto loading the template are only available for the Elasticsearch output. +For this configuration, you must <> +because the options for auto loading the template are only available for the {es} output. + +ifeval::["{beatname_lc}"=="filebeat"] +Want to use <> with {ls}? You need to do +some extra setup. For more information, see +{logstash-ref}/filebeat-modules.html[Working with {beatname_uc} modules]. +endif::[] ifndef::win-only[] ifndef::apm-server[]