OK, so now it's set up Metrick bait and connected to our ElasticSearch server, and it in Gravano to
set it up follows a very similar process to Volbeat.
Metrick beat is better at reading the metrics, batches of the CPU, memory disk, etc., whereas Falbe
is good for reading log files such as System Day, your web server or anything like that.
Okay, so I'm going to install Wittrock based on my Windows server so you could install metric beat
across multiple Windows servers if you wanted.
Was to one just to show you the steps.
This is my documentation, so I'm going to download Metrick from this website down here, Metrick Beats
ElasticSearch website.
I'm going to download the Windows Zip 64 bit.
I find this the easiest to use because if you use the mouse all you have to manage permissions when
you're updating the configuration file.
So I can use that one, I just download that to my computer.
Oh, open.
And now extract that to a folder somewhere on my computer, I'm going to put on the day drive.
And open when it's finished.
Very good, close to that in that right.
So open up the folder, incomes of Metrick, Big Watermill.
We edit that file.
It has a module's D folder showing which modules are available, whether they decide whether or not
you can see in metric beat, the system module is enabled by default.
Here we go.
And we can do that.
I'm using this code, so this is what it looks like.
And I put CPU Memory Network Process Statistics Canada if you want.
Anyway, so to manage metric based on Windows power, Warshel is the best use.
So let's open up our show as administrator power show run as administrator.
Very good.
OK, let's look at the folder, the lead metric wait lists never go there, the files, so to see what
modules we have, we can type metric based modules list.
And it has listed all the modules, it's like falbe emergency system is enabled by default.
I also want to enables the Windows module, which is the third copy that enabled Windows.
OK, so we can check that list again.
And if I scroll up enabled system on windows, you can always disable later on if you want to.
OK, so let's look at the metric being Wimoweh.
That the metric based configuration so similar, it looks in the modules file for AML files.
I'm not using Kobana so I can get rid of that.
I don't need to put in my elasticsearch i.p.
Which is that?
For this one, I'm not using cloud docker or Cubanos.
I'm just going to comment those out.
I will use this because the dashboard I will use at the end of the video will use some properties from
here.
So that's good processes at host metadata.
And that is good.
Safe.
Very good now to install the service on Windows so we can use his power, shall command low profile
execution policy bypassed and file the copy that will be running this fall here in our show.
And so pist, that's the whole command there.
And so that's installed.
We'll look at task manager services and find Metric Bakht.
They would go this metric beat there and it is currently stopped.
What we can do is start it if we want to.
But in my case, I'm not going to get any data arriving at myelocytic search server because my metric
based service running my windows is on a different network to most search server.
I need to whitelist the IP on my Lustick search server.
So basically to knows my IP address from the perspective of ElasticSearch server, which is on the Internet.
So this way to find that is type.
What is my IP?
And there we go so far, I go on to my ElasticSearch server and I pay tables, l I need to insert new
rule for that IP address.
OK, so the IP address was that excellent.
So my pay tables.
Well, there we go.
Number four is now accepting from.
Very good, that's been added number four there, like I said, now, that metric based service on my
windows is pushing data to the elasticsearch server.
I need to figure out what is the name of the index that the metric was using by default.
I'm on my elasticsearch server and I should look at the indices and there is new uncowed metric based
710.
With the date, I will be getting a new data source for the metric beat index here.
So open Carafano.
I like data sources.
I'm going to copy that.
You're all there, though.
Data sources at Data Source ElasticSearch, that's the euro and I'm going to call it metric based.
OK, go down index name was something like that.
And you seven 10 dot star, for example, time stamp is already correct, metric bait will create a
time stamp field version is seven plus.
Scientist, very good data source update.
So let's go to explore and select that, and I can see there is some data.
Excellent.
rawData There's quite a lot of.
It's from a Windows machine, that's the hostname there.
OK, straight away I'm going to get a dashboard from the community, the dashboard to manage.
And let's open up the Gryphon website dashboards and type in metric boot.
So this is the one that I'll use it one one five, six, seven.
Now, this is not a date.
This is a very typical working with Gryffindor and all the different components you have to bring together.
There'll be various things that are not up to date.
So I'll install this anyway and go through the process of updating it so you can see how you might want
to do that.
You can see here this was written for the final version six and ElasticSearch five, six, eight.
So it's quite a few versions ago anyway.
OK, so going into Gryffindor Ménage dashboard's import that I'd load and select the new Metrick beat
datasource the default.
That's all very good press import.
And straight away we see no data.
Plus there's a missing plug in.
I will solve the missing plug in with a pie chart first, I'm going to use the pie chart from here.
This is Gryffindor.
Final pie chart says you need to use a key ally to install it.
So, S.H., onto your Kafar server and run the fantasy CLIA plug ins in.
Stoeger, find a pie chart panel.
Very good.
Install successfully.
We now need to restart.
Restart.
OK, so we need to refresh this page.
So refresh, reload and they would go the there is no longer there but there's still a problem with
a matrix for each of these panels will resolve those.
So if we scroll down some of the matrix look like they're working.
So this is data coming from my Windows machine.
OK, so it's Metrick by sending data to the elasticsearch server and then the ElasticSearch data source,
the new one I just created is pulling that data.
OK, so we're getting some of that information already.
Let's slowly go through these panels and update them with the new changes.
So the first one I want to fix will actually be this one right up at the top.
Hostname says none.
If I go into the settings for this dashboard and press variables, this definition here is what needs
to be updated.
So instead of saying beat name keyword, I'm going to call it host dot aim and just accept that.
And straight away, down the bottom in the preview of values, I now get a new value.
So that looks to me like that's the correct query now.
So update that I go back into the dashboard and then we go hostname.
So there's only one hostname.
I've only set up one metric beat.
But if you set up lots of metric beats or point to the elasticsearch server, I would get a dropdown
and a new value for each Windows machine that you had.
So.
Next one, first one on one to fix as this bottom on hard disk used percentage it at that.
Now, the problem is usually the names of the metrics that are being polled as versions get updated,
Bafana plug ins, data sources, everything, all the different components, the names of things change.
So this is a common occurrence working out that somebody, somewhere on the journey has changed something
and you need to update it.
So just from experience, I know that system or system use per cent is already correct, but this group
by terms looks out of date for me.
It's actually no longer that you can just say you can actually just leave off the key word it so system.
Filesystem.
Dot Mount pointed that one just there and there we go, it's now showing me graphs or my see and my
day.
Now I want to see graphs for all my drives.
So that's in this bill to just you top two.
I'm just going to say no, limit me, all of them.
There we go.
Excellent.
Apply that.
And if I go back to this page, it looks much better.
Now, there are a few other things not working.
The next one looks like this C.P.U usage to me at that sort of system core or two percent.
How system thought c.p.u dot total per cent there would go.
Very good.
And in options it's saying one minus value.
I'm just going to delete that as well if it go.
I'm just going to apply that for now.
So that looks a little better.
OK, so let's look at this panel now.
CPU edit same thing system CPU total percent or a good size or a ploy going up.
These were the two pie graphs, the ones going.
First thing I want to look at is the CPU time per cent spent by processors.
Edit So down here, system processor CPU total percent, which I think is correct.
I'm just going to say this one should be called process.
It's dead and there we go.
Excellent pli that so we can now get a graph for the most busy processors on my computer over the last
five minutes.
Excellent.
I'll do this one as well.
Service used memory percentage.
Edit I think is the same problem.
It should be called processed name.
Yep, very good for that.
So this is a memory used by proper process.
It's looking pretty good already, lots of information there.
Now let's fix up these polygraph's, c.p.u of services, edit I'm think process the name and then we
go have a polygraph.
Save that or.
Excellent.
And same thing here.
It looks the same process on.
Excellent and is showing the top 10 apply.
Excellent.
It's looking pretty good.
I'm going to save that.
Very good.
And if I go to Sitting's Jason Morrow.
Or the Jason sitting in, they're going to copy and put it on my documentation for you.
So example, Windows Dashboard here on this ElasticSearch metric, big page.
This is the Jason that you can copy and import.
In there, if you want to the.
Copy and paste it and load you want to if you didn't want to do it the manual way like me, now my versions
are there five seven, three, two, elasticsearch seven, 10.
So who knows, in one or two versions from now, Kravanh or ElasticSearch or Dashboard will have problems
and need to resolve them.
So that's just typical of working with Fana and really old data sources.
The things change.
There's no warranty or no guarantees of backwards compatibility because there's just so many things
involved.
OK, so very good.
So there's quite a lot to look at there to monitor your computers over time.
Last one hour.
It's only just begun for me.
It's says quite an impressive dashboard metric by Bob ElasticSearch.
Excellent.