Would you like to learn how to do send Syslog messages from a Linux computer to an ElasticSearch server? In this tutorial, we are going to show you how to install Filebeat on a Linux computer and send the Syslog messages to an ElasticSearch server on a computer running Ubuntu Linux.

• Ubuntu 18
• Ubuntu 19
• ElasticSearch 7.6.2
• Kibana 7.6.2
• Filebeat 7.6.2

In our example, The ElastiSearch server IP address is

Tutorial Filebeat - Installation on Ubuntu Linux

Set a hostname using the command named hostnamectl.

Copy to Clipboard

Reboot the computer.

Copy to Clipboard

Download and install the Filebeat package.

Copy to Clipboard

Enable the Filebeat module named System.

Copy to Clipboard

Edit the Filebeat configuration file named filebeat.yml.

Copy to Clipboard

Here is the original file, before our configuration.

Copy to Clipboard

Here is the file with our configuration.

Copy to Clipboard

In our example, we configured the Filebeat server to connect to the Kibana server

In our example, we configured the Filebeat server to send data to the ElasticSearch server

Use the following command to create the Filebeat dashboards on the Kibana server.

Copy to Clipboard

Start the Filebeat service.

Copy to Clipboard

Configure the Filebeat service to start during boot time.

Copy to Clipboard

Congratulations! You have finished the Filebeat installation on Ubuntu Linux.

Kibana - Accessing the Filebeat Dashboard

Open your browser and enter the IP address of your Kibana server plus :5601.

In our example, the following URL was entered in the Browser:


The Kibana web interface should be presented

Kibana menus

On the Visualize and Explore Data area, select the Dashboard option.

Kibana dashboards

Search and access the Dashboard named: Syslog dashboard ECS

Kibana Syslog dashboard ECS

You should see the Filebeat dashboard.

Filebeat Kibana Syslog Dashboard

Congratulations! You are able to access the Filebeat information on the Kibana server.