At time of writing elastic.co
does not provide ARM builds for raspberry. This tutorial describes how to compile e.g. filebeat
and run in on Raspberry Pi3.
You'll need Git, Go (>1.8) and Python with virtualenv.
Raspian/Debian stretch
comes with Go 1.7. To get something newer you'll need to add the next version buster
to the package sources.
Add this line to /etc/apt/sources.list
http://raspbian.raspberrypi.org/raspbian/ buster main contrib non-free rpi
Make sure your /etc/apt/preferences
looks like this:
Package: *
Pin: release n=stretch
Pin-Priority: 500
Package: *
Pin: release n=buster
Pin-Priority: 10
Then update the package list:
sudo apt update
And install from buster
:
sudo apt install -t buster golang
This should get you Go 1.11 at time of writing.
Python 2.x should come preinstalled with Raspbian but you may be missing pip
and virtualenv
:
sudo apt-get install python-pip
sudo pip install virtualenv
Compiling with Go, even using a single CPU core can take a lot of memory. Update /etc/dphys-swapfile
to 1024MB instead of the default 100MB swap memory and enable it:
sudo nano /etc/dphys-swapfile
sudo dphys-swapfile setup
sudo dphys-swapfile swapon
Install Gox (Go crosscompiling) from here:
https://github.com/mitchellh/gox
Set the root path for Go package management:
export GOPATH=~/go
Get sources:
go get github.com/elastic/beats
You'll get an error message about valid targets or something, don't worry.
Goto desired beats folder:
cd ~/go/src/github.com/elastic/beats/metricbeat/
Select desired version, should match your elasticsearch backend, in my case 7.1 (note patch versions may not yield a result, so pick '7.1' instead of '7.1.1'):
git checkout 7.1
Set Gox to build for Arm, and build!
gox -osarch="linux/arm"
Run the go compiler:
GOPATH=~/go make
This wil output the executable filebeat
in the current directory, verify by running:
./filebeat -v -e
where -e
will output errors to the console instead of syslog. filebeat
will now complain about missing config file filebeat.yml
.
Copy filebeat.default.yml
and modify as required.
The fields.yml
is required to configure the index. To build run:
make python-env
make fields
mv _meta/fields.generated.yml ./fields.yml
Build the Kibana template:
make kibana
mv _meta/kibana .
Now run filebeat setup:
./filebeat setup -v -e
For some beats plugins the elasticsearch core can be supplied with addons. Assuming you're running the elastic server in a docker image named elasticsearch
install addons like this:
sudo docker exec -it elasticsearch bash
cd /opt/elasticsearch/
bin/elasticsearch-plugin install ingest-user-agent
bin/elasticsearch-plugin install ingest-geoip