filebeat

The largest consumers are systemd-journal which is storing logs in RAM, and filebeat which is relatively wasteful w/ memory.

You can easily run filebeat as a daemonset and have it detect all your pods and logs.

In comparison, deploying Filebeat and Metricbeat is super simple, just configure the yaml file via something like Ansible and you're done.

But you can also use something like filebeat and a bunch of other modern alternatives.

My first productive use for ChatGPT was writing a filebeat configuration (to extract tokens out of loglines to push into the ELK-stack)...

Set up FileBeat and Kibana (or a more dedicated dashboard) and you've got more alerts and telemetry than you could ever wish.

Then again, I asked ChatGPT moons ago to generate a Filebeat config file, and its output contained syntax errors...

Maybe check that a few important metrics are shipped via telegraf and filebeat looks at the right logs, too, that'll be 95% - 99%.

The other main issue I see is that they use chef and mrsk to setup applications, how is Filebeat setup?

I settled on a happy/ok midpoint recently whereby I dump logs in a redis queue using filebeat as it’s very simple.

I only looked for a moment, but filebeat appears to be ingestion only.

Vector.dev might be a good replacement for filebeat.

- how "plug and play" would be in a system using Prometheus+Thanos for metrics and Filebeat+Logsatsh+ElasticSearch for logs?

Filebeat is a tiny part of ELK, which is the de facto standard logging stack.

We turned to open-source solutions like Logstash, Prometheus, Filebeat, and Grafana.

How will that work with Logstash and Filebeat?