[id="{beatname_lc}-installation-configuration"]
== {beatname_uc} quick start: installation and configuration

++++
<titleabbrev>Quick start: installation and configuration</titleabbrev>
++++

This guide describes how to get started quickly with log data collection from
systemd journals. You'll learn how to:

* install {beatname_uc} on each system you want to monitor
* specify the location of your log files
* parse log data into fields and send it to {es}
* visualize the log data in {kib}

[float]
=== Before you begin

You need {es} for storing and searching your data, and {kib} for visualizing and
managing it.

include::{libbeat-dir}/tab-widgets/spinup-stack-widget.asciidoc[]

[float]
[[install]]
=== Step 1: Install {beatname_uc}

Install {beatname_uc} on all the servers you want to monitor.

To download and install {beatname_uc}, use the commands that work with your
system:

include::{libbeat-dir}/tab-widgets/install-deb-rpm-linux-widget.asciidoc[]

[float]
[[other-installation-options]]
==== Other installation options

* <<setup-repositories,APT or YUM>>
* https://www.elastic.co/downloads/beats/{beatname_lc}[Download page] 
* <<running-on-docker,Docker>>

[float]
[[set-connection]]
=== Step 2: Connect to the {stack}

include::{libbeat-dir}/shared/connecting-to-es.asciidoc[]


[float]
[[configuration]]
=== Step 3: Configure {beatname_uc}

Before running {beatname_uc}, specify the location of the systemd journal files
and configure how you want the files to be read. If you accept the default
configuration, {beatname_uc} reads from the local journal.

. In +{beatname_lc}.yml+, specify a list of paths to your systemd journal files.
Each path can be a directory path (to collect events from all journals in a
directory), or a file path. For example:
+
["source","sh",subs="attributes"]
----
{beatname_lc}.inputs:
- paths:
  - "/dev/log"
  - "/var/log/messages/my-journal-file.journal"
  seek: head
----
+
If no paths are specified, {beatname_uc} reads from the default journal.

. Set the <<seek,`seek`>> option to control the position where
{beatname_uc} starts reading the journal. The available options are `head`,
`tail`, and `cursor`. The default is `cursor`, which means that on first read,
{beatname_uc} starts reading at the beginning of the file, but continues reading
at the last known position after a reload or restart. For more detail about
the settings, see the reference docs for the
<<seek,`seek` option>>.

. (Optional) Set the <<include-matches,`include_matches`>> option
to filter entries in journald before collecting any log events. This reduces the
number of events that {beatname_uc} needs to process. For example, to fetch only
Redis events from a Docker container tagged as `redis`, use:
+
["source","sh",subs="attributes"]
----
{beatname_lc}.inputs:
- paths: []
  include_matches:
    - "CONTAINER_TAG=redis"
    - "_COMM=redis"
----

include::{libbeat-dir}/shared/config-check.asciidoc[]

[float]
[[setup-assets]]
=== Step 4: Set up assets

{beatname_uc} comes with predefined assets for parsing, indexing, and
visualizing your data. To load these assets:

. Make sure the user specified in +{beatname_lc}.yml+ is
<<privileges-to-setup-beats,authorized to set up {beatname_uc}>>.

. From the installation directory, run:
+
--
include::{libbeat-dir}/tab-widgets/setup-deb-rpm-linux-widget.asciidoc[]
--
+
`-e` is optional and sends output to standard error instead of the configured log output.

This step loads the recommended {ref}/indices-templates.html[index template] for writing to {es}.

[TIP]
=====
A connection to {es} (or {ess}) is required to set up the initial
environment. If you're using a different output, such as {ls}, see
<<load-template-manually>>.
=====

[float]
[[start]]
=== Step 5: Start {beatname_uc}

Before starting {beatname_uc}, modify the user credentials in
+{beatname_lc}.yml+ and specify a user who is
<<privileges-to-publish-events,authorized to publish events>>.

To start {beatname_uc}, run:

// tag::start-step[]
include::{libbeat-dir}/tab-widgets/start-deb-rpm-linux-widget.asciidoc[]
// end::start-step[]

{beatname_uc} is now ready to send journal events to the {es}.

[float]
[[view-data]]
=== Step 6: View your data in {kib}

There is currently no dashboard available for {beatname_uc}. To start exploring
your data, go to the Discover app in {kib}. From there, you can submit search
queries, filter the search results, and view document data.

To learn how to build visualizations and dashboards to view your data, see the
_{kibana-ref}/index.html[{kib} User Guide]_.


[float]
=== What's next?

Now that you have your logs streaming into {es}, learn how to unify your logs,
metrics, uptime, and application performance data.

include::{libbeat-dir}/shared/obs-apps.asciidoc[]

[TIP]
====
The {logs-app} shows logs from `filebeat-*` indices by default. To show
{beatname_uc} indices, configure the source to include `journalbeat-*`. You can
do this in the {logs-app} when you configure the source, or you can modify the {kib}
configuration. For
example:

[source,yaml]
----
xpack.infra:
 sources:
   default:
     logAlias: "filebeat-*,journalbeat-*"
----
====

// Add Javascript and CSS for tabbed panels
include::{libbeat-dir}/tab-widgets/code.asciidoc[]
