configuration.asciidoc

Configuration Options

The Execbeat configuration file uses YAML for its syntax. The file contains config options common to all Beats. These options are described in the following sections of the {libbeat}/configuration.html[Beats Platform Reference]:

• {libbeat}/configuration.html#configuration-shipper[Shipper]

• {libbeat}/configuration.html#configuration-output[Output]

• {libbeat}/configuration.html#configuration-logging[Logging (Optional)]

• {libbeat}/configuration.html#configuration-run-options[Run Options (Optional)]

Execbeat

The execbeat section specifies a list of commands that Execbeat calls in a scheduled fashion. Each command item begins with a dash (-) and specifies command specific configuration options.

Here is a sample configuration:

execbeat:

  commands:
    # Each - Commands to execute.
    -
      # Optional cron expression, defines when to execute the command.
      # Default is every 1 minute.
      schedule: "@every 5s"

      # The command to execute by Execbeat
      command: echo

      # Optional arguments to be passed to the command to execute
      args: "Hello Execbeat"

      # Type to be published in the 'type' field. For Elasticsearch output,
      # the type defines the document type these entries should be stored
      # in. Default: execbeat
      document_type: echo

      # Optional additional fields. These field can be freely picked
      # to add additional information
      fields:
        host: myhost

A complete example can be found in execbeat.yml

Options

schedule

Optional cron expression, defines when to execute the command. Default is every 1 minute.

schedule: @every 1m

command

The command to execute in a regular interval.

command: echo

args

Optional arguments to be passed to the command to execute.

args: "Hello World"

fields

Optional fields that you can specify to add additional information to the output. For example, you might add fields that you can use for filtering log data.

fields:
    level: debug
    review: 1

document_type

The event type to use for published lines read by harvesters. For Elasticsearch output, the value that you specify here is used to set the type field in the output document. The default value is execbeat.

document_type: mytype