Using Filebeat as a relay


Filebeat is a popular shipping agent that can also be used as a relay when sending logs to Loom's AI Sophie

Release or Environment

Sophie standalone versions 3.4.x - 3.7.x


While we would usually prefer sending data from a every server directly to Sophie, in some cases we would want to setup a relay. Most commonly, that would be the case with older network devices and operating systems that do not support encryption.

Note: we also have a guide for setting up an Rsyslog relay

When already using Filebeat to ship logs to Sophie, doubling its role as a relay is simple and encouraged.

Start by adding the following input to the Filebeat configuration file:

- type: tcp
  max_message_size: 10MiB
  host: "localhost:{{inbound-port}}"

 Replace {{inbound-port}}  with the port you will be sending data to this server

Similar to other inputs (such as file inputs) you can add fields that will be used as hints by Sophie to determine the application, service, and source-type of the events:

- type: tcp
    loom-application: IBM-AIX

Save the configuration and restart Filebeat for the changes to take effect.

That's it! the relay is ready. Start sending the logs to the relay to see them forwarded to Sophie. The data will be wrapped by the relay in a Filebeat header.