Run Metricbeat on Cloud Foundry

edit

You can use Metricbeat on Cloud Foundry to retrieve and ship metrics.

Cloud Foundry credentials

edit

Metricbeat needs credentials created with UAA so it can connect to loggregator to receive the logs. The uaac command will create the required credentials for connecting to loggregator.

uaac client add metricbeat --name metricbeat --secret changeme --authorized_grant_types client_credentials,refresh_token --authorities doppler.firehose,cloud_controller.admin_read_only

Use a unique secret: The uaac command shown here is an example. Remember to replace changeme with your secret, and update the metricbeat.yml file to use your chosen secret.

Cloud Foundry deploy manifests

edit

You deploy Metricbeat as an application with no route.

Cloud Foundry requires that 3 files exist inside of a directory to allow Metricbeat to be pushed. The commands below provide the basic steps for getting it up and running.

curl -L -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-7.9.3-linux-x86_64.tar.gz
tar xzvf metricbeat-7.9.3-linux-x86_64.tar.gz
cd metricbeat-7.9.3-linux-x86_64
curl -L -O https://raw.githubusercontent.com/elastic/beats/7.9/deploy/cloudfoundry/metricbeat/metricbeat.yml
# Update api_address, client_id, client_secret in downloaded metricbeat.
curl -L -O https://raw.githubusercontent.com/elastic/beats/7.9/deploy/cloudfoundry/metricbeat/manifest.yml

Deploy

edit

To deploy Metricbeat to Cloud Foundry, run:

cf push

To check the status, run:

$ cf apps

name         requested state   instances   memory   disk   urls
metricbeat   started           1/1         256M     1G

Metrics should start flowing to Elasticsearch. The events are annotated with metadata added by the add_cloudfoundry_metadata processor.

Set shard_id to scale: By default Metricbeat will generate a random shard_id when it starts. In the case that Metricbeat needs to be scaled passed 1 instance, be sure to set a static shard_id. Not setting a static shard_id will result in duplicate events being pushed to Elasticsearch.