Title
#fleet
a

Adam Connor

08/12/2022, 3:51 AM
actually I should be able to do the work if I get a hint like ‘use the corrupted porpoise method’ or ‘count the nose hairs in a video of Jordan Peterson crying’
Benjamin Edwards

Benjamin Edwards

08/12/2022, 8:58 AM
Adam, where are you running the Fleet backend? Knowing that would open up some options. If you are on VPS or self hosted, then setting up results logging destination as the file system plugin, then using something like Filebeat to ship logs to elastic search can work really well. If you are running in AWS, you can use the Firehose plugin, and then wire up firehose to deliver to managed OpenSearch. Like I said lots of options and some easier than others depending on your hosting situation.
a

Adam Connor

08/12/2022, 10:14 AM
Hi @Benjamin Edwards thanks for the reply. I have it running as a VPS with a local provider, non AWS/ GCP. Right now I’m trying to do everything ‘cheapest way possible’ until I am more confident and will switch to ‘best way possible’ I set up another VPS with Elastic and Kibana last night, then realised I had no idea how to get them to talk…
Saulo Guilhermino

Saulo Guilhermino

08/12/2022, 12:21 PM
@Adam Connor My approach to this is to set the Fleet logs to be stored in a local file and use a Fluent Bit (or some other log processor tool) to read from this file and send the lines to your ElasticSearch
12:23 PM
In case you need more details, I can send you my fluent bit configuration file
Benjamin Edwards

Benjamin Edwards

08/12/2022, 12:41 PM
Fluentbit, Vector, Filebeat all great tools
Saulo Guilhermino

Saulo Guilhermino

08/12/2022, 12:43 PM
Yea! Sorry, Benjamin, I hadn't finished reading your answer before writing mine. I ended up repeating everything lol
a

Adam Connor

08/13/2022, 1:04 AM
cool, thanks @Benjamin Edwards and @Saulo Guilhermino - I really appreciate the replies, and any example configs are welcome!