Filebeat Setup Command

[devinmatte]

I've noticed that after enrolling devices through puppet with filebeat, filebeat is present, the config is correct, but it doesn't start sending up logs until I have run filebeat setup manually.

Is it supposed to be run as a part of the plugin, is it intentional that it doesn't, or can a flag be added to run that as part of the install process?

[pcfens]

Is that for sending logs to elasticsearch? The module doesn't setup the structure in ES, but as I understand it, that should be a one time step for a single node (we don't send directly to ES, so I might be off on this part).

[freibuis]

filebeat setup is useless if you are using other systems like graylog. I would suggest looking at it from your storage side to make sure the types are installed or
run filebeat setup once if

• adding new filebeat modules
• a procotcol/module version has changed.
• sending logs to a newly provisioned elastic search service

I find it better to add the filebeat setup to the elastic search install manifiest as a post install process
but that means you will need to install filebeat on to that elastic search node