Filebeat integration

Ship Atomic OSSEC / hub alert data with Filebeat into Elasticsearch, Logstash, or another Beat-compatible sink.

Note

This page replaces a prior placeholder that incorrectly duplicated hub installation steps.

Overview

  1. Install Filebeat on the hub (or on a host that can read the alert feed you want to ship).

  2. Point Filebeat inputs at the OSSEC/Atomic alert JSON or log path used in your deployment.

  3. Configure an output (Elasticsearch, Logstash, Kafka, etc.) and restart Filebeat.

Exact paths and package names depend on your hub version and packaging. Prefer the distribution Filebeat packages for your OS, then add an Atomic-specific input stanza rather than replacing the stock configuration wholesale.