Beats: Packetbeat

Open in ChatGPTOpen in Claude

Coralogix integrates with Packetbeat so you can send your network usage logs from anywhere and parse them according to your needs.

What you need

• Have Packetbeat installed. For more information on how to install it, see the Elastic documentation.

• A Logstash instance that you run in your own infrastructure, configured to receive Beats input and forward it to Coralogix. Coralogix no longer hosts a Logstash server for Beats shippers. See Run your own Logstash instance for the Logstash input, filter, and output configuration.

General

Private Key: Your Send-Your-Data API key is a unique ID that represents your company.

Company Id: A unique number that represents your company. You can get your company id from the settings tab in the Coralogix dashboard.

Application Name: The name of your main application, for example, a company named "SuperData" would probably insert the "SuperData" string parameter or if they want to debug their test environment they might insert the "SuperData - Test".

SubSystem Name: Your application probably has multiple subsystems, for example: Backend servers, Middleware, Frontend servers etc. in order to help you examine the data you need, inserting the subsystem parameter is vital.

Configuration

Open your Packetbeat configuration file and configure it to use Logstash. For more information about configuring Packetbeat to use Logstash, see the Elastic documentation.

Point your Packetbeat to output to your own Logstash instance:

<logstash-ip-address>:5044

Note

The Coralogix-hosted Logstash endpoints (logstashserver.coralogix.com, logstash.coralogix.in, logstashserver.coralogix.us) are retired and no longer accept data. See Deprecation of Coralogix-hosted Logstash.

Set the General values (Send-Your-Data API key, application name, and subsystem name) in your Logstash configuration, not in packetbeat.yml.

Here is a basic example of packetbeat.yml for watching HTTP packages:

#========================== Network targets to watch ===========================

packetbeat.interfaces.device: any
packetbeat.protocols:
- type: http
  ports: [80, 8080, 8000, 5000, 8002]
  hide_keywords: ["pass", "password", "passwd"]
  send_headers: ["User-Agent", "Cookie", "Set-Cookie"]
  split_cookie: true
  real_ip_header: "X-Forwarded-For"

#----------------------------- Logstash output --------------------------------

output.logstash:
  enabled: true
  hosts: ["<logstash-ip-address>:5044"]