{"id":7286,"date":"2020-11-17T23:47:55","date_gmt":"2020-11-17T20:47:55","guid":{"rendered":"https:\/\/kifarunix.com\/?p=7286"},"modified":"2024-03-14T23:46:34","modified_gmt":"2024-03-14T20:46:34","slug":"monitor-linux-system-metrics-with-elk-stack","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/monitor-linux-system-metrics-with-elk-stack\/","title":{"rendered":"Monitor Linux System Metrics with ELK Stack"},"content":{"rendered":"\n<p>In this tutorial, you will learn how to monitor Linux system metrics with ELK Stack. ELK Stack, or if you like, Elastic stack can be used to monitor Linux system metrics with the aid of the Metricbeat. <a aria-label=\"Metricsbeat (opens in a new tab)\" class=\"rank-math-link\" href=\"https:\/\/www.elastic.co\/beats\/metricbeat\" target=\"_blank\" rel=\"noreferrer noopener\">Metricbeat<\/a> is a lightweight shipper for system metrics. It can collect system-level CPU usage, memory, file system, disk IO, and network IO statistics, as well as top-like statistics for every process running on your systems and ship them to Elasticsearch for indexing to enable visualization through the visualization tools like Kibana.<\/p>\n\n\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h2>Table of Contents<\/h2><nav><ul><li><a href=\"#monitoring-linux-system-metrics-with-elk-stack\">Monitoring Linux System Metrics with ELK Stack<\/a><ul><li><a href=\"#install-and-setup-elk-stack\">Install and Setup ELK Stack<\/a><\/li><li><a href=\"#install-metricbeat-in-linux-systems\">Install Metricbeat in Linux Systems<\/a><ul><li><a href=\"#install-metricbeat-on-ubuntu\">Install Metricbeat on Ubuntu<\/a><\/li><li><a href=\"#install-metricbeat-on-cent-os\">Install Metricbeat on CentOS<\/a><\/li><\/ul><\/li><li><a href=\"#configure-metricbeat-to-collect-various-system-metrics\">Configure Metricbeat to collect various system metrics<\/a><ul><li><a href=\"#configure-metricbeat-in-linux\">Configure Metricbeat in Linux<\/a><\/li><li><a href=\"#configure-kibana-endpoint\">Configure Kibana Endpoint<\/a><\/li><li><a href=\"#configure-metricbeat-logging\">Configure Metricbeat logging<\/a><\/li><li><a href=\"#enable-and-configure-metrics-collection-modules\">Enable and configure metrics collection modules<\/a><\/li><li><a href=\"#load-metric-kibana-dashboards-elasticsearch-index-template\">Load Metric Kibana Dashboards\/Elasticsearch Index Template<\/a><\/li><li><a href=\"#running-metricbeat-in-linux-system\">Running Metricbeat in Linux System<\/a><\/li><\/ul><\/li><li><a href=\"#create-metricbeat-kibana-index-pattern\">Create Metricbeat Kibana Index Pattern<\/a><\/li><li><a href=\"#view-metricbeat-data-in-kibana\">View Metricbeat Data in Kibana<\/a><ul><li><a href=\"#metricbeat-raw-data\">Metricbeat RAW Data<\/a><\/li><li><a href=\"#metricbeat-system-overview-dashboard\">Metricbeat System Overview Dashboard<\/a><\/li><\/ul><\/li><li><a href=\"#viewing-metrics-app-visualizations\">Viewing Metrics App Visualizations<\/a><\/li><li><a href=\"#reference\">Reference<\/a><\/li><li><a href=\"#related-tutorials\">Related Tutorials<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"monitoring-linux-system-metrics-with-elk-stack\">Monitoring Linux System Metrics with ELK Stack<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"install-and-setup-elk-stack\">Install and Setup ELK Stack<\/h3>\n\n\n\n<p>You need to have an ELK stack already setup and running. The setup of ELK Stack is beyond the scope of this guide, however, you can follow the links below to install and setup ELK Stack<\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" class=\"rank-math-link\" href=\"https:\/\/kifarunix.com\/install-elastic-elk-stack-on-ubuntu-20-04\/\" target=\"_blank\" rel=\"noreferrer noopener\">Install ELK Stack on Linux<\/a><\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" class=\"rank-math-link\" href=\"https:\/\/kifarunix.com\/deploy-a-single-node-elastic-stack-cluster-on-docker-containers\/\" target=\"_blank\" rel=\"noreferrer noopener\">Deploy a Single Node Elastic Stack Cluster on Docker Containers<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"install-metricbeat-in-linux-systems\">Install Metricbeat in Linux Systems<\/h3>\n\n\n\n<p>In this tutorial we will be using a CentOS 8 and an Ubuntu 20.04 systems for demo.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"install-metricbeat-on-ubuntu\">Install Metricbeat on Ubuntu<\/h4>\n\n\n\n<p>You can install Metricbeat from the official Elastic repos or directly using the Metricbeat DEB binary. We use the former method in this setup.<\/p>\n\n\n\n<p>Install Elastic stack repo Public Signing Key:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt install gnupg2 -y<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>wget -qO - https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch | sudo gpg --dearmor &gt; \/etc\/apt\/trusted.gpg.d\/elk.gpg<\/code><\/pre>\n\n\n\n<p>Install Elastic stack repo on Ubuntu<\/p>\n\n\n\n<p>We are running Elastic Stack 7.17.0, hence we are installing Metricbeat v7.17.0<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>echo \"deb https:\/\/artifacts.elastic.co\/packages\/7.x\/apt stable main\" | sudo tee -a \/etc\/apt\/sources.list.d\/elastic-7.x.list<\/code><\/pre>\n\n\n\n<p>Update package cache;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>sudo apt update<\/code><\/pre>\n\n\n\n<p>Install Metricbeat v7.17.0 on Ubuntu;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>sudo apt install metricbeat=7.17.0<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"install-metricbeat-on-cent-os\"><a href=\"#install-metricbeat-on-centos\">Install Metricbeat on CentOS<\/a><\/h4>\n\n\n\n<p>Similarly, you can install Metricbeat on CentOS\/RHEL or similar releases using the RPM binary or directly from the Elastic stack repos.<\/p>\n\n\n\n<p>For convenience sake, we install it from the Elastic stack repo, hence;<\/p>\n\n\n\n<p>Install Elastic stack repo Public Signing Key:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>sudo rpm --import https:\/\/packages.elastic.co\/GPG-KEY-elasticsearch<\/code><\/pre>\n\n\n\n<p>Install Elastic stack repo on CentOS 8;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\ncat &lt;&lt; EOL &gt; \/etc\/yum.repos.d\/elasticstack.repo \n[elastic-7.x]\nname=Elastic repository for 7.x packages\nbaseurl=https:\/\/artifacts.elastic.co\/packages\/7.x\/yum\ngpgcheck=1\ngpgkey=https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch\nenabled=1\nautorefresh=1\ntype=rpm-md\nEOL\n<\/code><\/pre>\n\n\n\n<p>Install Metricbeat on CentOS;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>sudo dnf install metricbeat-7.17.0<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"configure-metricbeat-to-collect-various-system-metrics\">Configure Metricbeat to collect various system metrics<\/h3>\n\n\n\n<p>Once the installation of metric is done, configure it to collect various system metrics and ship them to either Elasticsearch or Logstash depending on your setup.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"configure-metricbeat-in-linux\">Configure Metricbeat in Linux<\/h4>\n\n\n\n<p>To begin with, configure Metricbeat output. In this setup, we are sending Metricbeat data directly to Elasticsearch running on a remote host. As such, edit the Metricbeat configuration file and define Elasticsearch output.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/etc\/metricbeat\/metricbeat.yml<\/code><\/pre>\n\n\n\n<pre class=\"scroll-sz\"><code>\n...\n# ---------------------------- Elasticsearch Output ----------------------------\noutput.elasticsearch:\n  # Array of hosts to connect to.\n  #hosts: [\"localhost:9200\"]\n<strong>  hosts: [\"192.168.57.30:9200\"]<\/strong>\n<\/code><\/pre>\n\n\n\n<p>If you configured ELK stack authentication, ensure you define username and password with proper roles to write into the respective index you are using for Metricbeat data.<\/p>\n\n\n\n<p>If you are sending the metric data to Logstash instead, comment the Elasticsearch output configs and enable Logstash output as follows;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\n...\n# ---------------------------- Elasticsearch Output ----------------------------\n#output.elasticsearch:\n  # Array of hosts to connect to.\n  #hosts: [\"localhost:9200\"]\n  #hosts: [\"192.168.57.30:9200\"]\n\n  # Protocol - either `http` (default) or `https`.\n  #protocol: \"https\"\n\n  # Authentication credentials - either API key or username\/password.\n  #api_key: \"id:api_key\"\n  #username: \"elastic\"\n  #password: \"changeme\"\n\n# ------------------------------ Logstash Output -------------------------------\n<strong>output.logstash:\n  # The Logstash hosts\n  #hosts: [\"localhost:5044\"]\n  hosts: [\"192.168.57.30:5044\"]<\/strong>\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"configure-kibana-endpoint\">Configure Kibana Endpoint<\/h4>\n\n\n\n<p>If you will want to use Metricbeat prebuilt Kibana dashboards and both Kibana and Elasticsearch are running on separate hosts, then you will need to load the dashboard manually. For this reason, you need to configure Kibana endpoint. Otherwise, if Kibana and Elasticsearch are running on the same host, you don&#8217;t need to configure Kibana endpoint and can safely ignore this configuration.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/etc\/metricbeat\/metricbeat.yml<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\n...\n# =================================== Kibana ===================================\n\n# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.\n# This requires a Kibana endpoint configuration.\n<strong>setup.kibana:\n\n  # Kibana Host\n  #host: \"localhost:5601\"\n  host: \"192.168.57.30:5601\"<\/strong>\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"configure-metricbeat-logging\">Configure Metricbeat logging<\/h4>\n\n\n\n<p>To ensure that Metricbeat is logging to its specific file instead of the syslog (\/var\/log\/syslog, \/var\/log\/messages), enter the following lines into the configuration file;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\n# ================================= Logging ====================================\nlogging.level: info\nlogging.to_files: true\nlogging.files:\n  path: \/var\/log\/metricbeat\n  name: metricbeat\n  keepfiles: 7\n  permissions: 0644\n<\/code><\/pre>\n\n\n\n<p>Save and exit the configuration.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"enable-and-configure-metrics-collection-modules\">Enable and configure metrics collection modules<\/h4>\n\n\n\n<p>Metricbeat ships with a dozen modules that enabled it to collect specific service metrics. You can list modules by running the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>metricbeat modules list<\/code><\/pre>\n\n\n\n<p>The command shows enabled and disabled modules;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\nEnabled:\nsystem\n\nDisabled:\nactivemq\naerospike\napache\n...\n<\/code><\/pre>\n\n\n\n<p>To enable a module, simply run;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>metricbeat modules enable &lt;module-name&gt;<\/code><\/pre>\n\n\n\n<p>Where a module-name you can obtain from the list above.<\/p>\n\n\n\n<p>Similarly, to disable a module;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>metricbeat modules disable &lt;module-name&gt;<\/code><\/pre>\n\n\n\n<p>In this setup, we are using the Metricbeat system module, which is already enabled.<\/p>\n\n\n\n<p>This Metricbeat system module collects the following metricsets;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>cpu<\/li>\n\n\n\n<li>load<\/li>\n\n\n\n<li>memory<\/li>\n\n\n\n<li>network<\/li>\n\n\n\n<li>process<\/li>\n\n\n\n<li>process_summary<\/li>\n\n\n\n<li>socket_summary<\/li>\n\n\n\n<li>entropy<\/li>\n\n\n\n<li>core<\/li>\n\n\n\n<li>diskio<\/li>\n\n\n\n<li>socket<\/li>\n\n\n\n<li>service<\/li>\n\n\n\n<li>users<\/li>\n<\/ul>\n\n\n\n<p>If you want to modify the module, simply open the file, <code><strong>\/etc\/metricbeat\/modules.d\/system.yml<\/strong><\/code>, for editing.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"load-metric-kibana-dashboards-elasticsearch-index-template\">Load Metric Kibana Dashboards\/Elasticsearch Index Template<\/h4>\n\n\n\n<p>You can load the recommended&nbsp;index template&nbsp;for writing to Elasticsearch and deploy the sample dashboards for visualizing the Metricbeat data in Kibana by executing the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>metricbeat setup -e<\/code><\/pre>\n\n\n\n<p>The command above expects Kibana to be listening on localhost.<\/p>\n\n\n\n<p>Otherwise, configure Kibana to listen on an IP interface and load the dashboard from the metricbeat host using the command below;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>metricbeat setup -e -E setup.kibana.host=192.168.58.22:5601<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\n2023-04-07T17:40:23.797Z\tINFO\ttemplate\/load.go:197\tExisting template will be overwritten, as overwrite is enabled.\n2023-04-07T17:40:24.404Z\tINFO\ttemplate\/load.go:131\tTry loading template metricbeat-7.17.0 to Elasticsearch\n2023-04-07T17:40:24.456Z\tINFO\ttemplate\/load.go:123\tTemplate with name \"metricbeat-7.17.0\" loaded.\n2023-04-07T17:40:24.457Z\tINFO\t[index-management]\tidxmgmt\/std.go:297\tLoaded index template.\n2023-04-07T17:40:24.460Z\tINFO\t[index-management.ilm]\tilm\/std.go:126\tIndex Alias metricbeat-7.17.0 exists already.\n<strong>Index setup finished.\n<\/strong>Loading dashboards (Kibana must be running and reachable)\n2023-04-07T17:40:24.460Z\tINFO\tkibana\/client.go:180\tKibana url: http:\/\/192.168.58.22:5601\n2023-04-07T17:40:24.905Z\tINFO\tkibana\/client.go:180\tKibana url: http:\/\/192.168.58.22:5601\n2023-04-07T17:40:26.680Z\tINFO\t[add_cloud_metadata]\tadd_cloud_metadata\/add_cloud_metadata.go:101\tadd_cloud_metadata: hosting provider type not detected.\n2023-04-07T17:42:17.980Z\tINFO\tinstance\/beat.go:869\tKibana dashboards successfully loaded.\n<strong>Loaded dashboards<\/strong>\n<\/code><\/pre>\n\n\n\n<p>If you need to define username and password for authentication, pass the options, <\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code><strong>-E setup.kibana.username=elastic -E setup.kibana.password=PASSWORD<\/strong><\/code><\/pre>\n\n\n\n<p>If you are using Logstash or any other processing engines instead of using Elasticsearch as output, you need to load the index template manually into Elasticsearch. This requires a direct connection to Elasticsearch. The command below is used to load the index template manually to Elasticsearch (It temporarily disables Logstash Output).<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>metricbeat setup -e -E output.logstash.enabled=false -E output.elasticsearch.hosts=['192.168.57.30:9200'] -E setup.kibana.host=192.168.57.30:5601<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"running-metricbeat-in-linux-system\">Running Metricbeat in Linux System<\/h4>\n\n\n\n<p>Test Metricbeat configuration syntax;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>metricbeat test config<\/code><\/pre>\n\n\n\n<p>If you get, Config OK, then all is good. otherwise, if there is any error, fix before you can proceed.<\/p>\n\n\n\n<p>Test Modules settings;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>metricbeat test modules<\/code><\/pre>\n\n\n\n<p>Also, test Metricbeat output connection;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>metricbeat test output<\/code><\/pre>\n\n\n\n<p>Sample output;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\n  parse url... OK\n  connection...\n    parse host... OK\n    dns lookup... OK\n    addresses: 192.168.58.22\n    dial up... OK\n  TLS... WARN secure connection disabled\n  talk to server... OK\n  version: 7.17.0\n<\/code><\/pre>\n\n\n\n<p>Once the installation and configuration of Metricbeat is done, you can start and enable Metricbeat service to run on system boot;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl enable --now metricbeat<\/code><\/pre>\n\n\n\n<p>To check the status;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl status metricbeat<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\n\u25cf metricbeat.service - Metricbeat is a lightweight shipper for metrics.\n     Loaded: loaded (\/lib\/systemd\/system\/metricbeat.service; enabled; vendor preset: enabled)\n     Active: active (running) since Fri 2023-04-07 17:49:49 UTC; 2s ago\n       Docs: https:\/\/www.elastic.co\/beats\/metricbeat\n   Main PID: 71759 (metricbeat)\n      Tasks: 5 (limit: 1026)\n     Memory: 60.1M\n        CPU: 271ms\n     CGroup: \/system.slice\/metricbeat.service\n             \u2514\u250071759 \/usr\/share\/metricbeat\/bin\/metricbeat --environment systemd -c \/etc\/metricbeat\/metricbeat.yml --path.home \/usr\/share\/metricbeat --path.config \/etc\/metr>\n\nApr 07 17:49:49 ubuntu systemd[1]: metricbeat.service: Deactivated successfully.\nApr 07 17:49:49 ubuntu systemd[1]: Stopped Metricbeat is a lightweight shipper for metrics..\nApr 07 17:49:49 ubuntu systemd[1]: Started Metricbeat is a lightweight shipper for metrics..\n<\/code><\/pre>\n\n\n\n<p>Check the logs;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tail -f \/var\/log\/metricbeat\/metricbeat<\/code><\/pre>\n\n\n\n<p>If you get such as error related to Glibc as, <strong><code>Fatal glibc error: rseq registration failed<\/code><\/strong>, then check the guide below on how to fix;<\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/how-to-fix-filebeat-glibc-related-errors\/\" target=\"_blank\" rel=\"noreferrer noopener\">How to Fix Beats Glibc Related Errors<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"create-metricbeat-kibana-index-pattern\">Create Metricbeat Kibana Index Pattern<\/h3>\n\n\n\n<p>Navigate to your Elastic stack dashboard and create Kibana Metricbeat index to enable you view and visualize the metric data.<\/p>\n\n\n\n<p>The Index should be already created if the Metricbeat is started on your remote monitoring systems and system metric data is already being collected or if you loaded with the <strong><code>metricbeat setup<\/code><\/strong> command above.<\/p>\n\n\n\n<p>Confirm under <strong>Kibana menu &gt; Management &gt; Stack Management &gt; Data &gt; Index Management<\/strong>;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1889\" height=\"622\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/metricbeat-index.png\" alt=\"\" class=\"wp-image-16064\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/metricbeat-index.png?v=1680888045 1889w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/metricbeat-index-768x253.png?v=1680888045 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/metricbeat-index-1536x506.png?v=1680888045 1536w\" sizes=\"(max-width: 1889px) 100vw, 1889px\" \/><\/figure>\n\n\n\n<p>Next, create metricbeat Kibana index pattern, if it is not already created, by navigating to <strong>Kibana menu &gt; Management &gt; Stack Management &gt; Kibana &gt; Index Patterns &gt; Create index pattern<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1900\" height=\"930\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/create-metricbeat-index-pattern.png\" alt=\"\" class=\"wp-image-16065\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/create-metricbeat-index-pattern.png?v=1680888392 1900w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/create-metricbeat-index-pattern-768x376.png?v=1680888392 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/create-metricbeat-index-pattern-1536x752.png?v=1680888392 1536w\" sizes=\"(max-width: 1900px) 100vw, 1900px\" \/><\/figure>\n\n\n\n<p>Enter the pattern that matches your index, and choose @timestamp as Timestamp field and create the index pattern.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"view-metricbeat-data-in-kibana\">View Metricbeat Data in Kibana<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"metricbeat-raw-data\">Metricbeat RAW Data<\/h4>\n\n\n\n<p>Under the Discover navigation, select <code><strong>metricbeat-*<\/strong><\/code> index to view the Metricbeat raw data.<\/p>\n\n\n\n<p><strong>Adjust the time range accordingly.<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1902\" height=\"908\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/metricbeat-data.png\" alt=\"\" class=\"wp-image-16066\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/metricbeat-data.png?v=1680890184 1902w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/metricbeat-data-768x367.png?v=1680890184 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/metricbeat-data-1536x733.png?v=1680890184 1536w\" sizes=\"(max-width: 1902px) 100vw, 1902px\" \/><\/figure>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2020\/11\/metricbeat-raw-data.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-large\"><\/figure><\/a><\/div>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"metricbeat-system-overview-dashboard\">Metricbeat System Overview Dashboard<\/h4>\n\n\n\n<p>In the side navigation, click&nbsp;<strong>Dashboard<\/strong>, then select the dashboard that you want to open. For example, <strong><code>[Metricbeat System] Host overview ECS<\/code><\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1901\" height=\"2704\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/Metricbeat-System-Host-overview-ECS-Elastic.png\" alt=\"metricbeat dashboards\" class=\"wp-image-16067\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/Metricbeat-System-Host-overview-ECS-Elastic.png?v=1680890419 1901w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/Metricbeat-System-Host-overview-ECS-Elastic-768x1092.png?v=1680890419 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/Metricbeat-System-Host-overview-ECS-Elastic-1080x1536.png?v=1680890419 1080w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/Metricbeat-System-Host-overview-ECS-Elastic-1440x2048.png?v=1680890419 1440w\" sizes=\"(max-width: 1901px) 100vw, 1901px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"viewing-metrics-app-visualizations\">Viewing Metrics App Visualizations<\/h3>\n\n\n\n<p>In the side navigation, navigate to <strong>Observability &gt; Metrics<\/strong>. Under <strong>Inventory<\/strong>, you see hosts available.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1884\" height=\"869\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/metrics-inventory.png\" alt=\"\" class=\"wp-image-16068\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/metrics-inventory.png?v=1680890717 1884w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/metrics-inventory-768x354.png?v=1680890717 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/metrics-inventory-1536x708.png?v=1680890717 1536w\" sizes=\"(max-width: 1884px) 100vw, 1884px\" \/><\/figure>\n\n\n\n<p>Click on the specific host to view its metrics and open metrics as page.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1882\" height=\"2108\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/Infrastructure-Metrics-ubuntu-Kibana.png\" alt=\"\" class=\"wp-image-16069\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/Infrastructure-Metrics-ubuntu-Kibana.png?v=1680890889 1882w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/Infrastructure-Metrics-ubuntu-Kibana-768x860.png?v=1680890889 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/Infrastructure-Metrics-ubuntu-Kibana-1371x1536.png?v=1680890889 1371w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/Infrastructure-Metrics-ubuntu-Kibana-1828x2048.png?v=1680890889 1828w\" sizes=\"(max-width: 1882px) 100vw, 1882px\" \/><\/figure>\n\n\n\n<p>And that marks the end of our tutorial.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"reference\">Reference<\/h3>\n\n\n\n<p><a aria-label=\"Metricbeat quick start: installation and configuration (opens in a new tab)\" href=\"https:\/\/www.elastic.co\/guide\/en\/beats\/metricbeat\/current\/metricbeat-installation-configuration.html#metricbeat-installation-configuration\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Metricbeat quick start: installation and configuration<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"related-tutorials\">Related Tutorials<\/h3>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/monitor-system-metrics-with-tick-stack-on-ubuntu-20-04\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Monitor System Metrics with TICK Stack on Ubuntu 20.04<\/a><\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/monitor-linux-system-metrics-with-prometheus-node-exporter\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Monitor Linux System Metrics with Prometheus Node Exporter<\/a><\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/install-grafana-metrics-monitoring-tool-on-debian-9\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Install Grafana Metrics Monitoring Tool on Debian 9<\/a><\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/visualize-wordpress-user-activity-logs-on-elk-stack\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Visualize WordPress User Activity Logs on ELK Stack<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/process-and-visualize-modsecurity-logs-on-elk-stack\/\" target=\"_blank\" aria-label=\" (opens in a new tab)\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Process and Visualize ModSecurity Logs on ELK Stack<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this tutorial, you will learn how to monitor Linux system metrics with ELK Stack. ELK Stack, or if you like, Elastic stack can be<\/p>\n","protected":false},"author":3,"featured_media":16067,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[910,121,72],"tags":[2896,1852,2900,2895,2894,2901,2899,2897,2898],"class_list":["post-7286","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-elastic-stack","category-howtos","category-monitoring","tag-configure-metric-collections-with-metricbeat","tag-elk-stack","tag-elk-system-metrics","tag-install-metricbeat-centos-8","tag-install-metricbeat-ubuntu-20-04","tag-metricbeat","tag-monitor-system-metrics-with-metricbeat-and-elk","tag-setup-metricbeat-centos-8","tag-setup-metricbeat-ubuntu-20-04","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/7286"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=7286"}],"version-history":[{"count":3,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/7286\/revisions"}],"predecessor-version":[{"id":21559,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/7286\/revisions\/21559"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/16067"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=7286"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=7286"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=7286"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}