Installing Event Monitoring in Talend Runtime Container
Event Monitoring are supported on all platforms which are supported for the related release of Talend Runtime.
The Event Monitoring feature is not activated by default but preinstalled in the Talend Runtime Container. It can be activated with the tesb:start-em-XXX commands. For more information, see Event Monitoring Appenders.
The primary use case is to use Event Monitoring together with Talend LogServer which brings the capabilities of Filebeat, Logstash, ElasticSearch and Kibana. However, for the pure local use case the Talend LogServer is not needed and by this optional for the use of Event Monitoring.
- Copy the Filebeat that is provided as a subfolder of the Talend LogServer distribution package to the machine where the Talend Runtime is installed.
- A default filebeat configuration file is provided with Talend Runtime, which needs to be adapted to the environment by updating the LOG_PATH in {KARAF_HOME}/etc/filebeat_em.yml to point to {KARAF_DATA}/eventmonitoring/em*.log.*
Below is an example of the filebeat_em.yml where the paths and hosts entry must be adapted to the environment. It is essential to change the localhost and port to the remote Talend LogServer host and port (Logstash Endpoint).
#======= Filebeat prospectors =======
filebeat.prospectors:
- type: log
enabled: true
paths:
- ${LOG_PATH:D:\talend\ESB\runtime\container\data\eventmonitoring\em*.log*}
fields:
app_id: ${APP_NAME:ESB}
fields_under_root: true
json.keys_under_root: true
json.message_key: log
logging.metrics.enabled: false
#------- Logstash output -------
output.logstash:
# The Logstash hosts
hosts: ["${LOGSTASH_HOSTS:localhost}:${LOGSTASH_PORT:5044}"]To start filebeat, use the following command, in which {KARAF_HOME} needs to be replaced by the absolute path to the root Talend Runtime folder in your installation.
filebeat -e -c {KARAF_HOME}/etc/filebeat_em.yml