- Journalbeat Reference for 6.5-7.15:
- Journalbeat overview
- Quick start: installation and configuration
- Set up and run
- Configure
- Inputs
- General settings
- Project paths
- Output
- Kerberos
- SSL
- Index lifecycle management (ILM)
- Elasticsearch index template
- Processors
- Define processors
- add_cloud_metadata
- add_cloudfoundry_metadata
- add_docker_metadata
- add_fields
- add_host_metadata
- add_id
- add_kubernetes_metadata
- add_labels
- add_locale
- add_network_direction
- add_nomad_metadata
- add_observer_metadata
- add_process_metadata
- add_tags
- community_id
- convert
- copy_fields
- decode_base64_field
- decode_csv_fields
- decode_json_fields
- decode_xml
- decode_xml_wineventlog
- decompress_gzip_field
- detect_mime_type
- dissect
- dns
- drop_event
- drop_fields
- extract_array
- fingerprint
- include_fields
- rate_limit
- registered_domain
- rename
- script
- timestamp
- translate_sid
- truncate_fields
- urldecode
- Internal queue
- Logging
- HTTP endpoint
- Regular expression support
- Instrumentation
- journalbeat.reference.yml
- How to guides
- Exported fields
- Monitor
- Secure
- Troubleshoot
- Get help
- Debug
- Common problems
- Journalbeat uses too much bandwidth
- Error loading config file
- Found unexpected or unknown characters
- Logstash connection doesn’t work
- Publishing to Logstash fails with "connection reset by peer" message
- @metadata is missing in Logstash
- Not sure whether to use Logstash or Beats
- SSL client fails to connect to Logstash
- Monitoring UI shows fewer Beats than expected
Grant privileges and roles needed to read Journalbeat data from Kibana
editGrant privileges and roles needed to read Journalbeat data from Kibana
editKibana users typically need to view dashboards and visualizations that contain Journalbeat data. These users might also need to create and edit dashboards and visualizations.
To grant users the required privileges:
-
Create a reader role, called something like
journalbeat_reader
, that has the following privilege:Type Privilege Purpose Index
read
onjournalbeat-*
indicesRead data indexed by Journalbeat
Spaces
Read
orAll
on Dashboards, Visualize, and DiscoverAllow the user to view, edit, and create dashboards, as well as browse data.
Spaces
Read
orAll
on Kibana LogsAllow the use of Kibana Logs
-
Assign the reader role, along with the following built-in roles, to users who need to read Journalbeat data:
Role Purpose monitoring_user
Allow users to monitor the health of Journalbeat itself. Only assign this role to users who manage Journalbeat.