Filebeat¶
Overview¶
Elastic Beats are lightweight "data shippers". Filebeat's role in ROCK is to do just this: ship file data to the next step in the pipeline.
The following ROCK components depend on Filebeat to send their log files into the Kafka message queue:
-
Suricata - writes alerting data into
eve.json -
FSF - writes static file scan results to
rockout.log
Management¶
Service¶
FSF is deployed as a systemd unit, called filebeat.service. This service is
configured and enabled on startup. This can be verified with either:
$ sudo rockctl status
$ sudo systemctl status filebeat
Directories¶
The configuration path for Filebeat is found at:
/etc/filebeat/filebeat.yml