Skip to main content
Version: 5.1

Configuring a Standard Smart Beat Application

warning

It is assumed that Smart Beat Manager is already installed on the target host. If it is not yet installed, please refer to the Installing Smart Beat Manager.

Notation and Definitions​

  • HOST_LOGSTASH — IP logstash
  • HOST_OS_DATA — IP address of the node with the data role
  • USERNAME_OS — SM username, required for configuring and accessing OpenSearch
  • PASSWORD_OS — Password for the SM user
  • HOST_SBM — IP address of the host where Smart Beat Manager is installed
  • SBM_HOME — is the installation path of Smart Beat Manager, usually it is /app/smartBeatManager/
  • SB_HOME — Smart Beat installation home directory, for Linux - /app/smartBeat/, for Windows - C:\Program Files\smartBeat\

Configuring a Standard Smart Beat Application Using the Web Interface​

Downloading Beats Packages​

Before proceeding with the configuration, you must download the required Beats packages, including the appropriate distributions. In the examples below, these include Metricbeat, Winlogbeat, and Filebeat. Distributions are available for download from the official OpenSearch.

warning

Use the Beats versions published under the open source (OSS) license.

Uploading Beats Files to Smart Beat Manager​

This section shows how to upload a file using Filebeat as an example. The steps are the same for other Beats components.

To upload a Beats file to Smart Beat Manager, go to the Binaries section under Smart Beat Management (Main Menu - Smart Beat Management - Binaries) in the web interface.

Upload the file by either clicking the file selector button or dragging and dropping the file into the drag-and-drop area.

File Upload Window

Once the file is fully uploaded, click the Upload button.

Example of Uploaded File

After successful upload, the file will appear in the list of available configurations.

Upload Notification Window with File

Smart Beat Application Configuration​

The steps described in this section apply to all Beats.

To create a Smart Beat application, navigate to the Apps section in the Smart Beat Management interface (Main Menu - Smart Beat Management - Apps).

Applications Window

Click the Create button to open the application configuration window.

Application Configuration Window

Configuring an Application for Linux Metrics Collection​

In the Name field, enter a name for the new application, for example: metricbeat. Leave the default application type as Beat. In the Agent Type field, select metricbeat.

Before uploading the configuration file, you need to manually create and configure a metricbeat.yml file. Below is an example configuration for metricbeat.yml:

metricbeat.modules:
- module: system
  metricsets:
    - cpu
    - memory
    - network
    - filesystem
    - diskio
  enabled: true


output.logstash:
  hosts: ["<HOST_LOGSTASH>:51121"]
  ssl.certificate: "$SB_HOME/cert/cert.pem"
  ssl.key: "$SB_HOME/cert/key.pem"
  ssl.certificate_authorities: "$SB_HOME/cert/ca-cert.pem"

The metricbeat.modules section configures the metric collection parameters. In this example, the system, module is enabled to collect standard OS-level system metrics. The metricsets array defines the specific metrics to be collected: CPU usage, memory consumption, network stats, disk usage, and filesystem data. For more details on available options, refer to the official Elastic documentation. To activate the module, the enabled parameter must be set to true.

In the output.logstash section, specify the IP and port of the logstash instance in the hosts field (e.g., 51121). This section also includes SSL parameters required to establish a secure connection between the Beat agent and Logstash for data transfer.

warning

All file paths in the configuration must be relative to the target server's file system, where the agent is running—not to the Smart Beat Manager server.

In the Configuration Settings section, upload the previously created and configured file by either clicking the upload button or dragging the file into the drag-and-drop area.

As a result, your application settings will look like this:

Metricbeat Application

Click the Save button to finalize the setup.

Configuring an Application for Collecting Windows Events​

Application configuration is performed similarly to the previous section, taking into account the differences described below.

In the Agent type field, select winlogbeat.

Example configuration for winlogbeat.yml:

winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h
  - name: Security
  - name: System

setup.template.name: "winlogbeat"
setup.template.pattern: "winlogbeat"

output.logstash:
  hosts: ["<HOST_LOGSTASH>:51122"]
  ssl.certificate: "C:\\Program Files\\smartBeat\\cert\\node-cert.pem"
  ssl.key: "C:\\Program Files\\smartBeat\\cert\\node-key.pem"
  ssl.certificate_authorities: "C:\\Users\\user\\Documents\\ca-cert.pem"

The winlogbeat.event_logs section defines the list of Windows event logs to collect. A detailed description of the available parameters can be found in the official Elastic documentation.

warning

When specifying paths in configuration files for Windows, backslashes must be escaped.

The resulting application settings will appear as follows:

Winlogbeat Application

Configuring an Application for File Log Reading​

Application configuration is performed similarly to the previous sections, taking into account the differences described below.

In the Agent type field, select filebeat.

Example configuration for filebeat.yml:

filebeat.inputs:
  - type: filestream
    id: log-secure
    paths:
      - "/var/log/nginx.log"

output.logstash:
  hosts: ["<HOST_LOGSTASH>:51123"]
  ssl.certificate: "$SB_HOME/cert/cert.pem"
  ssl.key: "$SB_HOME/cert/key.pem"
  ssl.certificate_authorities: "$SB_HOME/cert/ca-cert.pem"

In the filebeat.inputs section, the following parameters are set:

  • type: filestream — used for reading active log files
  • id — a unique identifier for the input; useful when multiple inputs are defined
  • paths — a path or list of paths (with wildcard support) to the log files being read

The output.logstash section is configured in the same way as described in the metricbeat.

The resulting application settings will appear as follows:

Filebeat Application

Group Configuration​

To create a Smart Beat group, go to the Groups section of the Smart Beat Management interface (Main Menu - Smart Beat Management -Groups).

Group Window

Click the Create button to open the group configuration window.

Group Settings Window

Key information about the fields:

  • Name - sets the group name for the agents. It is recommended to use meaningful and descriptive names to simplify identifying the group’s purpose later
  • Apps – defines the list of configurations to be launched using Beats listed in the Binaries section
  • Binaries – lists all the required Beats distributions that will be used for this group
  • Filters – used to define agents (by name, ID, or IP) that should interact with Smart Beat Manager. You can specify multiple values and use wildcards with the * symbol
  • Exclusions – used to exclude agents (by name, ID, or IP) that should not be managed by Smart Beat Manager. Multiple values and wildcards with * are also supported
  • Systems – specifies the system type that the Smart Beat Manager will interact with

Group Configuration for metricbeat​

  • in the Name field, enter: Linux Metricbeat
  • in the Apps field, select the previously created application metricbeat
  • in the Binaries field, select the previously uploaded Beats distribution, e.g.: metricbeat-oss-8.6.2-linux-x86_64.tar.gz
  • in the Filters field, list the agent names, IDs, or IPs separated by commas. In this case, an ID is used
  • in the Exclusions field, specify any agents to exclude by name, ID, or IP, also comma-separated
  • in the Systems field, select linux-amd64

After filling in all fields, the group configuration will look like this:

Group metricbeat

Click the Save button.

Group Configuration for winlogbeat​

  • in the Name field, enter: Windows Events
  • in the Apps field, select the previously created application winlogbeat
  • in the Binaries field, select the previously uploaded archive, e.g.: winlogbeat-8.9.2-windows-x86_64.zip
  • in the Filters field, list agent names, IDs, or IPs separated by commas. In this case, names and wildcards are used
  • in the Exclusions field, specify agents to exclude by name, ID, or IP, separated by commas
  • in the Systems field, select windows-amd64

After completing the fields, the group configuration will look like this:

Group winlogbeat

Click the Save button.

Group Configuration for filebeat​

  • in the Name field, enter: Linux Filebeat
  • in the Apps field, select the previously created application filebeat
  • in the Binaries field, select the previously uploaded Beats distribution, e.g.: filebeat-8.17.3-linux-x86_64.tar.gz
  • in the Filters field, list agent names, IDs, or IPs separated by commas. In this case, an IP address is used
  • in the Exclusions field, specify agents to exclude by name, ID, or IP, separated by commas
  • in the Systems field, select linux-amd64

After completing the fields, the group configuration will look like this:

Group filebeat

Click the Save button.

This concludes the Smart Beat application configuration.

There is an alternative method for configuring agents. This method requires access to the server where Smart Beat Manager is installed to manually edit its configuration files.

Installing Beats​

Copy the downloaded Beats distributions and place them in the $SBM_HOME/binaries/ directory.

sudo cp ~/binaries/*  $SBM_HOME/binaries/
sudo chown -R sbm:sbm $SBM_HOME/

Configuring serverclasses.yml​

Open the serverclasses.yml file located in the $SBM_HOME/etc directory and add the necessary configuration parameters. Below is an example of the file content:

- name: Linux Metricbeat
  apps:
  - metricbeat_linux
  binaries:
  - metricbeat-oss-8.6.2-linux-x86_64.tar.gz
  systems:
  - linux-amd64
  filters:
  - 31d7dfc783bs39d6ead9c721153289de44d1047d56ca96456c873df481a4c3d1
  - 3F2504E0-4F89-11D3-9A0C-0305E82C3301
- name: Windows Events
  apps:
  - winlogbeat_events
  binaries:
  - winlogbeat-8.9.2-windows-x86_64.zip
  systems:
  - windows-amd64
  filters:
  - "prod_*"
  - "test_server"
- name: Linux Filebeat
  apps:
  - filebeat_linux
  binaries:
  - filebeat-oss-8.7.1-linux-x86_64.tar.gz
  systems:
  - linux-amd64
  filters:
  - 172.16.0.1

You can find the description of the parameters in the section above, which describes configuring a group via the web interface.

info

The apps, filters, binaries, name fields are mandatory.

Example: Configuring a Linux Metricbeat Application​

Create a directory with a name that exactly matches the one defined in the apps field of your serverclasses.yml file:

sudo -u sbm mkdir $SBM_HOME/apps/metricbeat_linux

Create and open the configuration file for editing:

sudo -u sbm nano $SBM_HOME/apps/metricbeat_linux/metricbeat.yml

To configure the metricbeat.yml file, refer to the section Configuring an Application for Linux Metrics Collection, where a configuration example is provided.

Example: Configuring an Application for Collecting Windows Events​

Create a directory with a name that exactly matches the one specified in the apps field of the serverclasses.yml configuration file:

sudo -u sbm mkdir $SBM_HOME/apps/winlogbeat_events

Create and open the configuration file for editing:

sudo -u sbm nano $SBM_HOME/apps/metricbeat_linux/winlogbeat.yml

To configure the winlogbeat.yml file, refer to the section Configuring an Application for Collecting Windows Events, which provides an example configuration.

Example: Configuring an Application for Reading Log Files​

Create a directory with a name that exactly matches the one specified in the apps field of the serverclasses.yml configuration file:

sudo -u sbm mkdir $SBM_HOME/apps/filebeat_linux

Create the configuration file and open it for editing:

sudo -u sbm nano $SBM_HOME/apps/metricbeat_linux/filebeat.yml

To configure the winlogbeat.yml file, refer to the section Configuring an Application for File Log Reading, which provides an example configuration.

Applying Configuration Changes​

To apply changes, Smart Beat Manager must reload its configuration. This can be done in one of the following ways:

  • restart the service using systemd
sudo systemctl restart smartBeatManager
  • use the Smart Beat Manager API
curl -k https://<HOST_SBM>:7769/reload -u sbm