os-data-into-elastic-stack

In this quick tutorial, we’ll discuss how to send OS-level metrics into Elastic Stack. As a reference, we’re going to be using an Ubuntu server here.

We’ll use Metricbeat to collect data from the Operating System and send them periodically to Elasticsearch.

If you’re interested in sending other types of data into an ES instance, we discussed JMX data and Application Logs before.

First, we need to download and install the standard Metricbeat agent – on our Ubuntu machine:

After installation, we need to configure Metricbeat to send data to Elasticsearch by modifying metricbeat.yml found at “/etc/metricbeat/” (on Ubuntu):

Then, we can customize the metrics we want to track by modifying /etc/metricbeat/modules.d/system.yml:

Finally, we’ll start our Metricbeat service:

To make sure Metricbeat is sending data to Elasticsearch, do a quick check of the indices:

Here’s what you should get:

Now, we’ll create new index from ‘Settings’ tab with pattern ‘metricbeat-*‘

Now, we’ll visualize our memory usage over time.

First, we’ll create a new search – to separate our memory metrics – on our ‘metricbeat-*‘ index with the following query with the name ‘System Memory’:

Finally, we can create a simple visualization of our memory data:

For Y-axis, choose:

For X-axis, choose Aggregation: Date Histogram

In this quick and to-the-point article, we learned how to send OS-level data into an Elastic Stack instance, using Metricbeat.