How does Filebeat work #1963
How does Filebeat work #1963
Conversation
ruflin
added
docs
in progress
|
@ruflin I think we need to be careful here not to duplicate info that really belongs in the reference section for config options. This topic should definitely describe how Filebeat works conceptually and mention config settings that control behavior, but any detailed guidance about setting options belongs either in the reference content or in topics under "Configuring Filebeat." Perhaps you are thinking the same thing when you mention having content for experienced users. :-) |
|
@dedemorton Exactly. I'm currently putting everything into 1 document and we should then decide based on the content what fits where. I will need your help here ;-) |
| @@ -2,68 +2,68 @@ | |||
|
|
|||
| This page intends to explain what the key building blocks of Filebeat are and how they work together. The goal is that the available configuration options can be better understood on what they do. | |||
|
|
|||
| === What is a Prospector? | |||
| === What is an Input? | |||
There was a problem hiding this comment.
From the perspective of working with the config file, "input" is definitely easier to follow and more intuitive.
My concern with renaming "prospector" to "input" is when we start to talk about an input conceptually as a component that does something. We also have the concept of inputs and outputs in Logstash. Our concept of outputs in Beats is pretty similar to Logstash; you specify an output based on the specific type of system that you want to send events to. But in the context of Filebeat, an input does not read from a specific type of system. It's more about specifying the paths to files and defining how you want Filebeat to process the log lines.
When you start explaining things conceptually, I think that "input" starts to sound a bit awkward. The word "input" by itself is almost too generic. It doesn't sound like a component that actually does something. In Logstash, they get around this problem by talking about "input stages" and "input plugins". I think maybe you ran into this problem yourself because you use "input module" below.
I wonder if we could rename the section without talking about an input as an actual component of functionality within Filebeat.
ruflin
force-pushed
the
filebeat-how-it-works
branch
3 times, most recently
from
dfd825f to
b1504ac
Compare
ruflin
force-pushed
the
filebeat-how-it-works
branch
from
b1504ac to
607d84f
Compare
|
|
||
| === What is an prospector? | ||
|
|
||
| Filebeat currently supports two `prospector` types: `log` and `stdin`. Each prospector type can be defined multiple times. The responsibility of the prospector is to find all sources it should read from. In case of the log input type it is to find all files on the drive based on the defined paths and start a harvester for each file that was found. Each prospector looks as following: |
There was a problem hiding this comment.
I'd suggest "Each prospector configuration looks as following" for clarity.
ruflin
force-pushed
the
filebeat-how-it-works
branch
2 times, most recently
from
e36c646 to
b2d52f6
Compare
ruflin
added
review
and removed
in progress
* Guide on how Filebeat works and some config options. * Explain some common use cases for the config options * Fix typos / issue. Move to troubleshooting guide
ruflin
force-pushed
the
filebeat-how-it-works
branch
from
b2d52f6 to
fb63026
Compare
Guide on how Filebeat works and some config options.
@dedemorton The intention is to have a general guide for filebeat. The second part about the config options should probably be moved to an other section as it is for "exeperienced users".