• refer:

1. https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html#configuring-grok-filter
2. https://elasticsearch.cn/question/2345

• outline

integrate FileBeat, logstash with Elasticsearch.

Error may encounter

If X-Pack security is enabled, following error will be happen in Logstash

[2017-12-22T15:30:51,068][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://localhost:9200/'"}

How to solve

Configure the username and password for login Elasticsearch in the pipeline:

input {
    beats {
        port => "5044"
    }
}
filter {
    grok {
        match => { "message" => "%{COMBINEDAPACHELOG}"}
    }
	geoip {
        source => "clientip"
    }
}
output {
   #stdout { codec => rubydebug }
   #stdout { }
   elasticsearch {
        hosts => [ "localhost:9200" ]
	user => elastic
	password => changeme
    }
}