.travis.yml

@@ -6,10 +6,11 @@ services:
 language: go
 
 go:
-  - "1.13"
+  - 1.9
 
 os:
   - linux
+  - osx
 
 env:
   matrix:
@@ -31,8 +32,6 @@ before_install:
   - export TRAVIS_BUILD_DIR=$HOME/gopath/src/github.com/icinga/icingabeat/
   - cd $HOME/gopath/src/github.com/icinga/icingabeat/
   - go get github.com/Masterminds/glide
-  - go get github.com/magefile/mage/mg
-  - go get github.com/sirupsen/logrus
 
 install:
   - true

AUTHORS

@@ -1,4 +1,3 @@
-Alexander <35256191+lx183@users.noreply.github.com>
 Blerim Sheqa <blerim.sheqa@icinga.com>
 Dorian Lenzner <Dorian.Lenzner@telekom.de>
 Michael Friedrich <michael.friedrich@icinga.com>

CHANGELOG.md

@@ -1,47 +1,4 @@
 # Icingabeat CHANGELOG
-
-## v7.17.4
-
-### Features
-* Update libbeat to version 7.14.2
-
-### Breaking Changes
-* Dashboards now must be importaed manually using Kibana
-
-## v7.14.2
-
-### Features
-* Update libbeat to version 7.14.2
-
-## v7.5.2
-
-### Features
-* Update libbeat to version 7.5.2
-
-## v7.4.2
-
-### Features
-* Update libbeat to version 7.4.2
-
-## v6.5.4
-
-### Features
-* Update libbeat to version 6.5.4
-* Move all field names to 'icinga' namespace
-
-### Bugs
-* Prevent usage of reserved keywords
-
-## v6.3.3
-
-### Features
-* Update libbeat to version 6.3.3
-
-### Bugs
-* Remove `zones` key from statuspoller. This key may become to big to process.
-* Catch 404 return codes
-* Update dashboard directory schema so `icingabeat setup` works out of the box
-
 ## v6.1.1
 
 ### Features

Makefile

@@ -1,22 +1,53 @@
 BEAT_NAME=icingabeat
+BEAT_DIR=github.com/icinga/icingabeat
+BEAT_DESCRIPTION=Icingabeat ships Icinga 2 events and states to Elasticsearch or Logstash.
+BEAT_VENDOR=Icinga
+BEAT_DOC_URL=https://github.com/Icinga/icingabeat
 BEAT_PATH=github.com/icinga/icingabeat
-BEAT_DOC_URL?=https://icinga.com/docs/icingabeat
-BEAT_GOPATH=$(firstword $(subst :, ,${GOPATH}))
 SYSTEM_TESTS=false
 TEST_ENVIRONMENT=false
-ES_BEATS_IMPORT_PATH=github.com/elastic/beats/v7
+ES_BEATS?=./vendor/github.com/elastic/beats
-ES_BEATS?=$(shell go list -m -f '{{.Dir}}' ${ES_BEATS_IMPORT_PATH})
+GOPACKAGES=$(shell glide novendor)
-LIBBEAT_MAKEFILE=$(ES_BEATS)/libbeat/scripts/Makefile
+PREFIX?=.
-GOPACKAGES=$(shell go list ${BEAT_PATH}/... | grep -v /tools)
+
-GOBUILD_FLAGS=-i -ldflags "-X ${ES_BEATS_IMPORT_PATH}/libbeat/version.buildTime=$(NOW) -X ${ES_BEATS_IMPORT_PATH}/libbeat/version.commit=$(COMMIT_ID)"
+#TARGETS="linux/amd64 linux/386 windows/amd64 windows/386 darwin/amd64"
-MAGE_IMPORT_PATH=github.com/magefile/mage
+#PACKAGES=${BEATNAME}/deb ${BEATNAME}/rpm ${BEATNAME}/darwin ${BEATNAME}/win ${BEATNAME}/bin
-NO_COLLECT=true
+#SNAPSHOT=false
-CHECK_HEADERS_DISABLED=true
 
 # Path to the libbeat Makefile
--include $(LIBBEAT_MAKEFILE)
+-include $(ES_BEATS)/libbeat/scripts/Makefile
 
+# Initial beat setup
+.PHONY: setup
+setup: copy-vendor
+	make update
+
+# Copy beats into vendor directory
 .PHONY: copy-vendor
 copy-vendor:
-	mage vendorUpdate
+	mkdir -p vendor/github.com/elastic/
+	cp -R ${GOPATH}/src/github.com/elastic/beats vendor/github.com/elastic/
+	rm -rf vendor/github.com/elastic/beats/.git
 
+.PHONY: git-init
+git-init:
+	git init
+	git add README.md CONTRIBUTING.md
+	git commit -m "Initial commit"
+	git add LICENSE
+	git commit -m "Add the LICENSE"
+	git add .gitignore
+	git commit -m "Add git settings"
+	git add .
+	git reset -- .travis.yml
+	git commit -m "Add icingabeat"
+	git add .travis.yml
+	git commit -m "Add Travis CI"
+
+# This is called by the beats packer before building starts
+.PHONY: before-build
+before-build:
+
+# Collects all dependencies and then calls update
+.PHONY: collect
+collect:

NOTICE.txt

@@ -1 +0,0 @@
-This file only exists to make `make package` happy.

README.md

@@ -25,7 +25,7 @@ for more information
 
 #### Requirements
 
-* [Golang](https://golang.org/dl/) 1.16
+* [Golang](https://golang.org/dl/) 1.9
 
 #### Clone
 
@@ -47,7 +47,7 @@ To build the binary for Icingabeat run the command below. This will generate a
 binary in the same directory with the name icingabeat.
 
 ```shell
-mage build
+make
 ```
 
 #### Run
@@ -57,6 +57,49 @@ To run Icingabeat with debugging output enabled, run:
 ./icingabeat -c icingabeat.yml -e -d "*"
 ```
 
+#### Test
+
+To test Icingabeat, run the following command:
+
+```shell
+make testsuite
+```
+
+alternatively:
+```shell
+make unit-tests
+make system-tests
+make integration-tests
+make coverage-report
+```
+
+The test coverage is reported in the folder `./build/coverage/`
+
+#### Update
+
+Each beat has a template for the mapping in elasticsearch and a documentation
+for the fields which is automatically generated based on `etc/fields.yml`.
+To generate etc/icingabeat.template.json and etc/icingabeat.asciidoc
+
+```shell
+make update
+```
+
+#### Cleanup
+
+To clean  Icingabeat source code, run the following commands:
+
+```shell
+make fmt
+make simplify
+```
+
+To clean up the build directory and generated artifacts, run:
+
+```shell
+make clean
+```
+
 ### Packaging
 
 The beat frameworks provides tools to crosscompile and package your beat for
@@ -65,9 +108,35 @@ vendoring as described above. To build packages of your beat, run the following
 command:
 
 ```shell
-export PLATFORMS="linux/amd64 linux/386"
+make package
-mage package
 ```
 
 This will fetch and create all images required for the build process. The whole
 process can take several minutes to finish.
+
+To disable snapshot packages or build specific packages, set the following
+environment variables:
+
+```shell
+export SNAPSHOT=false
+export TARGETS="\"linux/amd64 linux/386\""
+export PACKAGES=icingabeat/deb
+make package
+```
+
+#### Dashboards
+To be able to export dashboards with all their dependencies (visualizations and
+searches) you have to name the dashboard with a `icingabeat-` prefix.
+
+Export dashboards:
+```shell
+export ES_URL=http://127.0.0.1:9200
+make export-dashboards
+```
+
+After exporting, dashboards can be packaged:
+
+```shell
+export SNAPSHOT=false
+make package-dashboards
+```

RELEASE.md

@@ -14,7 +14,14 @@ git commit -am "Update AUTHORS"
 ## 2. Changelog
 Update [CHANGELOG.md] with all relevant information.
 
-## 3. Build
+## 3. Version
+Version numbers are incremented regarding the [SemVer 1.0.0] specification. 
+Update the version number in the following files:
+
+* `version.yml`
+* `vendor/github.com/elastic/beats/dev-tools/packer/version.yml`
+
+## 4. Build
 Build packages:
 
 ``` bash
@@ -29,7 +36,7 @@ export SNAPSHOT=false
 make package-dashboards
 ```
 
-## 4. Git Tag
+## 5. Git Tag
 Commit all changes to the `master` branch
 
 ``` bash
@@ -49,6 +56,7 @@ Push tags
 git push --tags
 ```
 
+[SemVer 1.0.0]: http://semver.org/spec/v1.0.0.html
 [CHANGELOG.md]: CHANGELOG.md
 [AUTHORS]: AUTHORS
 [.mailmap]: .mailmap

_meta/config/beat.yml.tmpl

@@ -1,73 +0,0 @@
-################### Icingabeat Configuration Example #########################
-
-############################# Icingabeat ######################################
-
-icingabeat:
-
-  # Defines the Icinga API endpoint
-  host: "localhost"
-
-  # Defines the port of the API endpoint
-  port: 5665
-
-  # A user with sufficient permissions
-  user: "icinga"
-
-  # Password of the user
-  password: "icinga"
-
-  # Configure SSL verification. If `false` is configured, all server hosts
-  # and certificates will be accepted. In this mode, SSL based connections are
-  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
-  # `true`.
-  ssl.verify: true
-
-  # List of root certificates for HTTPS server verifications
-  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
-
-  ########################### Icingabeat Eventstream ##########################
-  #
-  # Icingabeat supports capturing of an evenstream and periodical polling of the
-  # Icinga status data.
-
-  # Decide which events to receive from the event stream.
-  # The following event stream types are available:
-  #
-  # * CheckResult
-  # * StateChange
-  # * Notification
-  # * AcknowledgementSet
-  # * AcknowledgementCleared
-  # * CommentAdded
-  # * CommentRemoved
-  # * DowntimeAdded
-  # * DowntimeRemoved
-  # * DowntimeStarted
-  # * DowntimeTriggered
-  #
-  # To disable eventstream, leave the types empty or comment out the option
-  eventstream.types:
-    - CheckResult
-    - StateChange
-
-  # Event streams can be filtered by attributes using the prefix 'event.'
-  #
-  # Example for the CheckResult type with the exit_code set to 2:
-  # filter: "event.check_result.exit_status==2"
-  #
-  # Example for the CheckResult type with the service matching the string
-  # pattern "mysql*":
-  # filter: 'match("mysql*", event.service)'
-  #
-  # To disable filtering set an empty string or comment out the filter option
-  eventstream.filter: ""
-
-    # Defines how fast to reconnect to the API on connection loss
-  eventstream.retry_interval: 10s
-
-  ########################### Icingabeat Statuspoller #########################
-  #
-  # Icingabeat can collect status information about Icinga 2 periodically. Set
-  # an interval at which the status API should be called. Set to 0 to disable
-  # polling.
-  statuspoller.interval: 60s

_meta/fields.generated.yml

@@ -0,0 +1,687 @@
+- key: icingabeat
+  title: icingabeat
+  description: Data received from the Icinga 2 API
+  fields:
+    - name: timestamp
+      type: date
+      description: >
+        Timestamp of event occurrence
+
+    - name: type
+      type: keyword
+      description: >
+        Type of the document
+
+    - name: host
+      type: keyword
+      description: >
+        Host that triggered the event
+
+    - name: service
+      type: keyword
+      description: >
+        Service that triggered the event
+
+    - name: state
+      type: integer
+      description: >
+        State of the check
+
+    - name: state_type
+      type: integer
+      description: >
+        State type of the check
+
+    - name: author
+      type: keyword
+      description: >
+        Author of a message
+
+    - name: notification_type
+      type: keyword
+      description: >
+        Type of notification
+
+    - name: text
+      type: text
+      description: >
+        Text of a message
+
+    - name: users
+      type: keyword
+      description: >
+        Affected users of a notification
+
+    - name: acknowledgement_type
+      type: integer
+      description: >
+        Type of an acknowledgement
+
+    - name: expiry
+      type: date
+      description: >
+        Expiry of an acknowledgement
+
+    - name: notify
+      type: keyword
+      description: >
+        If has been sent out
+
+    - name: check_result.active
+      type: boolean
+      description: >
+        If check was active or passive
+
+    - name: check_result.check_source
+      type: keyword
+      description: >
+        Icinga instance that scheduled the check
+
+    - name: check_result.command
+      type: text
+      description: >
+        Command that was executed
+
+    - name: check_result.execution_end
+      type: date
+      description: >
+        Time when execution of check ended
+
+    - name: check_result.execution_start
+      type: date
+      description: >
+        Time when execution of check started
+
+    - name: check_result.exit_status
+      type: integer
+      description: >
+        Exit status
+
+    - name: check_result.output
+      type: text
+      description: >
+        Output of check
+
+    - name: check_result.performance_data
+      type: text
+      description: >
+        Performance data in text format
+
+    - name: check_result.schedule_end
+      type: date
+      description: >
+        Time when scheduling of the check ended
+
+    - name: check_result.schedule_start
+      type: date
+      description: >
+        Time when check was scheduled
+
+    - name: check_result.state
+      type: integer
+      description: >
+        State of the check
+
+    - name: check_result.type
+      type: keyword
+      description: >
+        Type of this event
+
+    - name: check_result.vars_after.attempt
+      type: integer
+      description: >
+        Check attempt after check execution
+
+    - name: check_result.vars_after.reachable
+      type: boolean
+      description: >
+        Reachable state after check execution
+
+    - name: check_result.vars_after.state
+      type: integer
+      description: >
+        State of the check after execution
+
+    - name: check_result.vars_after.state_type
+      type: integer
+      description: >
+        State type after execution
+
+    - name: check_result.vars_before.attempt
+      type: integer
+      description: >
+        Check attempt before check execution
+
+    - name: check_result.vars_before.reachable
+      type: boolean
+      description: >
+        Reachable state before check execution
+
+    - name: check_result.vars_before.state
+      type: integer
+      description: >
+        Check state before check execution
+
+    - name: check_result.vars_before.state_type
+      type: integer
+      description: >
+        State type before check execution
+
+    - name: comment.__name
+      type: text
+      description: >
+        Unique identifier of a comment
+
+    - name: comment.author
+      type: keyword
+      description: >
+        Author of a comment
+
+    - name: comment.entry_time
+      type: date
+      description: >
+        Entry time of a comment
+
+    - name: comment.entry_type
+      type: integer
+      description: >
+        Entry type of a comment
+
+    - name: comment.expire_time
+      type: date
+      description: >
+        Expire time of a comment
+
+    - name: comment.host_name
+      type: keyword
+      description: >
+        Host name of a comment
+
+    - name: comment.legacy_id
+      type: integer
+      description: >
+        Legacy ID of a comment
+
+    - name: comment.name
+      type: keyword
+      description: >
+        Identifier of a comment
+
+    - name: comment.package
+      type: keyword
+      description: >
+        Config package of a comment
+
+    - name: comment.service_name
+      type: keyword
+      description: >
+        Service name of a comment
+
+    - name: comment.templates
+      type: text
+      description: >
+        Templates used by a comment
+
+    - name: comment.text
+      type: text
+      description: >
+        Text of a comment
+
+    - name: comment.type
+      type: keyword
+      description: >
+        Comment type
+
+    - name: comment.version
+      type: keyword
+      description: >
+        Config version of comment object
+
+    - name: comment.zone
+      type: keyword
+      description: >
+        Zone where comment was generated
+
+    - name: downtime.__name
+      type: text
+      description: >
+        Unique identifier of a downtime
+
+    - name: downtime.author
+      type: keyword
+      description: >
+        Author of a downtime
+
+    - name: downtime.comment
+      type: text
+      description: >
+        Text of a downtime
+
+    - name: downtime.config_owner
+      type: text
+      description: >
+        Config owner
+
+    - name: downtime.duration
+      type: integer
+      description: >
+        Duration of a downtime
+
+    - name: downtime.end_time
+      type: date
+      description: >
+        Timestamp of downtime end
+
+    - name: downtime.entry_time
+      type: date
+      description: >
+        Timestamp when downtime was created
+
+    - name: downtime.fixed
+      type: boolean
+      description: >
+        If downtime is fixed or flexible
+
+    - name: downtime.host_name
+      type: keyword
+      description: >
+        Hostname of a downtime
+
+    - name: downtime.legacy_id
+      type: integer
+      description: >
+        The integer ID of a downtime
+
+    - name: downtime.name
+      type: keyword
+      description: >
+        Downtime config identifier
+
+    - name: downtime.package
+      type: keyword
+      description: >
+        Configuration package of downtime
+
+    - name: downtime.scheduled_by
+      type: text
+      description: >
+        By whom downtime was scheduled
+
+    - name: downtime.service_name
+      type: keyword
+      description: >
+        Service name of a downtime
+
+    - name: downtime.start_time
+      type: date
+      description: >
+        Timestamp when downtime starts
+
+    - name: downtime.templates
+      type: text
+      description: >
+        Templates used by this downtime
+
+    - name: downtime.trigger_time
+      type: date
+      description: >
+        Timestamp when downtime was triggered
+
+    - name: downtime.triggered_by
+      type: text
+      description: >
+        By whom downtime was triggered
+
+    - name: downtime.triggers
+      type: text
+      description: >
+        Downtime triggers
+
+    - name: downtime.type
+      type: keyword
+      description: >
+        Downtime type
+
+    - name: downtime.version
+      type: keyword
+      description: >
+        Config version of downtime
+
+    - name: downtime.was_cancelled
+      type: boolean
+      description: >
+        If downtime was cancelled
+
+    - name: downtime.zone
+      type: keyword
+      description: >
+        Zone of downtime
+
+    - name: status.active_host_checks
+      type: integer
+      description: >
+        Active host checks
+
+
+    - name: status.active_host_checks_15min
+      type: integer
+      description: >
+        Active host checks in the last 15 minutes
+
+
+    - name: status.active_host_checks_1min
+      type: integer
+      description: >
+        Acitve host checks in the last minute
+
+
+    - name: status.active_host_checks_5min
+      type: integer
+      description: >
+        Active host checks in the last 5 minutes
+
+
+    - name: status.active_service_checks
+      type: integer
+      description: >
+        Active service checks
+
+    - name: status.active_service_checks_15min
+      type: integer
+      description: >
+        Active service checks in the last 15 minutes
+
+    - name: status.active_service_checks_1min
+      type: integer
+      description: >
+        Active service checks in the last minute
+
+    - name: status.active_service_checks_5min
+      type: integer
+      description: >
+        Active service checks in the last 5 minutes
+
+    - name: status.api.identity
+      type: keyword
+      description: >
+        API identity
+
+    - name: status.api.num_conn_endpoints
+      type: integer
+      description: >
+        Number of connected endpoints
+
+    - name: status.api.num_endpoints
+      type: integer
+      description: >
+        Total number of endpoints
+
+    - name: status.api.num_not_conn_endpoints
+      type: integer
+      description: >
+        Number of not connected endpoints
+
+    - name: status.api.zones.demo.client_log_lag
+      type: integer
+      description: >
+        Lag of the replaylog
+
+    - name: status.api.zones.demo.connected
+      type: boolean
+      description: >
+        Zone connected
+
+    - name: status.api.zones.demo.endpoints
+      type: text
+      description: >
+        Endpoint names
+
+    - name: status.api.zones.demo.parent_zone
+      type: keyword
+      description: >
+        Parent zone
+
+    - name: status.avg_execution_time
+      type: integer
+      description: >
+        Average execution time of checks
+
+    - name: status.avg_latency
+      type: integer
+      description: >
+        Average latency time
+
+    - name: status.checkercomponent.checker.idle
+      type: integer
+      description: >
+        Idle checks
+
+    - name: status.checkercomponent.checker.pending
+      type: integer
+      description: >
+        Pending checks
+
+    - name: status.filelogger.main-log
+      type: integer
+      description: >
+        Mainlog enabled
+
+    - name: status.icingaapplication.app.enable_event_handlers
+      type: boolean
+      description: >
+        Event handlers enabled
+
+    - name: status.icingaapplication.app.enable_flapping
+      type: boolean
+      description: >
+        Flapping detection enabled
+
+    - name: status.icingaapplication.app.enable_host_checks
+      type: boolean
+      description: >
+        Host checks enabled
+
+    - name: status.icingaapplication.app.enable_notifications
+      type: boolean
+      description: >
+        Notifications enabled
+
+    - name: status.icingaapplication.app.enable_perfdata
+      type: boolean
+      description: >
+        Perfdata enabled
+
+    - name: status.icingaapplication.app.enable_service_checks
+      type: boolean
+      description: >
+        Service checks enabled
+
+    - name: status.icingaapplication.app.node_name
+      type: keyword
+      description: >
+        Node name
+
+    - name: status.icingaapplication.app.pid
+      type: integer
+      description: >
+        PID
+
+    - name: status.icingaapplication.app.program_start
+      type: integer
+      description: >
+        Time when Icinga started
+
+    - name: status.icingaapplication.app.version
+      type: keyword
+      description: >
+        Version
+
+    - name: status.idomysqlconnection.ido-mysql.connected
+      type: boolean
+      description: >
+        IDO connected
+
+    - name: status.idomysqlconnection.ido-mysql.instance_name
+      type: keyword
+      description: >
+        IDO Instance name
+
+    - name: status.idomysqlconnection.ido-mysql.query_queue_items
+      type: integer
+      description: >
+        IDO query items in the queue
+
+    - name: status.idomysqlconnection.ido-mysql.version
+      type: keyword
+      description: >
+        IDO schema version
+
+    - name: status.max_execution_time
+      type: integer
+      description: >
+        Max execution time
+
+    - name: status.max_latency
+      type: integer
+      description: >
+        Max latency
+
+    - name: status.min_execution_time
+      type: integer
+      description: >
+        Min execution time
+
+    - name: status.min_latency
+      type: integer
+      description: >
+        Min latency
+
+    - name: status.notificationcomponent.notification
+      type: integer
+      description: >
+        Notification
+
+    - name: status.num_hosts_acknowledged
+      type: integer
+      description: >
+        Amount of acknowledged hosts
+
+    - name: status.num_hosts_down
+      type: integer
+      description: >
+        Amount of down hosts
+
+    - name: status.num_hosts_flapping
+      type: integer
+      description: >
+        Amount of flapping hosts
+
+    - name: status.num_hosts_in_downtime
+      type: integer
+      description: >
+        Amount of hosts in downtime
+
+    - name: status.num_hosts_pending
+      type: integer
+      description: >
+        Amount of pending hosts
+
+    - name: status.num_hosts_unreachable
+      type: integer
+      description: >
+        Amount of unreachable hosts
+
+    - name: status.num_hosts_up
+      type: integer
+      description: >
+        Amount of hosts in up state
+
+    - name: status.num_services_acknowledged
+      type: integer
+      description: >
+        Amount of acknowledged services
+
+    - name: status.num_services_critical
+      type: integer
+      description: >
+        Amount of critical services
+
+    - name: status.num_services_flapping
+      type: integer
+      description: >
+        Amount of flapping services
+
+    - name: status.num_services_in_downtime
+      type: integer
+      description: >
+        Amount of services in downtime
+
+    - name: status.num_services_ok
+      type: integer
+      description: >
+        Amount of services in ok state
+
+    - name: status.num_services_pending
+      type: integer
+      description: >
+        Amount of pending services
+
+    - name: status.num_services_unknown
+      type: integer
+      description: >
+        Amount of unknown services
+
+    - name: status.num_services_unreachable
+      type: integer
+      description: >
+        Amount of unreachable services
+
+    - name: status.num_services_warning
+      type: integer
+      description: >
+        Amount of services in warning state
+
+    - name: status.passive_host_checks
+      type: integer
+      description: >
+        Amount of passive host checks
+
+    - name: status.passive_host_checks_15min
+      type: integer
+      description: >
+        Amount of passive host checks in the last 15 minutes
+
+    - name: status.passive_host_checks_1min
+      type: integer
+      description: >
+        Amount of passive host checks in the last minute
+
+    - name: status.passive_host_checks_5min
+      type: integer
+      description: >
+        Amount of passive host checks in the last 5 minutes
+
+    - name: status.passive_service_checks
+      type: integer
+      description: >
+        Amount of passive service checks
+
+    - name: status.passive_service_checks_15min
+      type: integer
+      description: >
+        Amount of passive service checks in the last 15 minutes
+
+    - name: status.passive_service_checks_1min
+      type: integer
+      description: >
+        Amount of passive service checks in the last minute
+
+    - name: status.passive_service_checks_5min
+      type: integer
+      description: >
+        Amount of passive service checks in the last 5 minutes
+
+    - name: status.uptime
+      type: integer
+      description: >
+        Uptime

_meta/fields.yml

@@ -1,15 +1,6 @@
 - key: icingabeat
   title: icingabeat
   description: Data received from the Icinga 2 API
-  fields:
-
-    - name: type
-      type: keyword
-      description: >
-        Type of the document
-
-    - name: icinga
-      type: group
   fields:
     - name: timestamp
       type: date
@@ -131,11 +122,6 @@
       description: >
         State of the check
 
-        - name: check_result.ttl
-          type: integer
-          description: >
-            TTL, only valid if passive check
-
     - name: check_result.type
       type: keyword
       description: >
@@ -435,6 +421,26 @@
       description: >
         Number of not connected endpoints
 
+    - name: status.api.zones.demo.client_log_lag
+      type: integer
+      description: >
+        Lag of the replaylog
+
+    - name: status.api.zones.demo.connected
+      type: boolean
+      description: >
+        Zone connected
+
+    - name: status.api.zones.demo.endpoints
+      type: text
+      description: >
+        Endpoint names
+
+    - name: status.api.zones.demo.parent_zone
+      type: keyword
+      description: >
+        Parent zone
+
     - name: status.avg_execution_time
       type: integer
       description: >

_meta/kibana/dashboard/720f2f20-0979-11e7-a4dd-e96fa284b426.json

@@ -0,0 +1,13 @@
+{
+  "hits": 0, 
+  "timeRestore": false, 
+  "description": "", 
+  "title": "icingabeat-checkresults", 
+  "uiStateJSON": "{}", 
+  "panelsJSON": "[{\"size_x\":12,\"size_y\":3,\"panelIndex\":1,\"type\":\"visualization\",\"id\":\"9631be10-0977-11e7-a4dd-e96fa284b426\",\"col\":1,\"row\":1},{\"size_x\":3,\"size_y\":6,\"panelIndex\":2,\"type\":\"visualization\",\"id\":\"d50bb810-0978-11e7-a4dd-e96fa284b426\",\"col\":1,\"row\":4},{\"size_x\":4,\"size_y\":6,\"panelIndex\":3,\"type\":\"visualization\",\"id\":\"df437df0-0977-11e7-a4dd-e96fa284b426\",\"col\":4,\"row\":4},{\"size_x\":5,\"size_y\":6,\"panelIndex\":4,\"type\":\"visualization\",\"id\":\"cf643aa0-0977-11e7-a4dd-e96fa284b426\",\"col\":8,\"row\":4}]", 
+  "optionsJSON": "{\"darkTheme\":false}", 
+  "version": 1, 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}}}]}"
+  }
+}

_meta/kibana/dashboard/92a6ffd0-0b1b-11e7-bf8f-1bd67e3b1cd2.json

@@ -0,0 +1,13 @@
+{
+  "hits": 0, 
+  "timeRestore": false, 
+  "description": "", 
+  "title": "icingabeat-notifications", 
+  "uiStateJSON": "{}", 
+  "panelsJSON": "[{\"size_x\":12,\"size_y\":2,\"panelIndex\":1,\"type\":\"visualization\",\"id\":\"face9fb0-0b1a-11e7-ad60-c7e10cd34b29\",\"col\":1,\"row\":1},{\"size_x\":3,\"size_y\":2,\"panelIndex\":2,\"type\":\"visualization\",\"id\":\"e3813340-0b1a-11e7-ad60-c7e10cd34b29\",\"col\":1,\"row\":3},{\"size_x\":3,\"size_y\":2,\"panelIndex\":3,\"type\":\"visualization\",\"id\":\"cf7c1400-0b1a-11e7-ad60-c7e10cd34b29\",\"col\":4,\"row\":3},{\"size_x\":3,\"size_y\":2,\"panelIndex\":4,\"type\":\"visualization\",\"id\":\"d8a29b80-0b1a-11e7-ad60-c7e10cd34b29\",\"col\":7,\"row\":3},{\"size_x\":3,\"size_y\":2,\"panelIndex\":5,\"type\":\"visualization\",\"id\":\"6a6a66b0-0b1b-11e7-ad60-c7e10cd34b29\",\"col\":10,\"row\":3},{\"size_x\":12,\"size_y\":5,\"panelIndex\":6,\"type\":\"search\",\"id\":\"9b1ca350-0b1a-11e7-ad60-c7e10cd34b29\",\"col\":1,\"row\":5,\"columns\":[\"host\",\"service\",\"notification_type\",\"text\",\"users\"],\"sort\":[\"@timestamp\",\"desc\"]}]", 
+  "optionsJSON": "{\"darkTheme\":false}", 
+  "version": 1, 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}}}]}"
+  }
+}

_meta/kibana/dashboard/ddf406a0-098f-11e7-a9c5-0f8cefa46ead.json

@@ -0,0 +1,13 @@
+{
+  "hits": 0, 
+  "timeRestore": false, 
+  "description": "", 
+  "title": "icingabeat-status", 
+  "uiStateJSON": "{}", 
+  "panelsJSON": "[{\"col\":1,\"id\":\"bef57c00-098c-11e7-85fa-5daf7284b188\",\"panelIndex\":1,\"row\":1,\"size_x\":4,\"size_y\":2,\"type\":\"visualization\"},{\"col\":9,\"id\":\"1b2324e0-0993-11e7-a836-f12bdc7df120\",\"panelIndex\":5,\"row\":3,\"size_x\":4,\"size_y\":2,\"type\":\"visualization\"},{\"col\":1,\"id\":\"47061440-0994-11e7-828e-2b8b7d3da4e9\",\"panelIndex\":6,\"row\":3,\"size_x\":4,\"size_y\":2,\"type\":\"visualization\"},{\"col\":5,\"id\":\"7bf45770-0994-11e7-862d-53e4526068ac\",\"panelIndex\":7,\"row\":3,\"size_x\":4,\"size_y\":2,\"type\":\"visualization\"},{\"col\":9,\"id\":\"bdd29b50-0996-11e7-862d-53e4526068ac\",\"panelIndex\":8,\"row\":5,\"size_x\":4,\"size_y\":2,\"type\":\"visualization\"},{\"col\":5,\"id\":\"dfb21700-0a63-11e7-a96b-35f342c9d63d\",\"panelIndex\":9,\"row\":5,\"size_x\":4,\"size_y\":2,\"type\":\"visualization\"},{\"col\":1,\"id\":\"4326e7c0-0a64-11e7-a96b-35f342c9d63d\",\"panelIndex\":10,\"row\":5,\"size_x\":4,\"size_y\":2,\"type\":\"visualization\"},{\"col\":5,\"id\":\"45556270-0b12-11e7-ad60-c7e10cd34b29\",\"panelIndex\":11,\"row\":1,\"size_x\":2,\"size_y\":2,\"type\":\"visualization\"},{\"col\":7,\"id\":\"e7912c50-0b11-11e7-ad60-c7e10cd34b29\",\"panelIndex\":12,\"row\":1,\"size_x\":3,\"size_y\":2,\"type\":\"visualization\"},{\"col\":10,\"id\":\"27ed7600-0b12-11e7-ad60-c7e10cd34b29\",\"panelIndex\":13,\"row\":1,\"size_x\":3,\"size_y\":2,\"type\":\"visualization\"}]", 
+  "optionsJSON": "{\"darkTheme\":false}", 
+  "version": 1, 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}}}]}"
+  }
+}

_meta/kibana/default/dashboard/Icingabeat-CheckRestuls.json

@@ -0,0 +1,114 @@
+{
+  "objects": [
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
+        },
+        "savedSearchId": "eb7896b0-e4bd-11e7-b4d1-8383451ae5a4",
+        "title": "CheckResults by State",
+        "uiStateJSON": "{\"vis\":{\"colors\":{\"Ok\":\"#629E51\",\"Warning\":\"#E5AC0E\",\"Critical\":\"#BF1B00\",\"Unknown\":\"#962D82\"}}}",
+        "version": 1,
+        "visState": "{\"title\":\"CheckResults by State\",\"type\":\"histogram\",\"params\":{\"type\":\"histogram\",\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"histogram\",\"mode\":\"stacked\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"group\",\"params\":{\"filters\":[{\"input\":{\"query\":\"check_result.state:0\"},\"label\":\"Ok\"},{\"input\":{\"query\":\"check_result.state:1\"},\"label\":\"Warning\"},{\"input\":{\"query\":\"check_result.state:3\"},\"label\":\"Critical\"},{\"input\":{\"query\":\"check_result.state:4\"},\"label\":\"Unknown\"}]}}]}"
+      },
+      "id": "a32bdf10-e4be-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:36.094Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
+        },
+        "savedSearchId": "eb7896b0-e4bd-11e7-b4d1-8383451ae5a4",
+        "title": "CheckResult Count",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"CheckResult Count\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"CheckResults received\"}}]}"
+      },
+      "id": "3bf26530-e4be-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:36.094Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
+        },
+        "savedSearchId": "eb7896b0-e4bd-11e7-b4d1-8383451ae5a4",
+        "title": "Hosts Tag Cloud",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Hosts Tag Cloud\",\"type\":\"tagcloud\",\"params\":{\"scale\":\"linear\",\"orientation\":\"single\",\"minFontSize\":18,\"maxFontSize\":72},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"host\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Hosts\"}}]}"
+      },
+      "id": "4a9d5c50-e4c0-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:36.094Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
+        },
+        "savedSearchId": "eb7896b0-e4bd-11e7-b4d1-8383451ae5a4",
+        "title": "Services Tag Cloud",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Services Tag Cloud\",\"type\":\"tagcloud\",\"params\":{\"scale\":\"linear\",\"orientation\":\"single\",\"minFontSize\":18,\"maxFontSize\":72},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"service\",\"size\":500,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Services\"}}]}"
+      },
+      "id": "6a23e300-e4c0-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:36.094Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "columns": [
+          "_source"
+        ],
+        "description": "",
+        "hits": 0,
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\n  \"index\": \"icingabeat-*\",\n  \"highlightAll\": true,\n  \"version\": true,\n  \"query\": {\n    \"language\": \"lucene\",\n    \"query\": \"type:icingabeat.event.checkresult\"\n  },\n  \"filter\": []\n}"
+        },
+        "sort": [
+          "@timestamp",
+          "desc"
+        ],
+        "title": "CheckResults",
+        "version": 1
+      },
+      "id": "eb7896b0-e4bd-11e7-b4d1-8383451ae5a4",
+      "type": "search",
+      "updated_at": "2017-12-27T07:51:40.826Z",
+      "version": 2
+    },
+    {
+      "attributes": {
+        "description": "Summary of check results received by Icinga",
+        "hits": 0,
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[],\"highlightAll\":true,\"version\":true}"
+        },
+        "optionsJSON": "{\"darkTheme\":false,\"useMargins\":true,\"hidePanelTitles\":false}",
+        "panelsJSON": "[{\"panelIndex\":\"1\",\"gridData\":{\"x\":0,\"y\":0,\"w\":12,\"h\":2,\"i\":\"1\"},\"version\":\"6.1.0\",\"type\":\"visualization\",\"id\":\"a32bdf10-e4be-11e7-b4d1-8383451ae5a4\"},{\"panelIndex\":\"2\",\"gridData\":{\"x\":0,\"y\":2,\"w\":3,\"h\":5,\"i\":\"2\"},\"version\":\"6.1.0\",\"type\":\"visualization\",\"id\":\"3bf26530-e4be-11e7-b4d1-8383451ae5a4\"},{\"panelIndex\":\"3\",\"gridData\":{\"x\":3,\"y\":2,\"w\":4,\"h\":5,\"i\":\"3\"},\"version\":\"6.1.0\",\"type\":\"visualization\",\"id\":\"4a9d5c50-e4c0-11e7-b4d1-8383451ae5a4\"},{\"panelIndex\":\"4\",\"gridData\":{\"x\":7,\"y\":2,\"w\":5,\"h\":5,\"i\":\"4\"},\"version\":\"6.1.0\",\"type\":\"visualization\",\"id\":\"6a23e300-e4c0-11e7-b4d1-8383451ae5a4\"}]",
+        "timeRestore": false,
+        "title": "Icingabeat-CheckResults",
+        "uiStateJSON": "{}",
+        "version": 1
+      },
+      "id": "34e97340-e4ce-11e7-b4d1-8383451ae5a4",
+      "type": "dashboard",
+      "updated_at": "2017-12-27T07:40:36.094Z",
+      "version": 1
+    }
+  ],
+  "version": "6.1.0"
+}

_meta/kibana/default/dashboard/Icingabeat-Notifications.json

@@ -0,0 +1,134 @@
+{
+  "objects": [
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"lucene\",\"query\":\"\"}}"
+        },
+        "savedSearchId": "fa782860-e4bd-11e7-b4d1-8383451ae5a4",
+        "title": "Notification Types",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Notification Types\",\"type\":\"histogram\",\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"legendPosition\":\"right\",\"seriesParams\":[{\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"mode\":\"stacked\",\"show\":\"true\",\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"times\":[],\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"Count\"},\"type\":\"value\"}]},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"notification_type\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}]}"
+      },
+      "id": "af54ac40-e4cd-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:37.107Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
+        },
+        "savedSearchId": "fa782860-e4bd-11e7-b4d1-8383451ae5a4",
+        "title": "Notification Types (Pie)",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Notification Types (Pie)\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"notification_type\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}]}"
+      },
+      "id": "caabba10-e4cd-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:37.107Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\n  \"filter\": [],\n  \"query\": {\n    \"query\": \"\",\n    \"language\": \"lucene\"\n  }\n}"
+        },
+        "savedSearchId": "fa782860-e4bd-11e7-b4d1-8383451ae5a4",
+        "title": "Notification Services",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\n  \"title\": \"Notification Services\",\n  \"type\": \"pie\",\n  \"params\": {\n    \"type\": \"pie\",\n    \"addTooltip\": true,\n    \"addLegend\": true,\n    \"legendPosition\": \"right\",\n    \"isDonut\": true,\n    \"labels\": {\n      \"show\": false,\n      \"values\": true,\n      \"last_level\": true,\n      \"truncate\": 100\n    }\n  },\n  \"aggs\": [\n    {\n      \"id\": \"1\",\n      \"enabled\": true,\n      \"type\": \"count\",\n      \"schema\": \"metric\",\n      \"params\": {}\n    },\n    {\n      \"id\": \"2\",\n      \"enabled\": true,\n      \"type\": \"terms\",\n      \"schema\": \"segment\",\n      \"params\": {\n        \"field\": \"service\",\n        \"size\": 5,\n        \"order\": \"desc\",\n        \"orderBy\": \"1\"\n      }\n    }\n  ]\n}"
+      },
+      "id": "fcb31150-e4ca-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:56:13.974Z",
+      "version": 2
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
+        },
+        "savedSearchId": "fa782860-e4bd-11e7-b4d1-8383451ae5a4",
+        "title": "Notification Hosts",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Notification Hosts\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"host\",\"size\":500,\"order\":\"desc\",\"orderBy\":\"1\"}}]}"
+      },
+      "id": "e5a012a0-e4c6-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:56:02.651Z",
+      "version": 3
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\n  \"filter\": [],\n  \"query\": {\n    \"query\": \"\",\n    \"language\": \"lucene\"\n  }\n}"
+        },
+        "savedSearchId": "fa782860-e4bd-11e7-b4d1-8383451ae5a4",
+        "title": "Notifications by User",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\n  \"title\": \"Notifications by User\",\n  \"type\": \"pie\",\n  \"params\": {\n    \"type\": \"pie\",\n    \"addTooltip\": true,\n    \"addLegend\": true,\n    \"legendPosition\": \"right\",\n    \"isDonut\": true,\n    \"labels\": {\n      \"show\": false,\n      \"values\": true,\n      \"last_level\": true,\n      \"truncate\": 100\n    }\n  },\n  \"aggs\": [\n    {\n      \"id\": \"1\",\n      \"enabled\": true,\n      \"type\": \"count\",\n      \"schema\": \"metric\",\n      \"params\": {}\n    },\n    {\n      \"id\": \"2\",\n      \"enabled\": true,\n      \"type\": \"terms\",\n      \"schema\": \"segment\",\n      \"params\": {\n        \"field\": \"users\",\n        \"size\": 5,\n        \"order\": \"desc\",\n        \"orderBy\": \"1\"\n      }\n    }\n  ]\n}"
+      },
+      "id": "e95ca140-e4cd-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:56:25.109Z",
+      "version": 2
+    },
+    {
+      "attributes": {
+        "columns": [
+          "host",
+          "service",
+          "users",
+          "text"
+        ],
+        "description": "",
+        "hits": 0,
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\n  \"index\": \"icingabeat-*\",\n  \"highlightAll\": true,\n  \"version\": true,\n  \"query\": {\n    \"language\": \"lucene\",\n    \"query\": \"type:icingabeat.event.notification\"\n  },\n  \"filter\": []\n}"
+        },
+        "sort": [
+          "@timestamp",
+          "desc"
+        ],
+        "title": "Notifications",
+        "version": 1
+      },
+      "id": "fa782860-e4bd-11e7-b4d1-8383451ae5a4",
+      "type": "search",
+      "updated_at": "2017-12-27T07:51:48.494Z",
+      "version": 2
+    },
+    {
+      "attributes": {
+        "description": "Summary of notifications received by Icinga",
+        "hits": 0,
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[],\"highlightAll\":true,\"version\":true}"
+        },
+        "optionsJSON": "{\"darkTheme\":false,\"hidePanelTitles\":false,\"useMargins\":true}",
+        "panelsJSON": "[{\"panelIndex\":\"1\",\"gridData\":{\"x\":0,\"y\":0,\"w\":12,\"h\":2,\"i\":\"1\"},\"id\":\"af54ac40-e4cd-11e7-b4d1-8383451ae5a4\",\"type\":\"visualization\",\"version\":\"6.1.0\"},{\"panelIndex\":\"2\",\"gridData\":{\"x\":0,\"y\":2,\"w\":3,\"h\":2,\"i\":\"2\"},\"id\":\"caabba10-e4cd-11e7-b4d1-8383451ae5a4\",\"type\":\"visualization\",\"version\":\"6.1.0\"},{\"panelIndex\":\"3\",\"gridData\":{\"x\":3,\"y\":2,\"w\":3,\"h\":2,\"i\":\"3\"},\"id\":\"fcb31150-e4ca-11e7-b4d1-8383451ae5a4\",\"type\":\"visualization\",\"version\":\"6.1.0\"},{\"panelIndex\":\"4\",\"gridData\":{\"x\":6,\"y\":2,\"w\":3,\"h\":2,\"i\":\"4\"},\"id\":\"e5a012a0-e4c6-11e7-b4d1-8383451ae5a4\",\"type\":\"visualization\",\"version\":\"6.1.0\"},{\"panelIndex\":\"5\",\"gridData\":{\"x\":9,\"y\":2,\"w\":3,\"h\":2,\"i\":\"5\"},\"id\":\"e95ca140-e4cd-11e7-b4d1-8383451ae5a4\",\"type\":\"visualization\",\"version\":\"6.1.0\"},{\"panelIndex\":\"6\",\"gridData\":{\"x\":0,\"y\":4,\"w\":12,\"h\":11,\"i\":\"6\"},\"version\":\"6.1.0\",\"type\":\"search\",\"id\":\"fa782860-e4bd-11e7-b4d1-8383451ae5a4\"}]",
+        "timeRestore": false,
+        "title": "Icingabeat-Notifications",
+        "uiStateJSON": "{}",
+        "version": 1
+      },
+      "id": "ed031e90-e4ce-11e7-b4d1-8383451ae5a4",
+      "type": "dashboard",
+      "updated_at": "2017-12-27T07:40:37.107Z",
+      "version": 1
+    }
+  ],
+  "version": "6.1.0"
+}

_meta/kibana/default/dashboard/Icingabeat-Status.json

@@ -0,0 +1,209 @@
+{
+  "objects": [
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{}"
+        },
+        "title": "Icinga Logo",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Icinga Logo\",\"type\":\"markdown\",\"params\":{\"fontSize\":12,\"markdown\":\"![Icinga Logo](https://www.icinga.com/wp-content/uploads/2014/06/icinga_logo.png)\"},\"aggs\":[]}"
+      },
+      "id": "77052890-e4c0-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:38.128Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
+        },
+        "savedSearchId": "091fd610-e4be-11e7-b4d1-8383451ae5a4",
+        "title": "Icinga Version",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Icinga Version\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"top\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"status.icingaapplication.app.version\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"_term\"}}]}"
+      },
+      "id": "bebb81b0-e4c1-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:38.128Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
+        },
+        "savedSearchId": "091fd610-e4be-11e7-b4d1-8383451ae5a4",
+        "title": "MySQL Schema Version",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"MySQL Schema Version\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"top\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"status.idomysqlconnection.ido-mysql.version\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"_term\"}}]}"
+      },
+      "id": "73cd6b40-e4c2-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:38.128Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
+        },
+        "savedSearchId": "091fd610-e4be-11e7-b4d1-8383451ae5a4",
+        "title": "Nodes",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Nodes\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"top\",\"isDonut\":true,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"status.icingaapplication.app.node_name\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"_term\"}}]}"
+      },
+      "id": "b37471e0-e4c6-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:38.128Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{}"
+        },
+        "title": "Hostchecks by time",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Hostchecks by time\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(metric='avg:status.active_host_checks_1min').color(#070F4E).label(\\\"1 min\\\").title(\\\"Amount of Hostchecks\\\"),.es(metric='avg:status.active_host_checks_5min').color(#2772DB).label(\\\"5 min\\\"),.es(metric='avg:status.active_host_checks_15min').color(#3AB1C8).label(\\\"15 min\\\")\",\"interval\":\"1m\"},\"aggs\":[]}"
+      },
+      "id": "16cd5a60-e4c0-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:38.128Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{}"
+        },
+        "title": "Servicechecks by time",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Servicechecks by time\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(metric='avg:status.active_service_checks_1min').color(#070F4E).label(\\\"1 min\\\").title(\\\"Amount of Servicechecks\\\"),.es(metric='avg:status.active_service_checks_5min').color(#2772DB).label(\\\"5 min\\\"),.es(metric='avg:status.active_service_checks_15min').color(#3AB1C8).label(\\\"15 min\\\")\",\"interval\":\"1m\"},\"aggs\":[]}"
+      },
+      "id": "fbb4acc0-e4cd-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:38.128Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{}"
+        },
+        "title": "Endpoints comparisson",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"Endpoints comparisson\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(metric='avg:status.api.num_endpoints').label(\\\"Endpoints\\\"), .es(metric='avg:status.api.num_not_conn_endpoints').label(\\\"Endpoints not connected\\\").title(\\\"Connected Endpoints\\\")\",\"interval\":\"1m\"},\"aggs\":[]}"
+      },
+      "id": "0c0685d0-e4bf-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:38.128Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{}"
+        },
+        "title": "States of Hosts",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"States of Hosts\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(metric='avg:status.num_hosts_up').color(#3EC8AC).label(\\\"Up\\\").title(\\\"States of Hosts\\\"),.es(metric='avg:status.num_hosts_down').color(#E94822).label(\\\"Down\\\"),.es(metric='avg:status.num_hosts_unreachable').color(#6E60A0).label(\\\"Unreachable\\\")\",\"interval\":\"1m\"},\"aggs\":[]}"
+      },
+      "id": "0d44fb70-e4ce-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:38.128Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{}"
+        },
+        "title": "States of Services",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"States of Services\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(metric='avg:status.num_services_ok').color(#3EC8AC).label(\\\"Ok\\\").title(\\\"States of Services\\\"),.es(metric='avg:status.num_services_warning').color(#F2910A).label(\\\"Warning\\\"),.es(metric='avg:status.num_services_critical').color(#E94822).label(\\\"Critical\\\")\",\"interval\":\"1m\"},\"aggs\":[]}"
+      },
+      "id": "204750b0-e4ce-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:38.128Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "description": "",
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{}"
+        },
+        "title": "MySQL Queries",
+        "uiStateJSON": "{}",
+        "version": 1,
+        "visState": "{\"title\":\"MySQL Queries\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(metric='avg:perfdata.idomysqlconnection_ido-mysql_queries_1min.value').color(#616EEF).label(\\\"1 min\\\").title(\\\"MySQL Queries\\\"), .es(metric='avg:perfdata.idomysqlconnection_ido-mysql_queries_5mins.value').color(#09A8FA).label(\\\"5 min\\\"), .es(metric='avg:perfdata.idomysqlconnection_ido-mysql_queries_15mins.value').color(#41C5D3).label(\\\"15 min\\\")\",\"interval\":\"1m\"},\"aggs\":[]}"
+      },
+      "id": "4d4cda00-e4c2-11e7-b4d1-8383451ae5a4",
+      "type": "visualization",
+      "updated_at": "2017-12-27T07:40:38.128Z",
+      "version": 1
+    },
+    {
+      "attributes": {
+        "columns": [
+          "_source"
+        ],
+        "description": "",
+        "hits": 0,
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\n  \"index\": \"icingabeat-*\",\n  \"highlightAll\": true,\n  \"version\": true,\n  \"query\": {\n    \"language\": \"lucene\",\n    \"query\": \"type:icingabeat.status*\"\n  },\n  \"filter\": []\n}"
+        },
+        "sort": [
+          "@timestamp",
+          "desc"
+        ],
+        "title": "Statuspoller",
+        "version": 1
+      },
+      "id": "091fd610-e4be-11e7-b4d1-8383451ae5a4",
+      "type": "search",
+      "updated_at": "2017-12-27T07:51:55.982Z",
+      "version": 2
+    },
+    {
+      "attributes": {
+        "description": "Summary of Icinga Metrics",
+        "hits": 0,
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[],\"highlightAll\":true,\"version\":true}"
+        },
+        "optionsJSON": "{\"darkTheme\":false,\"hidePanelTitles\":false,\"useMargins\":true}",
+        "panelsJSON": "[{\"gridData\":{\"h\":2,\"i\":\"1\",\"w\":3,\"x\":0,\"y\":0},\"id\":\"77052890-e4c0-11e7-b4d1-8383451ae5a4\",\"panelIndex\":\"1\",\"type\":\"visualization\",\"version\":\"6.1.0\"},{\"gridData\":{\"h\":2,\"i\":\"2\",\"w\":3,\"x\":3,\"y\":0},\"id\":\"bebb81b0-e4c1-11e7-b4d1-8383451ae5a4\",\"panelIndex\":\"2\",\"type\":\"visualization\",\"version\":\"6.1.0\"},{\"gridData\":{\"h\":2,\"i\":\"3\",\"w\":3,\"x\":6,\"y\":0},\"id\":\"73cd6b40-e4c2-11e7-b4d1-8383451ae5a4\",\"panelIndex\":\"3\",\"type\":\"visualization\",\"version\":\"6.1.0\"},{\"gridData\":{\"h\":2,\"i\":\"4\",\"w\":3,\"x\":9,\"y\":0},\"id\":\"b37471e0-e4c6-11e7-b4d1-8383451ae5a4\",\"panelIndex\":\"4\",\"type\":\"visualization\",\"version\":\"6.1.0\"},{\"gridData\":{\"h\":3,\"i\":\"5\",\"w\":4,\"x\":0,\"y\":2},\"id\":\"16cd5a60-e4c0-11e7-b4d1-8383451ae5a4\",\"panelIndex\":\"5\",\"type\":\"visualization\",\"version\":\"6.1.0\"},{\"gridData\":{\"h\":3,\"i\":\"6\",\"w\":4,\"x\":4,\"y\":2},\"id\":\"fbb4acc0-e4cd-11e7-b4d1-8383451ae5a4\",\"panelIndex\":\"6\",\"type\":\"visualization\",\"version\":\"6.1.0\"},{\"gridData\":{\"h\":3,\"i\":\"7\",\"w\":4,\"x\":8,\"y\":2},\"id\":\"0c0685d0-e4bf-11e7-b4d1-8383451ae5a4\",\"panelIndex\":\"7\",\"type\":\"visualization\",\"version\":\"6.1.0\"},{\"gridData\":{\"h\":3,\"i\":\"8\",\"w\":4,\"x\":0,\"y\":5},\"id\":\"0d44fb70-e4ce-11e7-b4d1-8383451ae5a4\",\"panelIndex\":\"8\",\"type\":\"visualization\",\"version\":\"6.1.0\"},{\"gridData\":{\"h\":3,\"i\":\"9\",\"w\":4,\"x\":4,\"y\":5},\"id\":\"204750b0-e4ce-11e7-b4d1-8383451ae5a4\",\"panelIndex\":\"9\",\"type\":\"visualization\",\"version\":\"6.1.0\"},{\"gridData\":{\"h\":3,\"i\":\"10\",\"w\":4,\"x\":8,\"y\":5},\"id\":\"4d4cda00-e4c2-11e7-b4d1-8383451ae5a4\",\"panelIndex\":\"10\",\"type\":\"visualization\",\"version\":\"6.1.0\"}]",
+        "timeRestore": false,
+        "title": "Icingabeat-Status",
+        "uiStateJSON": "{}",
+        "version": 1
+      },
+      "id": "a13f1a80-e4cf-11e7-b4d1-8383451ae5a4",
+      "type": "dashboard",
+      "updated_at": "2017-12-27T07:40:38.128Z",
+      "version": 1
+    }
+  ],
+  "version": "6.1.0"
+}

_meta/kibana/search/5091de50-0975-11e7-a4dd-e96fa284b426.json

@@ -0,0 +1,16 @@
+{
+  "sort": [
+    "@timestamp", 
+    "desc"
+  ], 
+  "hits": 0, 
+  "description": "", 
+  "title": "CheckResults", 
+  "version": 1, 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"index\":\"icingabeat-*\",\"query\":{\"query_string\":{\"query\":\"type:icingabeat.event.checkresult\",\"analyze_wildcard\":true}},\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647}}"
+  }, 
+  "columns": [
+    "_source"
+  ]
+}

_meta/kibana/search/5570eb90-098a-11e7-9f17-cf3a85e0d1dc.json

@@ -0,0 +1,16 @@
+{
+  "sort": [
+    "@timestamp", 
+    "desc"
+  ], 
+  "hits": 0, 
+  "description": "", 
+  "title": "Statuspoller", 
+  "version": 1, 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"index\":\"icingabeat-*\",\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647},\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"type:icingabeat.status*\"}}}"
+  }, 
+  "columns": [
+    "_source"
+  ]
+}

_meta/kibana/search/9b1ca350-0b1a-11e7-ad60-c7e10cd34b29.json

@@ -0,0 +1,20 @@
+{
+  "sort": [
+    "@timestamp", 
+    "desc"
+  ], 
+  "hits": 0, 
+  "description": "", 
+  "title": "Notifications", 
+  "version": 1, 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"index\":\"icingabeat-*\",\"filter\":[],\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647},\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"type:icingabeat.event.notification\"}}}"
+  }, 
+  "columns": [
+    "host", 
+    "service", 
+    "notification_type", 
+    "text", 
+    "users"
+  ]
+}

_meta/kibana/visualization/1b2324e0-0993-11e7-a836-f12bdc7df120.json

@@ -0,0 +1,10 @@
+{
+  "visState": "{\"title\":\"Endpoints comparisson\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(metric='avg:status.api.num_endpoints').label(\\\"Endpoints\\\"), .es(metric='avg:status.api.num_not_conn_endpoints').label(\\\"Endpoints not connected\\\").title(\\\"Connected Endpoints\\\")\",\"interval\":\"auto\"},\"aggs\":[],\"listeners\":{}}", 
+  "description": "", 
+  "title": "Endpoints comparisson", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/27ed7600-0b12-11e7-ad60-c7e10cd34b29.json

@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"Nodes\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"status.icingaapplication.app.node_name\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "Nodes", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "savedSearchId": "5570eb90-098a-11e7-9f17-cf3a85e0d1dc", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/4326e7c0-0a64-11e7-a96b-35f342c9d63d.json

@@ -0,0 +1,10 @@
+{
+  "visState": "{\"title\":\"States of Hosts\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(metric='avg:status.num_hosts_up').color(#3EC8AC).label(\\\"Up\\\").title(\\\"States of Hosts\\\"),.es(metric='avg:status.num_hosts_down').color(#E94822).label(\\\"Down\\\"),.es(metric='avg:status.num_hosts_unreachable').color(#6E60A0).label(\\\"Unreachable\\\")\",\"interval\":\"1m\"},\"aggs\":[],\"listeners\":{}}", 
+  "description": "", 
+  "title": "States of Hosts", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/45556270-0b12-11e7-ad60-c7e10cd34b29.json

@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"Icinga Version\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"status.icingaapplication.app.version\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"\"}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "Icinga Version", 
+  "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", 
+  "version": 1, 
+  "savedSearchId": "5570eb90-098a-11e7-9f17-cf3a85e0d1dc", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/47061440-0994-11e7-828e-2b8b7d3da4e9.json

@@ -0,0 +1,10 @@
+{
+  "visState": "{\"title\":\"Hostchecks by time\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(metric='avg:status.active_host_checks_1min').color(#070F4E).label(\\\"1 min\\\").title(\\\"Amount of Hostchecks\\\"),.es(metric='avg:status.active_host_checks_5min').color(#2772DB).label(\\\"5 min\\\"),.es(metric='avg:status.active_host_checks_15min').color(#3AB1C8).label(\\\"15 min\\\")\",\"interval\":\"auto\"},\"aggs\":[],\"listeners\":{}}", 
+  "description": "", 
+  "title": "Hostchecks by time", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/6a6a66b0-0b1b-11e7-ad60-c7e10cd34b29.json

@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"Notifications by User\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"segment\",\"params\":{\"filters\":[{\"input\":{\"query\":{\"query_string\":{\"query\":\"users:bob\",\"analyze_wildcard\":true}}},\"label\":\"Bob\"},{\"input\":{\"query\":{\"query_string\":{\"query\":\"users:on-call\",\"analyze_wildcard\":true}}},\"label\":\"On-Call\"}]}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "Notifications by User", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "savedSearchId": "9b1ca350-0b1a-11e7-ad60-c7e10cd34b29", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/7bf45770-0994-11e7-862d-53e4526068ac.json

@@ -0,0 +1,10 @@
+{
+  "visState": "{\"title\":\"Servicechecks by time\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(metric='avg:status.active_service_checks_1min').color(#070F4E).label(\\\"1 min\\\").title(\\\"Amount of Servicechecks\\\"),.es(metric='avg:status.active_service_checks_5min').color(#2772DB).label(\\\"5 min\\\"),.es(metric='avg:status.active_service_checks_15min').color(#3AB1C8).label(\\\"15 min\\\")\",\"interval\":\"1m\"},\"aggs\":[],\"listeners\":{}}", 
+  "description": "", 
+  "title": "Servicechecks by time", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/9631be10-0977-11e7-a4dd-e96fa284b426.json

@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"CheckResults by State\",\"type\":\"histogram\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"scale\":\"linear\",\"mode\":\"stacked\",\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false,\"orderBucketsBySum\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"filters\",\"schema\":\"group\",\"params\":{\"filters\":[{\"input\":{\"query\":{\"query_string\":{\"query\":\"check_result.state:0\",\"analyze_wildcard\":true}}},\"label\":\"0: OK\"},{\"input\":{\"query\":{\"query_string\":{\"query\":\"check_result.state:1\",\"analyze_wildcard\":true}}},\"label\":\"1: Warning\"},{\"input\":{\"query\":{\"query_string\":{\"query\":\"check_result.state:2\",\"analyze_wildcard\":true}}},\"label\":\"2: Critical\"},{\"input\":{\"query\":{\"query_string\":{\"query\":\"check_result.state:3\",\"analyze_wildcard\":true}}},\"label\":\"3: Unknown\"}]}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "CheckResults by State", 
+  "uiStateJSON": "{\"vis\":{\"colors\":{\"0\":\"#629E51\",\"1\":\"#E5AC0E\",\"2\":\"#BF1B00\",\"Ok\":\"#508642\",\"Critical\":\"#BF1B00\",\"Warning\":\"#EAB839\",\"Unknown\":\"#962D82\",\"0: OK\":\"#629E51\",\"1: Warning\":\"#E5AC0E\",\"2: Critical\":\"#BF1B00\",\"3: Unknown\":\"#962D82\"}}}", 
+  "version": 1, 
+  "savedSearchId": "5091de50-0975-11e7-a4dd-e96fa284b426", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/bdd29b50-0996-11e7-862d-53e4526068ac.json

@@ -0,0 +1,10 @@
+{
+  "visState": "{\"title\":\"MySQL Queries\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(metric='avg:perfdata.idomysqlconnection_ido-mysql_queries_1min.value').color(#616EEF).label(\\\"1 min\\\").title(\\\"MySQL Queries\\\"), .es(metric='avg:perfdata.idomysqlconnection_ido-mysql_queries_5mins.value').color(#09A8FA).label(\\\"5 min\\\"), .es(metric='avg:perfdata.idomysqlconnection_ido-mysql_queries_15mins.value').color(#41C5D3).label(\\\"15 min\\\")\",\"interval\":\"1m\"},\"aggs\":[],\"listeners\":{}}", 
+  "description": "", 
+  "title": "MySQL Queries", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/bef57c00-098c-11e7-85fa-5daf7284b188.json

@@ -0,0 +1,10 @@
+{
+  "visState": "{\"title\":\"Icinga Logo\",\"type\":\"markdown\",\"params\":{\"markdown\":\"![Icinga Logo](https://www.icinga.com/wp-content/uploads/2014/06/icinga_logo.png)\"},\"aggs\":[],\"listeners\":{}}", 
+  "description": "", 
+  "title": "Icinga Logo", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/cf643aa0-0977-11e7-a4dd-e96fa284b426.json

@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"Services Tag Cloud\",\"type\":\"tagcloud\",\"params\":{\"scale\":\"linear\",\"orientation\":\"single\",\"minFontSize\":18,\"maxFontSize\":72},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"service\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Services\"}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "Services Tag Cloud", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "savedSearchId": "5091de50-0975-11e7-a4dd-e96fa284b426", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/cf7c1400-0b1a-11e7-ad60-c7e10cd34b29.json

@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"Notification Services\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"service\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "Notification Services", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "savedSearchId": "9b1ca350-0b1a-11e7-ad60-c7e10cd34b29", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/d50bb810-0978-11e7-a4dd-e96fa284b426.json

@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"CheckResult Count\",\"type\":\"metric\",\"params\":{\"handleNoResults\":true,\"fontSize\":60},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{\"customLabel\":\"CheckResults received\"}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "CheckResult Count", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "savedSearchId": "5091de50-0975-11e7-a4dd-e96fa284b426", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/d8a29b80-0b1a-11e7-ad60-c7e10cd34b29.json

@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"Notification Hosts\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"host\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "Notification Hosts", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "savedSearchId": "9b1ca350-0b1a-11e7-ad60-c7e10cd34b29", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/df437df0-0977-11e7-a4dd-e96fa284b426.json

@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"Hosts Tag Cloud\",\"type\":\"tagcloud\",\"params\":{\"scale\":\"linear\",\"orientation\":\"single\",\"minFontSize\":18,\"maxFontSize\":72},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"host\",\"size\":50,\"order\":\"desc\",\"orderBy\":\"1\",\"customLabel\":\"Hosts\"}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "Hosts Tag Cloud", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "savedSearchId": "5091de50-0975-11e7-a4dd-e96fa284b426", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/dfb21700-0a63-11e7-a96b-35f342c9d63d.json

@@ -0,0 +1,10 @@
+{
+  "visState": "{\"title\":\"States of Services\",\"type\":\"timelion\",\"params\":{\"expression\":\".es(metric='avg:status.num_services_ok').color(#3EC8AC).label(\\\"Ok\\\").title(\\\"States of Services\\\"),.es(metric='avg:status.num_services_warning').color(#F2910A).label(\\\"Warning\\\"),.es(metric='avg:status.num_services_critical').color(#E94822).label(\\\"Critical\\\")\",\"interval\":\"1m\"},\"aggs\":[],\"listeners\":{}}", 
+  "description": "", 
+  "title": "States of Services", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/e3813340-0b1a-11e7-ad60-c7e10cd34b29.json

@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"Notification Types\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"notification_type\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "Notification Types", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "savedSearchId": "9b1ca350-0b1a-11e7-ad60-c7e10cd34b29", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/e7912c50-0b11-11e7-ad60-c7e10cd34b29.json

@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"MySQL Schema Version\",\"type\":\"pie\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"segment\",\"params\":{\"field\":\"status.idomysqlconnection.ido-mysql.version\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "MySQL Schema Version", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "savedSearchId": "5570eb90-098a-11e7-9f17-cf3a85e0d1dc", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[]}"
+  }
+}

_meta/kibana/visualization/face9fb0-0b1a-11e7-ad60-c7e10cd34b29.json

@@ -0,0 +1,11 @@
+{
+  "visState": "{\"title\":\"Notification Types\",\"type\":\"histogram\",\"params\":{\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"scale\":\"linear\",\"mode\":\"stacked\",\"times\":[],\"addTimeMarker\":false,\"defaultYExtents\":false,\"setYExtents\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"terms\",\"schema\":\"group\",\"params\":{\"field\":\"notification_type\",\"size\":5,\"order\":\"desc\",\"orderBy\":\"1\"}}],\"listeners\":{}}", 
+  "description": "", 
+  "title": "Notification Types", 
+  "uiStateJSON": "{}", 
+  "version": 1, 
+  "savedSearchId": "9b1ca350-0b1a-11e7-ad60-c7e10cd34b29", 
+  "kibanaSavedObjectMeta": {
+    "searchSourceJSON": "{\"filter\":[]}"
+  }
+}

beater/eventstream.go

@@ -12,9 +12,9 @@ import (
 
 	"github.com/icinga/icingabeat/config"
 
-	"github.com/elastic/beats/v7/libbeat/beat"
+	"github.com/elastic/beats/libbeat/beat"
-	"github.com/elastic/beats/v7/libbeat/common"
+	"github.com/elastic/beats/libbeat/common"
-	"github.com/elastic/beats/v7/libbeat/logp"
+	"github.com/elastic/beats/libbeat/logp"
 )
 
 // Eventstream type
@@ -51,39 +51,39 @@ func BuildEventstreamEvent(e []byte) beat.Event {
 	event.Fields = common.MapStr{}
 
 	for key, value := range icingaEvent {
-		event.Fields.Put(target_key+key, value)
+		event.Fields.Put(key, value)
 	}
 
 	logp.Debug("icingabeat", "Type: %v", icingaEvent["type"])
 	switch icingaEvent["type"] {
 	case "CheckResult", "StateChange", "Notification":
 		checkResult := icingaEvent["check_result"].(map[string]interface{})
-		event.Fields.Put(target_key+"check_result.execution_start", FloatToTimestamp(checkResult["execution_start"].(float64)))
+		event.Fields.Put("check_result.execution_start", FloatToTimestamp(checkResult["execution_start"].(float64)))
-		event.Fields.Put(target_key+"check_result.execution_end", FloatToTimestamp(checkResult["execution_end"].(float64)))
+		event.Fields.Put("check_result.execution_end", FloatToTimestamp(checkResult["execution_end"].(float64)))
-		event.Fields.Put(target_key+"check_result.schedule_start", FloatToTimestamp(checkResult["schedule_start"].(float64)))
+		event.Fields.Put("check_result.schedule_start", FloatToTimestamp(checkResult["schedule_start"].(float64)))
-		event.Fields.Put(target_key+"check_result.schedule_end", FloatToTimestamp(checkResult["schedule_end"].(float64)))
+		event.Fields.Put("check_result.schedule_end", FloatToTimestamp(checkResult["schedule_end"].(float64)))
-		event.Fields.Delete(target_key + "check_result.performance_data")
+		event.Fields.Delete("check_result.performance_data")
 
 	case "AcknowledgementSet":
 		event.Delete("comment")
-		event.Fields.Put(target_key+"comment.text", icingaEvent["comment"])
+		event.Fields.Put("comment.text", icingaEvent["comment"])
-		event.Fields.Put(target_key+"expiry", FloatToTimestamp(icingaEvent["expiry"].(float64)))
+		event.Fields.Put("expiry", FloatToTimestamp(icingaEvent["expiry"].(float64)))
 
 	case "CommentAdded", "CommentRemoved":
 		comment := icingaEvent["comment"].(map[string]interface{})
-		event.Fields.Put(target_key+"comment.entry_time", FloatToTimestamp(comment["entry_time"].(float64)))
+		event.Fields.Put("comment.entry_time", FloatToTimestamp(comment["entry_time"].(float64)))
-		event.Fields.Put(target_key+"comment.expire_time", FloatToTimestamp(comment["expire_time"].(float64)))
+		event.Fields.Put("comment.expire_time", FloatToTimestamp(comment["expire_time"].(float64)))
 
 	case "DowntimeAdded", "DowntimeRemoved", "DowntimeStarted", "DowntimeTriggered":
 		downtime := icingaEvent["downtime"].(map[string]interface{})
-		event.Fields.Put(target_key+"downtime.end_time", FloatToTimestamp(downtime["end_time"].(float64)))
+		event.Fields.Put("downtime.end_time", FloatToTimestamp(downtime["end_time"].(float64)))
-		event.Fields.Put(target_key+"downtime.entry_time", FloatToTimestamp(downtime["entry_time"].(float64)))
+		event.Fields.Put("downtime.entry_time", FloatToTimestamp(downtime["entry_time"].(float64)))
-		event.Fields.Put(target_key+"downtime.start_time", FloatToTimestamp(downtime["start_time"].(float64)))
+		event.Fields.Put("downtime.start_time", FloatToTimestamp(downtime["start_time"].(float64)))
-		event.Fields.Put(target_key+"downtime.trigger_time", FloatToTimestamp(downtime["trigger_time"].(float64)))
+		event.Fields.Put("downtime.trigger_time", FloatToTimestamp(downtime["trigger_time"].(float64)))
 	}
 
 	event.Fields.Put("type", "icingabeat.event."+strings.ToLower(icingaEvent["type"].(string)))
-	event.Fields.Put(target_key+"timestamp", FloatToTimestamp(icingaEvent["timestamp"].(float64)))
+	event.Fields.Put("timestamp", FloatToTimestamp(icingaEvent["timestamp"].(float64)))
 
 	return event
 }

beater/http.go

@@ -4,12 +4,13 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"errors"
+	"fmt"
 	"io/ioutil"
 	"net/http"
 	"net/url"
 	"time"
 
-	"github.com/elastic/beats/v7/libbeat/logp"
+	"github.com/elastic/beats/libbeat/logp"
 )
 
 func requestURL(bt *Icingabeat, method string, URL *url.URL) (*http.Response, error) {
@@ -31,6 +32,7 @@ func requestURL(bt *Icingabeat, method string, URL *url.URL) (*http.Response, er
 		skipSslVerify = true
 	}
 
+	fmt.Print(bt.config.SSL.CertificateAuthorities)
 	tlsConfig := &tls.Config{
 		InsecureSkipVerify: skipSslVerify,
 		RootCAs:            certPool,
@@ -66,9 +68,6 @@ func requestURL(bt *Icingabeat, method string, URL *url.URL) (*http.Response, er
 	case 401:
 		err = errors.New("Authentication failed for user " + bt.config.User)
 		defer response.Body.Close()
-	case 404:
-		err = errors.New("404 Not Found. Missing permissions may be a reason for this.")
-		defer response.Body.Close()
 	}
 
 	return response, err

beater/icingabeat.go

@@ -3,9 +3,9 @@ package beater
 import (
 	"fmt"
 
-	"github.com/elastic/beats/v7/libbeat/beat"
+	"github.com/elastic/beats/libbeat/beat"
-	"github.com/elastic/beats/v7/libbeat/common"
+	"github.com/elastic/beats/libbeat/common"
-	"github.com/elastic/beats/v7/libbeat/logp"
+	"github.com/elastic/beats/libbeat/logp"
 
 	"github.com/icinga/icingabeat/config"
 )
@@ -17,8 +17,6 @@ type Icingabeat struct {
 	client beat.Client
 }
 
-var target_key = "icinga."
-
 // New beater
 func New(b *beat.Beat, cfg *common.Config) (beat.Beater, error) {
 	config := config.DefaultConfig
@@ -49,6 +47,7 @@ func (bt *Icingabeat) Run(b *beat.Beat) error {
 		go eventstream.Run()
 	}
 
+	fmt.Print(bt.config.Statuspoller.Interval)
 	if bt.config.Statuspoller.Interval > 0 {
 		var statuspoller *Statuspoller
 		statuspoller = NewStatuspoller(bt, bt.config)

beater/statuspoller.go

@@ -10,9 +10,9 @@ import (
 
 	"github.com/icinga/icingabeat/config"
 
-	"github.com/elastic/beats/v7/libbeat/beat"
+	"github.com/elastic/beats/libbeat/beat"
-	"github.com/elastic/beats/v7/libbeat/common"
+	"github.com/elastic/beats/libbeat/common"
-	"github.com/elastic/beats/v7/libbeat/logp"
+	"github.com/elastic/beats/libbeat/logp"
 )
 
 // Statuspoller type
@@ -56,20 +56,11 @@ func BuildStatusEvents(body []byte) []beat.Event {
 						switch statusvalue.(type) {
 						case map[string]interface{}:
 							if len(statusvalue.(map[string]interface{})) > 0 {
-								for key, value := range value.(map[string]interface{}) {
+								event.Fields.Put(key, value)
-									if key == "api" {
-										// "zones" can include a massive amount of data, depending
-										// on the number of connected agents and satellites
-										// since enough data is included in other keys, we're
-										// removing "zones" explicitly
-										delete(value.(map[string]interface{}), "zones")
-									}
-								}
-								event.Fields.Put(target_key+key, value)
 							}
 
 						default:
-							event.Fields.Put(target_key+key, value)
+							event.Fields.Put(key, value)
 						}
 
 					}
@@ -83,21 +74,22 @@ func BuildStatusEvents(body []byte) []beat.Event {
 						case interface{}:
 							key = "perfdata." + perfdata.(map[string]interface{})["label"].(string)
 							value = perfdata
-							event.Fields.Put(target_key+key, value)
+							event.Fields.Put(key, value)
 
 						}
 					}
 
 				case "name":
+					key = "type"
 					value = "icingabeat.status." + strings.ToLower(value.(string))
-					event.Fields.Put("type", value)
+					event.Fields.Put(key, value)
 
 				default:
-					event.Fields.Put(target_key+key, value)
+					event.Fields.Put(key, value)
 				}
 			}
 
-			if statusAvailable, _ := event.Fields.HasKey(target_key + "status"); statusAvailable == true {
+			if statusAvailable, _ := event.Fields.HasKey("status"); statusAvailable == true {
 				statusEvents = append(statusEvents, event)
 			}
 		}

cmd/root.go

@@ -3,12 +3,11 @@ package cmd
 import (
 	"github.com/icinga/icingabeat/beater"
 
-	cmd "github.com/elastic/beats/v7/libbeat/cmd"
+	cmd "github.com/elastic/beats/libbeat/cmd"
-	"github.com/elastic/beats/v7/libbeat/cmd/instance"
 )
 
 // Name of this beat
 var Name = "icingabeat"
 
 // RootCmd to handle beats cli
-var RootCmd = cmd.GenRootCmdWithSettings(beater.New, instance.Settings{Name: Name})
+var RootCmd = cmd.GenRootCmd(Name, "", beater.New)

dashboards.yml

@@ -1,6 +1,6 @@
 dashboards:
 - id: 34e97340-e4ce-11e7-b4d1-8383451ae5a4
-  file: Icingabeat-CheckResults.json
+  file: Icingabeat-CheckRestuls.json
 
 - id: ed031e90-e4ce-11e7-b4d1-8383451ae5a4
   file: Icingabeat-Notifications.json

data/meta.json

@@ -1 +1 @@
-{"uuid":"0409fabd-956a-4000-9090-22c9c0b438af","first_start":"2022-05-31T13:14:26.86643+02:00"}
+{"uuid":"0409fabd-956a-4000-9090-22c9c0b438af"}

docs/01-about.md

@@ -10,7 +10,7 @@ or Logstash.
 > Elasticsearch, either directly or via Logstash, so it can be visualized with
 > Kibana.
 
-![CheckResults](../screenshots/checkresults.png) | ![Status](../screenshots/notifications.png)
+![CheckResults](../screenshots/checkresults.png) | ![Status](../screenshots/status.png)
 -------------------------------------------------|-------------------------------------
 
 ## Eventstream

docs/02-installation.md

@@ -71,7 +71,7 @@ Make sure you have configured Icingabeat properly before starting it. Use one
 of the following commands to start Icingabeat:
 
 * `service icingabeat start` or
-* `systemctl start icingabeat` or
+* `systemctl icingabeat start` or
 * `/etc/init.d/icingabeat start`
 
 ## Dashboards
@@ -79,12 +79,17 @@ We have dashboards prepared that you can use when getting started with
 Icingabeat. They are meant to give you some inspiration before you start
 exploring the data by yourself.
 
-Starting with icingabeat v7.17.4 you have to download and import the dashboards manually.
+**Note:** The dashboards require Kibana >= 6.0
 
-Download and upack `dashboards.zip` from the [latest release](https://github.com/Icinga/icingabeat/releases/latest) page.
+Import dashboards and index pattern:
+``` shell
+icingabeat setup
+```
 
-Use Kibana's Import functionality to upload the `*.ndjson` files which will
+Set Kibana host, user and password if necessary:
-import a bunch of saved objects, including dashboards and single visualizations.
+``` shell
+icingabeat setup -E setup.kibana.host=127.0.0.1:5601 -E setup.kibana.username=elastic -E setup.kibana.password=secret
+```
 
 ## Manual Installation
 

go.mod

@@ -1,155 +0,0 @@
-module github.com/icinga/icingabeat
-
-go 1.17
-
-require (
-    github.com/tsg/go-daemon v0.0.0-20200207173439-e704b93fd89b
-    github.com/blakesmith/ar v0.0.0-20150311145944-8bd4349a67f2
-	github.com/Microsoft/go-winio v0.5.1 // indirect
-	github.com/Shopify/sarama v0.0.0-00010101000000-000000000000 // indirect
-	github.com/StackExchange/wmi v0.0.0-20170221213301-9f32b5905fd6 // indirect
-	github.com/akavel/rsrc v0.8.0 // indirect
-	github.com/cespare/xxhash/v2 v2.1.1 // indirect
-	github.com/dlclark/regexp2 v1.1.7-0.20171009020623-7632a260cbaf // indirect
-	github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7 // indirect
-	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-units v0.4.0 // indirect
-	github.com/dop251/goja v0.0.0-20200831102558-9af81ddcf0e1 // indirect
-	github.com/dop251/goja_nodejs v0.0.0-20171011081505-adff31b136e6 // indirect
-	github.com/dustin/go-humanize v1.0.0 // indirect
-	github.com/eapache/go-resiliency v1.2.0 // indirect
-	github.com/elastic/ecs v1.12.0 // indirect
-	github.com/elastic/elastic-agent-client/v7 v7.0.0-20210727140539-f0905d9377f6 // indirect
-	github.com/elastic/go-concert v0.2.0 // indirect
-	github.com/elastic/go-lumber v0.1.0 // indirect
-	github.com/elastic/go-seccomp-bpf v1.2.0 // indirect
-	github.com/elastic/go-structform v0.0.9 // indirect
-	github.com/elastic/go-sysinfo v1.7.1 // indirect
-	github.com/elastic/go-txfile v0.0.7 // indirect
-	github.com/elastic/go-ucfg v0.8.3 // indirect
-	github.com/elastic/go-windows v1.0.1 // indirect
-	github.com/elastic/gosigar v0.14.2 // indirect
-	github.com/fatih/color v1.9.0 // indirect
-	github.com/go-ole/go-ole v1.2.5-0.20190920104607-14974a1cf647 // indirect
-	github.com/go-sourcemap/sourcemap v2.1.2+incompatible // indirect
-	github.com/gofrs/flock v0.7.2-0.20190320160742-5135e617513b // indirect
-	github.com/gofrs/uuid v3.3.0+incompatible // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
-	github.com/gomodule/redigo v1.8.3 // indirect
-	github.com/google/go-cmp v0.5.6 // indirect
-	github.com/h2non/filetype v1.1.1 // indirect
-	github.com/hashicorp/go-multierror v1.1.0 // indirect
-	github.com/hashicorp/golang-lru v0.5.4 // indirect
-	github.com/joeshaw/multierror v0.0.0-20140124173710-69b34d4ec901 // indirect
-	github.com/jonboulle/clockwork v0.2.2 // indirect
-	github.com/josephspurrier/goversioninfo v0.0.0-20190209210621-63e6d1acd3dd // indirect
-	github.com/magefile/mage v1.11.0
-	github.com/mattn/go-colorable v0.1.6 // indirect
-	github.com/miekg/dns v1.1.25 // indirect
-	github.com/mitchellh/hashstructure v0.0.0-20170116052023-ab25296c0f51 // indirect
-	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.2-0.20190823105129-775207bd45b6 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
-	github.com/prometheus/procfs v0.6.0 // indirect
-	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
-	github.com/shirou/gopsutil v3.20.12+incompatible // indirect
-	github.com/spf13/cobra v1.0.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/urso/sderr v0.0.0-20210525210834-52b04e8f5c71 // indirect
-	github.com/xdg/scram v1.0.3 // indirect
-	go.elastic.co/apm v1.11.0 // indirect
-	go.elastic.co/apm/module/apmelasticsearch v1.7.2 // indirect
-	go.elastic.co/apm/module/apmhttp v1.7.2 // indirect
-	go.elastic.co/ecszap v0.3.0 // indirect
-	go.uber.org/atomic v1.5.0 // indirect
-	go.uber.org/multierr v1.3.0 // indirect
-	go.uber.org/zap v1.14.0 // indirect
-	golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e // indirect
-	golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 // indirect
-	golang.org/x/net v0.0.0-20211020060615-d418f374d309 // indirect
-	golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1 // indirect
-	golang.org/x/sys v0.0.0-20211102192858-4dd72447c267 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
-	golang.org/x/tools v0.1.7 // indirect
-	google.golang.org/genproto v0.0.0-20211021150943-2b146023228c // indirect
-	google.golang.org/grpc v1.41.0 // indirect
-	google.golang.org/protobuf v1.27.1 // indirect
-	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/jcmturner/aescts.v1 v1.0.1 // indirect
-	gopkg.in/jcmturner/dnsutils.v1 v1.0.1 // indirect
-	gopkg.in/jcmturner/goidentity.v3 v3.0.0 // indirect
-	gopkg.in/jcmturner/gokrb5.v7 v7.5.0 // indirect
-	gopkg.in/jcmturner/rpc.v1 v1.1.0 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
-	howett.net/plist v0.0.0-20181124034731-591f970eefbb // indirect
-	k8s.io/api v0.21.1 // indirect
-	k8s.io/apimachinery v0.21.1 // indirect
-	k8s.io/client-go v0.21.1 // indirect
-)
-
-require github.com/elastic/beats/v7 v7.17.4
-
-require (
-	github.com/BurntSushi/toml v0.3.1 // indirect
-	github.com/armon/go-radix v1.0.0 // indirect
-	github.com/containerd/containerd v1.5.7 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/docker/distribution v2.8.0+incompatible // indirect
-	github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21 // indirect
-	github.com/eapache/queue v1.1.0 // indirect
-	github.com/go-logr/logr v0.4.0 // indirect
-	github.com/google/gofuzz v1.1.0 // indirect
-	github.com/googleapis/gnostic v0.4.1 // indirect
-	github.com/hashicorp/errwrap v1.0.0 // indirect
-	github.com/hashicorp/go-uuid v1.0.2 // indirect
-	github.com/imdario/mergo v0.3.12 // indirect
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
-	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
-	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
-	github.com/jcmturner/gofork v1.0.0 // indirect
-	github.com/jcmturner/gokrb5/v8 v8.4.2 // indirect
-	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
-	github.com/json-iterator/go v1.1.11 // indirect
-	github.com/klauspost/compress v1.13.6 // indirect
-	github.com/mattn/go-isatty v0.0.12 // indirect
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.1 // indirect
-	github.com/pierrec/lz4 v2.6.0+incompatible // indirect
-	github.com/santhosh-tekuri/jsonschema v1.2.4 // indirect
-	github.com/sirupsen/logrus v1.8.1 // indirect
-	github.com/urso/diag v0.0.0-20200210123136-21b3cc8eb797 // indirect
-	github.com/urso/go-bin v0.0.0-20180220135811-781c575c9f0e // indirect
-	github.com/urso/magetools v0.0.0-20190919040553-290c89e0c230 // indirect
-	github.com/xdg/stringprep v1.0.3 // indirect
-	go.elastic.co/fastjson v1.1.0 // indirect
-	go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee // indirect
-	golang.org/x/mod v0.4.2 // indirect
-	golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d // indirect
-	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	honnef.co/go/tools v0.0.1-2020.1.4 // indirect
-	k8s.io/klog/v2 v2.8.0 // indirect
-	k8s.io/utils v0.0.0-20201110183641-67b214c5f920 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.1.0 // indirect
-	sigs.k8s.io/yaml v1.2.0 // indirect
-)
-
-replace (
-	github.com/Microsoft/go-winio => github.com/bi-zone/go-winio v0.4.15
-	github.com/Shopify/sarama => github.com/elastic/sarama v1.19.1-0.20210823122811-11c3ef800752
-	github.com/apoydence/eachers => github.com/poy/eachers v0.0.0-20181020210610-23942921fe77 //indirect, see https://github.com/elastic/beats/pull/29780 for details.
-	github.com/cucumber/godog => github.com/cucumber/godog v0.8.1
-	github.com/docker/docker => github.com/docker/engine v0.0.0-20191113042239-ea84732a7725
-	github.com/docker/go-plugins-helpers => github.com/elastic/go-plugins-helpers v0.0.0-20200207104224-bdf17607b79f
-	github.com/dop251/goja => github.com/andrewkroh/goja v0.0.0-20190128172624-dd2ac4456e20
-	github.com/dop251/goja_nodejs => github.com/dop251/goja_nodejs v0.0.0-20171011081505-adff31b136e6
-	github.com/fsnotify/fsevents => github.com/elastic/fsevents v0.0.0-20181029231046-e1d381a4d270
-	github.com/fsnotify/fsnotify => github.com/adriansr/fsnotify v1.4.8-0.20211018144411-a81f2b630e7c
-	github.com/golang/glog => github.com/elastic/glog v1.0.1-0.20210831205241-7d8b5c89dfc4
-	github.com/google/gopacket => github.com/adriansr/gopacket v1.1.18-0.20200327165309-dd62abfa8a41
-	github.com/insomniacslk/dhcp => github.com/elastic/dhcp v0.0.0-20200227161230-57ec251c7eb3 // indirect
-	github.com/tonistiigi/fifo => github.com/containerd/fifo v0.0.0-20190816180239-bda0ff6ed73c
-)

icingabeat.docker.yml

@@ -1,9 +0,0 @@
-
-processors:
-  - add_cloud_metadata: ~
-  - add_docker_metadata: ~
-
-output.elasticsearch:
-  hosts: '${ELASTICSEARCH_HOSTS:elasticsearch:9200}'
-  username: '${ELASTICSEARCH_USERNAME:}'
-  password: '${ELASTICSEARCH_PASSWORD:}'

icingabeat.full.yml

@@ -0,0 +1,727 @@
+################### Icingabeat Configuration Example #########################
+
+############################# Icingabeat ######################################
+
+icingabeat:
+
+  # Defines the Icinga API endpoint
+  host: "localhost"
+
+  # Defines the port of the API endpoint
+  port: 5665
+
+  # A user with sufficient permissions
+  user: "icinga"
+
+  # Password of the user
+  password: "icinga"
+
+  # Skip SSL verification
+  skip_ssl_verify: false
+
+  # Icingabeat supports capturing of an evenstream and periodical polling of the
+  # Icinga status data.
+  eventstream:
+    #
+    # Decide which events to receive from the event stream.
+    # The following event stream types are available:
+    #
+    # * CheckResult
+    # * StateChange
+    # * Notification
+    # * AcknowledgementSet
+    # * AcknowledgementCleared
+    # * CommentAdded
+    # * CommentRemoved
+    # * DowntimeAdded
+    # * DowntimeRemoved
+    # * DowntimeStarted
+    # * DowntimeTriggered
+    #
+    # To disable eventstream, leave the types empty or comment out the option
+    types:
+      - CheckResult
+      - StateChange
+
+    # Event streams can be filtered by attributes using the prefix 'event.'
+    #
+    # Example for the CheckResult type with the exit_code set to 2:
+    # filter: "event.check_result.exit_status==2"
+    #
+    # Example for the CheckResult type with the service matching the string
+    # pattern "mysql*":
+    # filter: 'match("mysql*", event.service)'
+    #
+    # To disable filtering set an empty string or comment out the filter option
+    filter: ""
+
+    # Defines how fast to reconnect to the API on connection loss
+    retry_interval: 10s
+
+  statuspoller:
+    # Interval at which the status API is called. Set to 0 to disable polling.
+    interval: 60s
+
+#================================ General ======================================
+
+# The name of the shipper that publishes the network data. It can be used to group
+# all the transactions sent by a single shipper in the web interface.
+# If this options is not defined, the hostname is used.
+#name:
+
+# The tags of the shipper are included in their own field with each
+# transaction published. Tags make it easy to group servers by different
+# logical properties.
+#tags: ["service-X", "web-tier"]
+
+# Optional fields that you can specify to add additional information to the
+# output. Fields can be scalar values, arrays, dictionaries, or any nested
+# combination of these.
+#fields:
+#  env: staging
+
+# If this option is set to true, the custom fields are stored as top-level
+# fields in the output document instead of being grouped under a fields
+# sub-dictionary. Default is false.
+#fields_under_root: false
+
+# Internal queue size for single events in processing pipeline
+#queue_size: 1000
+
+# The internal queue size for bulk events in the processing pipeline.
+# Do not modify this value.
+#bulk_queue_size: 0
+
+# Sets the maximum number of CPUs that can be executing simultaneously. The
+# default is the number of logical CPUs available in the system.
+#max_procs:
+
+#================================ Processors ===================================
+
+# Processors are used to reduce the number of fields in the exported event or to
+# enhance the event with external metadata. This section defines a list of
+# processors that are applied one by one and the first one receives the initial
+# event:
+#
+#   event -> filter1 -> event1 -> filter2 ->event2 ...
+#
+# The supported processors are drop_fields, drop_event, include_fields, and
+# add_cloud_metadata.
+#
+# For example, you can use the following processors to keep the fields that
+# contain CPU load percentages, but remove the fields that contain CPU ticks
+# values:
+#
+#processors:
+#- include_fields:
+#    fields: ["cpu"]
+#- drop_fields:
+#    fields: ["cpu.user", "cpu.system"]
+#
+# The following example drops the events that have the HTTP response code 200:
+#
+#processors:
+#- drop_event:
+#    when:
+#       equals:
+#           http.code: 200
+#
+# The following example enriches each event with metadata from the cloud
+# provider about the host machine. It works on EC2, GCE, and DigitalOcean.
+#
+#processors:
+#- add_cloud_metadata:
+#
+
+#================================ Outputs ======================================
+
+# Configure what outputs to use when sending the data collected by the beat.
+# Multiple outputs may be used.
+
+#-------------------------- Elasticsearch output -------------------------------
+output.elasticsearch:
+  # Boolean flag to enable or disable the output module.
+  #enabled: true
+
+  # Array of hosts to connect to.
+  # Scheme and port can be left out and will be set to the default (http and 9200)
+  # In case you specify and additional path, the scheme is required: http://localhost:9200/path
+  # IPv6 addresses should always be defined as: https://[2001:db8::1]:9200
+  hosts: ["localhost:9200"]
+
+  # Set gzip compression level.
+  #compression_level: 0
+
+  # Optional protocol and basic auth credentials.
+  #protocol: "https"
+  #username: "elastic"
+  #password: "changeme"
+
+  # Dictionary of HTTP parameters to pass within the url with index operations.
+  #parameters:
+    #param1: value1
+    #param2: value2
+
+  # Number of workers per Elasticsearch host.
+  #worker: 1
+
+  # Optional index name. The default is "icingabeat" plus date
+  # and generates [icingabeat-]YYYY.MM.DD keys.
+  #index: "icingabeat-%{+yyyy.MM.dd}"
+
+  # Optional ingest node pipeline. By default no pipeline will be used.
+  #pipeline: ""
+
+  # Optional HTTP Path
+  #path: "/elasticsearch"
+
+  # Custom HTTP headers to add to each request
+  #headers:
+  #  X-My-Header: Contents of the header
+
+  # Proxy server url
+  #proxy_url: http://proxy:3128
+
+  # The number of times a particular Elasticsearch index operation is attempted. If
+  # the indexing operation doesn't succeed after this many retries, the events are
+  # dropped. The default is 3.
+  #max_retries: 3
+
+  # The maximum number of events to bulk in a single Elasticsearch bulk API index request.
+  # The default is 50.
+  #bulk_max_size: 50
+
+  # Configure http request timeout before failing an request to Elasticsearch.
+  #timeout: 90
+
+  # The number of seconds to wait for new events between two bulk API index requests.
+  # If `bulk_max_size` is reached before this interval expires, addition bulk index
+  # requests are made.
+  #flush_interval: 1s
+
+  # A template is used to set the mapping in Elasticsearch
+  # By default template loading is enabled and the template is loaded.
+  # These settings can be adjusted to load your own template or overwrite existing ones.
+
+  # Set to false to disable template loading.
+  #template.enabled: true
+
+  # Template name. By default the template name is icingabeat.
+  #template.name: "icingabeat"
+
+  # Path to template file
+  #template.path: "${path.config}/icingabeat.template.json"
+
+  # Overwrite existing template
+  #template.overwrite: false
+
+  # If set to true, icingabeat checks the Elasticsearch version at connect time, and if it
+  # is 2.x, it loads the file specified by the template.versions.2x.path setting. The
+  # default is true.
+  #template.versions.2x.enabled: true
+
+  # Path to the Elasticsearch 2.x version of the template file.
+  #template.versions.2x.path: "${path.config}/icingabeat.template-es2x.json"
+
+  # If set to true, icingabeat checks the Elasticsearch version at connect time, and if it
+  # is 6.x, it loads the file specified by the template.versions.6x.path setting. The
+  # default is true.
+  #template.versions.6x.enabled: true
+
+  # Path to the Elasticsearch 6.x version of the template file.
+  #template.versions.6x.path: "${path.config}/icingabeat.template-es6x.json"
+
+  # Use SSL settings for HTTPS. Default is true.
+  #ssl.enabled: true
+
+  # Configure SSL verification mode. If `none` is configured, all server hosts
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `full`.
+  #ssl.verification_mode: full
+
+  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
+  # 1.2 are enabled.
+  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+
+  # SSL configuration. By default is off.
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  # Certificate for SSL client authentication
+  #ssl.certificate: "/etc/pki/client/cert.pem"
+
+  # Client Certificate Key
+  #ssl.key: "/etc/pki/client/cert.key"
+
+  # Optional passphrase for decrypting the Certificate Key.
+  #ssl.key_passphrase: ''
+
+  # Configure cipher suites to be used for SSL connections
+  #ssl.cipher_suites: []
+
+  # Configure curve types for ECDHE based cipher suites
+  #ssl.curve_types: []
+
+  # Configure what types of renegotiation are supported. Valid options are
+  # never, once, and freely. Default is never.
+  #ssl.renegotiation: never
+
+
+#----------------------------- Logstash output ---------------------------------
+#output.logstash:
+  # Boolean flag to enable or disable the output module.
+  #enabled: true
+
+  # The Logstash hosts
+  #hosts: ["localhost:5044"]
+
+  # Number of workers per Logstash host.
+  #worker: 1
+
+  # Set gzip compression level.
+  #compression_level: 3
+
+  # Optional load balance the events between the Logstash hosts
+  #loadbalance: true
+
+  # Number of batches to be send asynchronously to logstash while processing
+  # new batches.
+  #pipelining: 0
+
+  # If enabled only a subset of events in a batch of events is transferred per
+  # transaction.  The number of events to be sent increases up to `bulk_max_size`
+  # if no error is encountered.
+  #slow_start: false
+
+  # Optional index name. The default index name is set to name of the beat
+  # in all lowercase.
+  #index: 'icingabeat'
+
+  # SOCKS5 proxy server URL
+  #proxy_url: socks5://user:password@socks5-server:2233
+
+  # Resolve names locally when using a proxy server. Defaults to false.
+  #proxy_use_local_resolver: false
+
+  # Enable SSL support. SSL is automatically enabled, if any SSL setting is set.
+  #ssl.enabled: true
+
+  # Configure SSL verification mode. If `none` is configured, all server hosts
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `full`.
+  #ssl.verification_mode: full
+
+  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
+  # 1.2 are enabled.
+  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+
+  # Optional SSL configuration options. SSL is off by default.
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  # Certificate for SSL client authentication
+  #ssl.certificate: "/etc/pki/client/cert.pem"
+
+  # Client Certificate Key
+  #ssl.key: "/etc/pki/client/cert.key"
+
+  # Optional passphrase for decrypting the Certificate Key.
+  #ssl.key_passphrase: ''
+
+  # Configure cipher suites to be used for SSL connections
+  #ssl.cipher_suites: []
+
+  # Configure curve types for ECDHE based cipher suites
+  #ssl.curve_types: []
+
+  # Configure what types of renegotiation are supported. Valid options are
+  # never, once, and freely. Default is never.
+  #ssl.renegotiation: never
+
+#------------------------------- Kafka output ----------------------------------
+#output.kafka:
+  # Boolean flag to enable or disable the output module.
+  #enabled: true
+
+  # The list of Kafka broker addresses from where to fetch the cluster metadata.
+  # The cluster metadata contain the actual Kafka brokers events are published
+  # to.
+  #hosts: ["localhost:9092"]
+
+  # The Kafka topic used for produced events. The setting can be a format string
+  # using any event field. To set the topic from document type use `%{[type]}`.
+  #topic: beats
+
+  # The Kafka event key setting. Use format string to create unique event key.
+  # By default no event key will be generated.
+  #key: ''
+
+  # The Kafka event partitioning strategy. Default hashing strategy is `hash`
+  # using the `output.kafka.key` setting or randomly distributes events if
+  # `output.kafka.key` is not configured.
+  #partition.hash:
+    # If enabled, events will only be published to partitions with reachable
+    # leaders. Default is false.
+    #reachable_only: false
+
+    # Configure alternative event field names used to compute the hash value.
+    # If empty `output.kafka.key` setting will be used.
+    # Default value is empty list.
+    #hash: []
+
+  # Authentication details. Password is required if username is set.
+  #username: ''
+  #password: ''
+
+  # Kafka version icingabeat is assumed to run against. Defaults to the oldest
+  # supported stable version (currently version 0.8.2.0)
+  #version: 0.8.2
+
+  # Metadata update configuration. Metadata do contain leader information
+  # deciding which broker to use when publishing.
+  #metadata:
+    # Max metadata request retry attempts when cluster is in middle of leader
+    # election. Defaults to 3 retries.
+    #retry.max: 3
+
+    # Waiting time between retries during leader elections. Default is 250ms.
+    #retry.backoff: 250ms
+
+    # Refresh metadata interval. Defaults to every 10 minutes.
+    #refresh_frequency: 10m
+
+  # The number of concurrent load-balanced Kafka output workers.
+  #worker: 1
+
+  # The number of times to retry publishing an event after a publishing failure.
+  # After the specified number of retries, the events are typically dropped.
+  # Some Beats, such as Filebeat, ignore the max_retries setting and retry until
+  # all events are published.  Set max_retries to a value less than 0 to retry
+  # until all events are published. The default is 3.
+  #max_retries: 3
+
+  # The maximum number of events to bulk in a single Kafka request. The default
+  # is 2048.
+  #bulk_max_size: 2048
+
+  # The number of seconds to wait for responses from the Kafka brokers before
+  # timing out. The default is 30s.
+  #timeout: 30s
+
+  # The maximum duration a broker will wait for number of required ACKs. The
+  # default is 10s.
+  #broker_timeout: 10s
+
+  # The number of messages buffered for each Kafka broker. The default is 256.
+  #channel_buffer_size: 256
+
+  # The keep-alive period for an active network connection. If 0s, keep-alives
+  # are disabled. The default is 0 seconds.
+  #keep_alive: 0
+
+  # Sets the output compression codec. Must be one of none, snappy and gzip. The
+  # default is gzip.
+  #compression: gzip
+
+  # The maximum permitted size of JSON-encoded messages. Bigger messages will be
+  # dropped. The default value is 1000000 (bytes). This value should be equal to
+  # or less than the broker's message.max.bytes.
+  #max_message_bytes: 1000000
+
+  # The ACK reliability level required from broker. 0=no response, 1=wait for
+  # local commit, -1=wait for all replicas to commit. The default is 1.  Note:
+  # If set to 0, no ACKs are returned by Kafka. Messages might be lost silently
+  # on error.
+  #required_acks: 1
+
+  # The number of seconds to wait for new events between two producer API calls.
+  #flush_interval: 1s
+
+  # The configurable ClientID used for logging, debugging, and auditing
+  # purposes.  The default is "beats".
+  #client_id: beats
+
+  # Enable SSL support. SSL is automatically enabled, if any SSL setting is set.
+  #ssl.enabled: true
+
+  # Optional SSL configuration options. SSL is off by default.
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  # Configure SSL verification mode. If `none` is configured, all server hosts
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `full`.
+  #ssl.verification_mode: full
+
+  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
+  # 1.2 are enabled.
+  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+
+  # Certificate for SSL client authentication
+  #ssl.certificate: "/etc/pki/client/cert.pem"
+
+  # Client Certificate Key
+  #ssl.key: "/etc/pki/client/cert.key"
+
+  # Optional passphrase for decrypting the Certificate Key.
+  #ssl.key_passphrase: ''
+
+  # Configure cipher suites to be used for SSL connections
+  #ssl.cipher_suites: []
+
+  # Configure curve types for ECDHE based cipher suites
+  #ssl.curve_types: []
+
+  # Configure what types of renegotiation are supported. Valid options are
+  # never, once, and freely. Default is never.
+  #ssl.renegotiation: never
+
+#------------------------------- Redis output ----------------------------------
+#output.redis:
+  # Boolean flag to enable or disable the output module.
+  #enabled: true
+
+  # The list of Redis servers to connect to. If load balancing is enabled, the
+  # events are distributed to the servers in the list. If one server becomes
+  # unreachable, the events are distributed to the reachable servers only.
+  #hosts: ["localhost:6379"]
+
+  # The Redis port to use if hosts does not contain a port number. The default
+  # is 6379.
+  #port: 6379
+
+  # The name of the Redis list or channel the events are published to. The
+  # default is icingabeat.
+  #key: icingabeat
+
+  # The password to authenticate with. The default is no authentication.
+  #password:
+
+  # The Redis database number where the events are published. The default is 0.
+  #db: 0
+
+  # The Redis data type to use for publishing events. If the data type is list,
+  # the Redis RPUSH command is used. If the data type is channel, the Redis
+  # PUBLISH command is used. The default value is list.
+  #datatype: list
+
+  # The number of workers to use for each host configured to publish events to
+  # Redis. Use this setting along with the loadbalance option. For example, if
+  # you have 2 hosts and 3 workers, in total 6 workers are started (3 for each
+  # host).
+  #worker: 1
+
+  # If set to true and multiple hosts or workers are configured, the output
+  # plugin load balances published events onto all Redis hosts. If set to false,
+  # the output plugin sends all events to only one host (determined at random)
+  # and will switch to another host if the currently selected one becomes
+  # unreachable. The default value is true.
+  #loadbalance: true
+
+  # The Redis connection timeout in seconds. The default is 5 seconds.
+  #timeout: 5s
+
+  # The number of times to retry publishing an event after a publishing failure.
+  # After the specified number of retries, the events are typically dropped.
+  # Some Beats, such as Filebeat, ignore the max_retries setting and retry until
+  # all events are published. Set max_retries to a value less than 0 to retry
+  # until all events are published. The default is 3.
+  #max_retries: 3
+
+  # The maximum number of events to bulk in a single Redis request or pipeline.
+  # The default is 2048.
+  #bulk_max_size: 2048
+
+  # The URL of the SOCKS5 proxy to use when connecting to the Redis servers. The
+  # value must be a URL with a scheme of socks5://.
+  #proxy_url:
+
+  # This option determines whether Redis hostnames are resolved locally when
+  # using a proxy. The default value is false, which means that name resolution
+  # occurs on the proxy server.
+  #proxy_use_local_resolver: false
+
+  # Enable SSL support. SSL is automatically enabled, if any SSL setting is set.
+  #ssl.enabled: true
+
+  # Configure SSL verification mode. If `none` is configured, all server hosts
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `full`.
+  #ssl.verification_mode: full
+
+  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
+  # 1.2 are enabled.
+  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+
+  # Optional SSL configuration options. SSL is off by default.
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  # Certificate for SSL client authentication
+  #ssl.certificate: "/etc/pki/client/cert.pem"
+
+  # Client Certificate Key
+  #ssl.key: "/etc/pki/client/cert.key"
+
+  # Optional passphrase for decrypting the Certificate Key.
+  #ssl.key_passphrase: ''
+
+  # Configure cipher suites to be used for SSL connections
+  #ssl.cipher_suites: []
+
+  # Configure curve types for ECDHE based cipher suites
+  #ssl.curve_types: []
+
+  # Configure what types of renegotiation are supported. Valid options are
+  # never, once, and freely. Default is never.
+  #ssl.renegotiation: never
+
+
+#------------------------------- File output -----------------------------------
+#output.file:
+  # Boolean flag to enable or disable the output module.
+  #enabled: true
+
+  # Path to the directory where to save the generated files. The option is
+  # mandatory.
+  #path: "/tmp/icingabeat"
+
+  # Name of the generated files. The default is `icingabeat` and it generates
+  # files: `icingabeat`, `icingabeat.1`, `icingabeat.2`, etc.
+  #filename: icingabeat
+
+  # Maximum size in kilobytes of each file. When this size is reached, and on
+  # every icingabeat restart, the files are rotated. The default value is 10240
+  # kB.
+  #rotate_every_kb: 10000
+
+  # Maximum number of files under path. When this number of files is reached,
+  # the oldest file is deleted and the rest are shifted from last to first. The
+  # default is 7 files.
+  #number_of_files: 7
+
+
+#----------------------------- Console output ---------------------------------
+#output.console:
+  # Boolean flag to enable or disable the output module.
+  #enabled: true
+
+  # Pretty print json event
+  #pretty: false
+
+#================================= Paths ======================================
+
+# The home path for the icingabeat installation. This is the default base path
+# for all other path settings and for miscellaneous files that come with the
+# distribution (for example, the sample dashboards).
+# If not set by a CLI flag or in the configuration file, the default for the
+# home path is the location of the binary.
+#path.home:
+
+# The configuration path for the icingabeat installation. This is the default
+# base path for configuration files, including the main YAML configuration file
+# and the Elasticsearch template file. If not set by a CLI flag or in the
+# configuration file, the default for the configuration path is the home path.
+#path.config: ${path.home}
+
+# The data path for the icingabeat installation. This is the default base path
+# for all the files in which icingabeat needs to store its data. If not set by a
+# CLI flag or in the configuration file, the default for the data path is a data
+# subdirectory inside the home path.
+#path.data: ${path.home}/data
+
+# The logs path for a icingabeat installation. This is the default location for
+# the Beat's log files. If not set by a CLI flag or in the configuration file,
+# the default for the logs path is a logs subdirectory inside the home path.
+#path.logs: ${path.home}/logs
+
+#============================== Dashboards =====================================
+# These settings control loading the sample dashboards to the Kibana index. Loading
+# the dashboards is disabled by default and can be enabled either by setting the
+# options here, or by using the `-setup` CLI flag.
+#dashboards.enabled: false
+
+# The URL from where to download the dashboards archive. By default this URL
+# has a value which is computed based on the Beat name and version. For released
+# versions, this URL points to the dashboard archive on the artifacts.elastic.co
+# website.
+#dashboards.url:
+
+# The directory from where to read the dashboards. It is used instead of the URL
+# when it has a value.
+#dashboards.directory:
+
+# The file archive (zip file) from where to read the dashboards. It is used instead
+# of the URL when it has a value.
+#dashboards.file:
+
+# If this option is enabled, the snapshot URL is used instead of the default URL.
+#dashboards.snapshot: false
+
+# The URL from where to download the snapshot version of the dashboards. By default
+# this has a value which is computed based on the Beat name and version.
+#dashboards.snapshot_url
+
+# In case the archive contains the dashboards from multiple Beats, this lets you
+# select which one to load. You can load all the dashboards in the archive by
+# setting this to the empty string.
+#dashboards.beat: icingabeat
+
+# The name of the Kibana index to use for setting the configuration. Default is ".kibana"
+#dashboards.kibana_index: .kibana
+
+# The Elasticsearch index name. This overwrites the index name defined in the
+# dashboards and index pattern. Example: testbeat-*
+#dashboards.index:
+
+#================================ Logging ======================================
+# There are three options for the log output: syslog, file, stderr.
+# Under Windows systems, the log files are per default sent to the file output,
+# under all other system per default to syslog.
+
+# Sets log level. The default log level is info.
+# Available log levels are: critical, error, warning, info, debug
+#logging.level: info
+
+# Enable debug output for selected components. To enable all selectors use ["*"]
+# Other available selectors are "beat", "publish", "service"
+# Multiple selectors can be chained.
+#logging.selectors: [ ]
+
+# Send all logging output to syslog. The default is false.
+#logging.to_syslog: true
+
+# If enabled, icingabeat periodically logs its internal metrics that have changed
+# in the last period. For each metric that changed, the delta from the value at
+# the beginning of the period is logged. Also, the total values for
+# all non-zero internal metrics are logged on shutdown. The default is true.
+#logging.metrics.enabled: true
+
+# The period after which to log the internal metrics. The default is 30s.
+#logging.metrics.period: 30s
+
+# Logging to rotating files files. Set logging.to_files to false to disable logging to
+# files.
+logging.to_files: true
+logging.files:
+  # Configure the path where the logs are written. The default is the logs directory
+  # under the home path (the binary location).
+  #path: /var/log/icingabeat
+
+  # The name of the files where the logs are written to.
+  #name: icingabeat
+
+  # Configure log file size limit. If limit is reached, log file will be
+  # automatically rotated
+  #rotateeverybytes: 10485760 # = 10MB
+
+  # Number of rotated log files to keep. Oldest files will be deleted first.
+  #keepfiles: 7
+
+  # The permissions mask to apply when rotating log files. The default value is 0600.
+  # Must be a valid Unix-style file permissions mask expressed in octal notation.
+  #permissions: 0600

icingabeat.yml

@@ -72,7 +72,7 @@ icingabeat:
   # polling.
   statuspoller.interval: 60s
 
-# ================================== General ===================================
+#================================ General =====================================
 
 # The name of the shipper that publishes the network data. It can be used to group
 # all the transactions sent by a single shipper in the web interface.
@@ -87,10 +87,11 @@ icingabeat:
 #fields:
 #  env: staging
 
-# ================================= Dashboards =================================
+
+#============================== Dashboards =====================================
 # These settings control loading the sample dashboards to the Kibana index. Loading
 # the dashboards is disabled by default and can be enabled either by setting the
-# options here or by using the `setup` command.
+# options here, or by using the `-setup` CLI flag or the `setup` command.
 #setup.dashboards.enabled: false
 
 # The URL from where to download the dashboards archive. By default this URL
@@ -99,7 +100,7 @@ icingabeat:
 # website.
 #setup.dashboards.url:
 
-# =================================== Kibana ===================================
+#============================== Kibana =====================================
 
 # Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
 # This requires a Kibana endpoint configuration.
@@ -111,14 +112,9 @@ setup.kibana:
   # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
   #host: "localhost:5601"
 
-  # Kibana Space ID
+#============================= Elastic Cloud ==================================
-  # ID of the Kibana Space into which the dashboards should be loaded. By default,
-  # the Default Space will be used.
-  #space.id:
 
-# =============================== Elastic Cloud ================================
+# These settings simplify using icingabeat with the Elastic Cloud (https://cloud.elastic.co/).
-
-# These settings simplify using Icingabeat with the Elastic Cloud (https://cloud.elastic.co/).
 
 # The cloud.id setting overwrites the `output.elasticsearch.hosts` and
 # `setup.kibana.host` options.
@@ -129,24 +125,21 @@ setup.kibana:
 # `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
 #cloud.auth:
 
-# ================================== Outputs ===================================
+#================================ Outputs =====================================
 
 # Configure what output to use when sending the data collected by the beat.
 
-# ---------------------------- Elasticsearch Output ----------------------------
+#-------------------------- Elasticsearch output ------------------------------
 output.elasticsearch:
   # Array of hosts to connect to.
   hosts: ["localhost:9200"]
 
-  # Protocol - either `http` (default) or `https`.
+  # Optional protocol and basic auth credentials.
   #protocol: "https"
-
-  # Authentication credentials - either API key or username/password.
-  #api_key: "id:api_key"
   #username: "elastic"
   #password: "changeme"
 
-# ------------------------------ Logstash Output -------------------------------
+#----------------------------- Logstash output --------------------------------
 #output.logstash:
   # The Logstash hosts
   #hosts: ["localhost:5044"]
@@ -161,73 +154,13 @@ output.elasticsearch:
   # Client Certificate Key
   #ssl.key: "/etc/pki/client/cert.key"
 
-# ================================= Processors =================================
+#================================ Logging =====================================
-
-# Configure processors to enhance or manipulate events generated by the beat.
-
-processors:
-  - add_host_metadata: ~
-  - add_cloud_metadata: ~
-  - add_docker_metadata: ~
-
-
-# ================================== Logging ===================================
 
 # Sets log level. The default log level is info.
-# Available log levels are: error, warning, info, debug
+# Available log levels are: critical, error, warning, info, debug
 #logging.level: debug
 
 # At debug level, you can selectively enable logging only for some components.
 # To enable all selectors use ["*"]. Examples of other selectors are "beat",
-# "publisher", "service".
+# "publish", "service".
 #logging.selectors: ["*"]
-
-# ============================= X-Pack Monitoring ==============================
-# Icingabeat can export internal metrics to a central Elasticsearch monitoring
-# cluster.  This requires xpack monitoring to be enabled in Elasticsearch.  The
-# reporting is disabled by default.
-
-# Set to true to enable the monitoring reporter.
-#monitoring.enabled: false
-
-# Sets the UUID of the Elasticsearch cluster under which monitoring data for this
-# Icingabeat instance will appear in the Stack Monitoring UI. If output.elasticsearch
-# is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.
-#monitoring.cluster_uuid:
-
-# Uncomment to send the metrics to Elasticsearch. Most settings from the
-# Elasticsearch output are accepted here as well.
-# Note that the settings should point to your Elasticsearch *monitoring* cluster.
-# Any setting that is not set is automatically inherited from the Elasticsearch
-# output configuration, so if you have the Elasticsearch output configured such
-# that it is pointing to your Elasticsearch monitoring cluster, you can simply
-# uncomment the following line.
-#monitoring.elasticsearch:
-
-# ============================== Instrumentation ===============================
-
-# Instrumentation support for the icingabeat.
-#instrumentation:
-    # Set to true to enable instrumentation of icingabeat.
-    #enabled: false
-
-    # Environment in which icingabeat is running on (eg: staging, production, etc.)
-    #environment: ""
-
-    # APM Server hosts to report instrumentation results to.
-    #hosts:
-    #  - http://localhost:8200
-
-    # API Key for the APM Server(s).
-    # If api_key is set then secret_token will be ignored.
-    #api_key:
-
-    # Secret token for the APM Server(s).
-    #secret_token:
-
-
-# ================================= Migration ==================================
-
-# This allows to enable 6.7 migration aliases
-#migration.6_to_7.enabled: true
-

include/list.go

@@ -1,24 +0,0 @@
-// Licensed to Elasticsearch B.V. under one or more contributor
-// license agreements. See the NOTICE file distributed with
-// this work for additional information regarding copyright
-// ownership. Elasticsearch B.V. licenses this file to you under
-// the Apache License, Version 2.0 (the "License"); you may
-// not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
-// Code generated by beats/dev-tools/cmd/module_include_list/module_include_list.go - DO NOT EDIT.
-
-package include
-
-import (
-	// Import packages that need to register themselves.
-)

magefile.go

@@ -1,118 +0,0 @@
-// +build mage
-
-package main
-
-import (
-	"fmt"
-	"time"
-
-	"github.com/magefile/mage/mg"
-
-	devtools "github.com/elastic/beats/v7/dev-tools/mage"
-	"github.com/elastic/beats/v7/dev-tools/mage/target/build"
-	"github.com/elastic/beats/v7/dev-tools/mage/target/common"
-	"github.com/elastic/beats/v7/dev-tools/mage/target/pkg"
-	"github.com/elastic/beats/v7/dev-tools/mage/target/unittest"
-)
-
-func init() {
-	devtools.SetBuildVariableSources(devtools.DefaultBeatBuildVariableSources)
-
-	devtools.BeatDescription = "Icingabeat fetches data from the Icinga 2 API and forwards it to Elasticsearch or Logstash."
-	devtools.BeatVendor = "Icinga GmbH"
-	devtools.BeatURL = "https://icinga.com/docs/icingabeat"
-	devtools.BeatProjectType = devtools.CommunityProject
-	devtools.CrossBuildMountModcache = true
-}
-
-// Package packages the Beat for distribution.
-// Use SNAPSHOT=true to build snapshots.
-// Use PLATFORMS to control the target platforms.
-func Package() {
-	start := time.Now()
-	defer func() { fmt.Println("package ran for", time.Since(start)) }()
-
-	devtools.UseCommunityBeatPackaging()
-	devtools.PackageKibanaDashboardsFromBuildDir()
-
-	mg.Deps(Update)
-	mg.Deps(build.CrossBuild, build.CrossBuildGoDaemon)
-	mg.SerialDeps(devtools.Package, pkg.PackageTest)
-}
-
-// Update updates the generated files (aka make update).
-func Update() {
-	mg.SerialDeps(Fields, Dashboards, Config, includeList, fieldDocs)
-}
-
-// Fields generates a fields.yml for the Beat.
-func Fields() error {
-	return devtools.GenerateFieldsYAML()
-}
-
-// Config generates both the short/reference/docker configs.
-func Config() error {
-	p := devtools.DefaultConfigFileParams()
-	p.Templates = append(p.Templates, "_meta/config/*.tmpl")
-	return devtools.Config(devtools.AllConfigTypes, p, ".")
-}
-
-func includeList() error {
-	options := devtools.DefaultIncludeListOptions()
-	options.ImportDirs = []string{"protos/*"}
-	options.ModuleDirs = nil
-	return devtools.GenerateIncludeListGo(options)
-}
-
-// Clean cleans all generated files and build artifacts.
-func Clean() error {
-	return devtools.Clean()
-}
-
-// Check formats code, updates generated content, check for common errors, and
-// checks for any modified files.
-func Check() {
-	common.Check()
-}
-
-// Fmt formats source code (.go and .py) and adds license headers.
-func Fmt() {
-	common.Fmt()
-}
-
-// Test runs all available tests
-func Test() {
-	mg.Deps(unittest.GoUnitTest)
-}
-
-// Build builds the Beat binary.
-func Build() error {
-	return build.Build()
-}
-
-// CrossBuild cross-builds the beat for all target platforms.
-func CrossBuild() error {
-	return build.CrossBuild()
-}
-
-// BuildGoDaemon builds the go-daemon binary (use crossBuildGoDaemon).
-func BuildGoDaemon() error {
-	return build.BuildGoDaemon()
-}
-
-// GolangCrossBuild build the Beat binary inside of the golang-builder.
-// Do not use directly, use crossBuild instead.
-func GolangCrossBuild() error {
-	return build.GolangCrossBuild()
-}
-
-// Fields generates fields.yml and fields.go files for the Beat.
-
-func fieldDocs() error {
-	return devtools.Docs.FieldDocs("fields.yml")
-}
-
-// Dashboards collects all the dashboards and generates index patterns.
-func Dashboards() error {
-	return devtools.KibanaDashboards("protos")
-}

main.go

@@ -4,8 +4,6 @@ import (
 	"os"
 
 	"github.com/icinga/icingabeat/cmd"
-
-	_ "github.com/icinga/icingabeat/include"
 )
 
 func main() {

vendor/github.com/elastic/beats/.appveyor.yml

@@ -0,0 +1,111 @@
+# Version format
+version: "{build}"
+
+# Operating system (build VM template)
+os: Windows Server 2012 R2
+
+# Environment variables
+environment:
+  GOPATH: c:\gopath
+  GVM_DL: https://github.com/andrewkroh/gvm/releases/download/v0.0.1/gvm-windows-amd64.exe
+  PYWIN_DL: https://beats-files.s3.amazonaws.com/deps/pywin32-220.win32-py2.7.exe
+  matrix:
+  - PROJ: github.com\elastic\beats\metricbeat
+    BEAT: metricbeat
+  - PROJ: github.com\elastic\beats\filebeat
+    BEAT: filebeat
+  - PROJ: github.com\elastic\beats\winlogbeat
+    BEAT: winlogbeat
+
+# Custom clone folder (variables are not expanded here).
+clone_folder: c:\gopath\src\github.com\elastic\beats
+
+# Cache files until appveyor.yml is modified.
+cache:
+- C:\ProgramData\chocolatey\bin -> .appveyor.yml
+- C:\ProgramData\chocolatey\lib -> .appveyor.yml
+- C:\Users\appveyor\.gvm -> .go-version
+- C:\Windows\System32\gvm.exe -> .appveyor.yml
+- C:\tools\mingw64 -> .appveyor.yml
+- C:\pywin_inst.exe -> .appveyor.yml
+
+# Scripts that run after cloning repository
+install:
+  - ps: >-
+      if(!(Test-Path "C:\Windows\System32\gvm.exe")) {
+        wget "$env:GVM_DL" -Outfile C:\Windows\System32\gvm.exe
+      }
+  - ps: gvm --format=powershell $(Get-Content .go-version) | Invoke-Expression
+  # AppVeyor installed mingw is 32-bit only so install 64-bit version.
+  - ps: >-
+      if(!(Test-Path "C:\tools\mingw64\bin\gcc.exe")) {
+        cinst mingw > mingw-install.txt
+        Push-AppveyorArtifact mingw-install.txt
+      }
+  - set PATH=C:\tools\mingw64\bin;%PATH%
+  - set PATH=%GOPATH%\bin;%PATH%
+  - go install github.com/elastic/beats/vendor/github.com/pierrre/gotestcover
+  - go version
+  - go env
+  # Download the PyWin32 installer if it is not cached.
+  - ps: >-
+      if(!(Test-Path "C:\pywin_inst.exe")) {
+        (new-object net.webclient).DownloadFile("$env:PYWIN_DL", 'C:/pywin_inst.exe')
+      }
+  - set PYTHONPATH=C:\Python27
+  - set PATH=%PYTHONPATH%;%PYTHONPATH%\Scripts;%PATH%
+  - python --version
+  - pip install six jinja2 nose nose-timer PyYAML redis elasticsearch
+  - easy_install C:/pywin_inst.exe
+
+# To run your custom scripts instead of automatic MSBuild
+build_script:
+  # Compile
+  - appveyor AddCompilationMessage "Starting Compile"
+  - ps: cd $env:BEAT
+  - go build
+  - appveyor AddCompilationMessage "Compile Success" -FileName "%BEAT%.exe"
+
+# To run your custom scripts instead of automatic tests
+test_script:
+  # Unit tests
+  - ps: Add-AppveyorTest "Unit Tests" -Outcome Running
+  - mkdir build\coverage
+  - gotestcover -race -coverprofile=build/coverage/integration.cov github.com/elastic/beats/%BEAT%/...
+  - ps: Update-AppveyorTest "Unit Tests" -Outcome Passed
+  # System tests
+  - ps: Add-AppveyorTest "System tests" -Outcome Running
+  - go test -race -c -cover -covermode=atomic -coverpkg ./...
+  - ps: |
+      if ($env:BEAT -eq "metricbeat") {
+        cp .\_meta\fields.common.yml .\_meta\fields.generated.yml
+        python .\scripts\fields_collector.py | out-file -append -encoding UTF8 -filepath .\_meta\fields.generated.yml
+      }
+  - ps: cd tests/system
+  - nosetests --with-timer
+  - ps: Update-AppveyorTest "System tests" -Outcome Passed
+
+after_test:
+  - ps: cd $env:GOPATH\src\$env:PROJ
+  - python ..\dev-tools\aggregate_coverage.py -o build\coverage\system.cov .\build\system-tests\run
+  - python ..\dev-tools\aggregate_coverage.py -o build\coverage\full.cov .\build\coverage
+  - go tool cover -html=build\coverage\full.cov -o build\coverage\full.html
+  - ps: Push-AppveyorArtifact build\coverage\full.cov
+  - ps: Push-AppveyorArtifact build\coverage\full.html
+  # Upload coverage report.
+  - "SET PATH=C:\\Python34;C:\\Python34\\Scripts;%PATH%"
+  - pip install codecov
+  - ps: cd $env:GOPATH\src\github.com\elastic\beats
+  - codecov -X gcov -f "%BEAT%\build\coverage\full.cov"
+
+# Executes for both successful and failed builds
+on_finish:
+  - ps: cd $env:GOPATH\src\$env:PROJ
+  - 7z a -r system-tests-output.zip build\system-tests\run
+  - ps: Push-AppveyorArtifact system-tests-output.zip
+
+# To disable deployment
+deploy: off
+
+# Notifications should only be setup using the AppVeyor UI so that
+# forks can be created without inheriting the settings.

vendor/github.com/elastic/beats/.editorconfig

@@ -0,0 +1,31 @@
+# See: http://editorconfig.org
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[.go]
+indent_size = 4
+indent_style = tab
+
+[*.json]
+indent_size = 4
+indent_style = space
+
+[*.py]
+indent_style = space
+indent_size = 4
+
+[*.yml]
+indent_style = space
+indent_size = 2
+
+[Makefile]
+indent_style = tab
+
+[Vagrantfile]
+indent_size = 2
+indent_style = space

vendor/github.com/elastic/beats/.gitattributes

@@ -0,0 +1,6 @@
+CHANGELOG.md  merge=union
+CHANGELOG.asciidoc  merge=union
+
+# Keep these file types as CRLF (Windows).
+*.bat    text eol=crlf
+*.cmd    text eol=crlf

vendor/github.com/elastic/beats/.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,11 @@
+Please post all questions and issues on https://discuss.elastic.co/c/beats
+before opening a Github Issue. Your questions will reach a wider audience there,
+and if we confirm that there is a bug, then you can open a new issue.
+
+For security vulnerabilities please only send reports to security@elastic.co.
+See https://www.elastic.co/community/security for more information.
+
+For confirmed bugs, please report:
+- Version: 
+- Operating System: 
+- Steps to Reproduce: 

vendor/github.com/elastic/beats/.gitignore

@@ -0,0 +1,32 @@
+# Directories
+/.vagrant
+/.idea
+/.vscode
+/build
+/*/data
+/*/logs
+/*/fields.yml
+/*/*.template*.json
+
+# Files
+.DS_Store
+/beats.iml
+*.dev.yml
+*.generated.yml
+coverage.out
+.python-version
+beat.db
+
+# Editor swap files
+*.swp
+*.swo
+*.swn
+
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+*.exe
+*.test
+*.prof
+*.pyc

vendor/github.com/elastic/beats/.go-version

@@ -0,0 +1 @@
+1.9.2

vendor/github.com/elastic/beats/.pylintrc

@@ -0,0 +1,13 @@
+[MESSAGES CONTROL]
+
+disable=too-many-lines,too-many-public-methods,too-many-statements
+
+
+[BASIC]
+
+method-rgx=[a-z_][a-z0-9_]{2,50}$
+
+
+[FORMAT]
+
+max-line-length=120

vendor/github.com/elastic/beats/.travis.yml

@@ -0,0 +1,156 @@
+sudo: required
+dist: trusty
+services:
+  - docker
+
+language: go
+
+# Make sure project can also be built on travis for clones of the repo
+go_import_path: github.com/elastic/beats
+
+env:
+  global:
+    # Cross-compile for amd64 only to speed up testing.
+    - GOX_FLAGS="-arch amd64"
+    - DOCKER_COMPOSE_VERSION=1.11.1
+    - GO_VERSION="$(cat .go-version)"
+    - TRAVIS_ETCD_VERSION=v3.2.8
+
+jobs:
+  include:
+    # General checks
+    - os: linux
+      env: TARGETS="check"
+      go: $GO_VERSION
+      stage: check
+
+    # Filebeat
+    - os: linux
+      env: TARGETS="-C filebeat testsuite"
+      go: $GO_VERSION
+      stage: test
+    - os: osx
+      env: TARGETS="TEST_ENVIRONMENT=0 -C filebeat testsuite"
+      go: $GO_VERSION
+      stage: test
+
+    # Heartbeat
+    - os: linux
+      env: TARGETS="-C heartbeat testsuite"
+      go: $GO_VERSION
+      stage: test
+    - os: osx
+      env: TARGETS="TEST_ENVIRONMENT=0 -C heartbeat testsuite"
+      go: $GO_VERSION
+      stage: test
+
+    # Auditbeat
+    - os: linux
+      env: TARGETS="-C auditbeat testsuite"
+      go: $GO_VERSION
+      stage: test
+
+    # Libbeat
+    - os: linux
+      env: TARGETS="-C libbeat testsuite"
+      go: $GO_VERSION
+      stage: test
+    - os: linux
+      env: TARGETS="-C libbeat crosscompile"
+      go: $GO_VERSION
+      stage: test
+
+    # Metricbeat
+    - os: linux
+      env: TARGETS="-C metricbeat testsuite"
+      go: $GO_VERSION
+      stage: test
+    - os: osx
+      env: TARGETS="TEST_ENVIRONMENT=0 -C metricbeat testsuite"
+      go: $GO_VERSION
+      stage: test
+    - os: linux
+      env: TARGETS="-C metricbeat crosscompile"
+      go: $GO_VERSION
+      stage: test
+
+    # Packetbeat
+    - os: linux
+      env: TARGETS="-C packetbeat testsuite"
+      go: $GO_VERSION
+      stage: test
+
+    # Winlogbeat
+    - os: linux
+      env: TARGETS="-C winlogbeat crosscompile"
+      go: $GO_VERSION
+      stage: test
+
+    # Generators
+    - os: linux
+      env: TARGETS="-C generator/metricbeat test"
+      go: $GO_VERSION
+      stage: test
+    - os: linux
+      env: TARGETS="-C generator/beat test"
+      go: $GO_VERSION
+      stage: test
+
+    # Kubernetes
+    - os: linux
+      install: deploy/kubernetes/.travis/setup.sh
+      env:
+        - TARGETS="-C deploy/kubernetes test"
+        - TRAVIS_KUBE_VERSION=v1.6.11
+      stage: test
+    - os: linux
+      install: deploy/kubernetes/.travis/setup.sh
+      env:
+        - TARGETS="-C deploy/kubernetes test"
+        - TRAVIS_KUBE_VERSION=v1.7.7
+      stage: test
+    - os: linux
+      install: deploy/kubernetes/.travis/setup.sh
+      env:
+        - TARGETS="-C deploy/kubernetes test"
+        - TRAVIS_KUBE_VERSION=v1.8.0
+      stage: test
+
+addons:
+  apt:
+    packages:
+      - python-virtualenv
+      - libpcap-dev
+
+before_install:
+  - python --version
+  - umask 022
+  - chmod -R go-w $GOPATH/src/github.com/elastic/beats
+  # Docker-compose installation
+  - sudo rm /usr/local/bin/docker-compose || true
+  - curl -L https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-`uname -s`-`uname -m` > docker-compose
+  - chmod +x docker-compose
+  - sudo mv docker-compose /usr/local/bin
+
+# Skips installations step
+install: true
+
+script:
+  - make $TARGETS
+
+notifications:
+  slack:
+    on_success: change
+    on_failure: always
+    on_pull_requests: false
+    rooms:
+      secure: "e25J5puEA31dOooTI4T+K+zrTs8XeWIGq2cgmiPt9u/g7eqWeQj1UJnVsr8GOu1RPDyuJZJHXqfrvuOYJTdHzXbwjD0JTbwwVVZMkkZW2SWZHG46HCXPiucjWXEr3hXJKBJDDpIx6VxrN7r17dejv1biQ8QuEFZfiB1H8kbH/ho="
+
+after_success:
+  # Copy full.cov to coverage.txt because codecov.io requires this file
+  - test -f auditbeat/build/coverage/full.cov && bash <(curl -s https://codecov.io/bash) -f auditbeat/build/coverage/full.cov
+  - test -f filebeat/build/coverage/full.cov && bash <(curl -s https://codecov.io/bash) -f filebeat/build/coverage/full.cov
+  - test -f heartbeat/build/coverage/full.cov && bash <(curl -s https://codecov.io/bash) -f heartbeat/build/coverage/full.cov
+  - test -f libbeat/build/coverage/full.cov && bash <(curl -s https://codecov.io/bash) -f libbeat/build/coverage/full.cov
+  - test -f metricbeat/build/coverage/full.cov && bash <(curl -s https://codecov.io/bash) -f metricbeat/build/coverage/full.cov
+  - test -f packetbeat/build/coverage/full.cov && bash <(curl -s https://codecov.io/bash) -f packetbeat/build/coverage/full.cov

vendor/github.com/elastic/beats/CONTRIBUTING.md

@@ -0,0 +1,17 @@
+Please post all questions and issues first on
+[https://discuss.elastic.co/c/beats](https://discuss.elastic.co/c/beats)
+before opening a Github Issue.
+
+# Contributing to Beats
+
+The Beats are open source and we love to receive contributions from our
+community — you!
+
+There are many ways to contribute, from writing tutorials or blog posts,
+improving the documentation, submitting bug reports and feature requests or
+writing code for implementing a whole new protocol.
+
+If you want to contribute to the Beats project, you can start by reading
+the [contributing guidelines](https://www.elastic.co/guide/en/beats/devguide/current/beats-contributing.html)
+in the _Beats Developer Guide_.
+

vendor/github.com/elastic/beats/LICENSE.txt

@@ -0,0 +1,13 @@
+Copyright (c) 2012–2017 Elastic <http://www.elastic.co>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

vendor/github.com/elastic/beats/Makefile

@@ -0,0 +1,155 @@
+BUILD_DIR=$(CURDIR)/build
+COVERAGE_DIR=$(BUILD_DIR)/coverage
+BEATS=packetbeat filebeat winlogbeat metricbeat heartbeat auditbeat
+PROJECTS=libbeat $(BEATS)
+PROJECTS_ENV=libbeat filebeat metricbeat
+SNAPSHOT?=yes
+PYTHON_ENV?=$(BUILD_DIR)/python-env
+VIRTUALENV_PARAMS?=
+FIND=find . -type f -not -path "*/vendor/*" -not -path "*/build/*" -not -path "*/.git/*"
+GOLINT=golint
+GOLINT_REPO=github.com/golang/lint/golint
+REVIEWDOG=reviewdog
+REVIEWDOG_OPTIONS?=-diff "git diff master"
+REVIEWDOG_REPO=github.com/haya14busa/reviewdog/cmd/reviewdog
+
+# Runs complete testsuites (unit, system, integration) for all beats with coverage and race detection.
+# Also it builds the docs and the generators
+
+.PHONY: testsuite
+testsuite:
+	@$(foreach var,$(PROJECTS),$(MAKE) -C $(var) testsuite || exit 1;)
+
+.PHONY: setup-commit-hook
+setup-commit-hook:
+	@cp script/pre_commit.sh .git/hooks/pre-commit
+	@chmod 751 .git/hooks/pre-commit
+
+stop-environments:
+	@$(foreach var,$(PROJECTS_ENV),$(MAKE) -C $(var) stop-environment || exit 0;)
+
+# Runs unit and system tests without coverage and race detection.
+.PHONY: test
+test:
+	@$(foreach var,$(PROJECTS),$(MAKE) -C $(var) test || exit 1;)
+
+# Runs unit tests without coverage and race detection.
+.PHONY: unit
+unit:
+	@$(foreach var,$(PROJECTS),$(MAKE) -C $(var) unit || exit 1;)
+
+.PHONY: coverage-report
+coverage-report:
+	@mkdir -p $(COVERAGE_DIR)
+	@echo 'mode: atomic' > ./$(COVERAGE_DIR)/full.cov
+	@# Collects all coverage files and skips top line with mode
+	@$(foreach var,$(PROJECTS),tail -q -n +2 ./$(var)/$(COVERAGE_DIR)/*.cov >> ./$(COVERAGE_DIR)/full.cov || true;)
+	@go tool cover -html=./$(COVERAGE_DIR)/full.cov -o $(COVERAGE_DIR)/full.html
+	@echo "Generated coverage report $(COVERAGE_DIR)/full.html"
+
+.PHONY: update
+update: notice
+	@$(foreach var,$(PROJECTS),$(MAKE) -C $(var) update || exit 1;)
+	@$(MAKE) -C deploy/kubernetes all
+
+.PHONY: clean
+clean:
+	@rm -rf build
+	@$(foreach var,$(PROJECTS),$(MAKE) -C $(var) clean || exit 1;)
+	@$(MAKE) -C generator clean
+
+# Cleans up the vendor directory from unnecessary files
+# This should always be run after updating the dependencies
+.PHONY: clean-vendor
+clean-vendor:
+	@sh script/clean_vendor.sh
+
+.PHONY: check
+check: python-env
+	@$(foreach var,$(PROJECTS),$(MAKE) -C $(var) check || exit 1;)
+	@# Checks also python files which are not part of the beats
+	@$(FIND) -name *.py -exec $(PYTHON_ENV)/bin/autopep8 -d --max-line-length 120  {} \; | (! grep . -q) || (echo "Code differs from autopep8's style" && false)
+	@# Validate that all updates were committed
+	@$(MAKE) update
+	@git diff | cat
+	@git update-index --refresh
+	@git diff-index --exit-code HEAD --
+
+# Corrects spelling errors
+.PHONY: misspell
+misspell:
+	go get github.com/client9/misspell
+	# Ignore Kibana files (.json)
+	$(FIND) -not -path "*.json" -name '*' -exec misspell -w {} \;
+
+.PHONY: fmt
+fmt: python-env
+	@$(foreach var,$(PROJECTS),$(MAKE) -C $(var) fmt || exit 1;)
+	@# Cleans also python files which are not part of the beats
+	@$(FIND) -name "*.py" -exec $(PYTHON_ENV)/bin/autopep8 --in-place --max-line-length 120 {} \;
+
+.PHONY: lint
+lint:
+	@go get $(GOLINT_REPO) $(REVIEWDOG_REPO)
+	$(REVIEWDOG) $(REVIEWDOG_OPTIONS)
+
+# Collects all dashboards and generates dashboard folder for https://github.com/elastic/beats-dashboards/tree/master/dashboards
+.PHONY: beats-dashboards
+beats-dashboards:
+	@mkdir -p build/dashboards
+	@$(foreach var,$(BEATS),cp -r $(var)/_meta/kibana/ build/dashboards/$(var)  || exit 1;)
+
+# Builds the documents for each beat
+.PHONY: docs
+docs:
+	@$(foreach var,$(PROJECTS),BUILD_DIR=${BUILD_DIR} $(MAKE) -C $(var) docs || exit 1;)
+	sh ./script/build_docs.sh dev-guide github.com/elastic/beats/docs/devguide ${BUILD_DIR}
+
+.PHONY: package
+package: update beats-dashboards
+	@$(foreach var,$(BEATS),SNAPSHOT=$(SNAPSHOT) $(MAKE) -C $(var) package || exit 1;)
+
+	@echo "Start building the dashboards package"
+	@mkdir -p build/upload/
+	@BUILD_DIR=${BUILD_DIR} SNAPSHOT=$(SNAPSHOT) $(MAKE) -C dev-tools/packer package-dashboards ${BUILD_DIR}/upload/build_id.txt
+	@mv build/upload build/dashboards-upload
+
+	@# Copy build files over to top build directory
+	@mkdir -p build/upload/
+	@$(foreach var,$(BEATS),cp -r $(var)/build/upload/ build/upload/$(var)  || exit 1;)
+	@cp -r build/dashboards-upload build/upload/dashboards
+	@# Run tests on the generated packages.
+	@go test ./dev-tools/package_test.go -files "${BUILD_DIR}/upload/*/*"
+
+# Upload nightly builds to S3
+.PHONY: upload-nightlies-s3
+upload-nightlies-s3: all
+	aws s3 cp --recursive --acl public-read build/upload s3://beats-nightlies
+
+# Run after building to sign packages and publish to APT and YUM repos.
+.PHONY: package-upload
+upload-package:
+	$(MAKE) -C dev-tools/packer deb-rpm-s3
+	# You must export AWS_ACCESS_KEY=<AWS access> and export AWS_SECRET_KEY=<secret>
+	# before running this make target.
+	dev-tools/packer/docker/deb-rpm-s3/deb-rpm-s3.sh
+
+.PHONY: release-upload
+upload-release:
+	aws s3 cp --recursive --acl public-read build/upload s3://download.elasticsearch.org/beats/
+
+.PHONY: notice
+notice: python-env
+	@echo "Generating NOTICE"
+	@$(PYTHON_ENV)/bin/python dev-tools/generate_notice.py .
+
+# Sets up the virtual python environment
+.PHONY: python-env
+python-env:
+	@test -d $(PYTHON_ENV) || virtualenv $(VIRTUALENV_PARAMS) $(PYTHON_ENV)
+	@$(PYTHON_ENV)/bin/pip install -q --upgrade pip autopep8 six
+
+# Tests if apm works with the current code
+.PHONY: test-apm
+test-apm:
+	sh ./script/test_apm.sh

vendor/github.com/elastic/beats/README.md

@@ -0,0 +1,78 @@
+[![Travis](https://travis-ci.org/elastic/beats.svg?branch=master)](https://travis-ci.org/elastic/beats)
+[![AppVeyor](https://ci.appveyor.com/api/projects/status/p7y92i6pp2v7vnrd/branch/master?svg=true)](https://ci.appveyor.com/project/elastic-beats/beats/branch/master)
+[![GoReportCard](http://goreportcard.com/badge/elastic/beats)](http://goreportcard.com/report/elastic/beats)
+[![codecov.io](https://codecov.io/github/elastic/beats/coverage.svg?branch=master)](https://codecov.io/github/elastic/beats?branch=master)
+
+# Beats - The Lightweight Shippers of the Elastic Stack
+
+The [Beats](https://www.elastic.co/products/beats) are lightweight data
+shippers, written in Go, that you install on your servers to capture all sorts
+of operational data (think of logs, metrics, or network packet data). The Beats
+send the operational data to Elasticsearch, either directly or via Logstash, so
+it can be visualized with Kibana.
+
+By "lightweight", we mean that Beats have a small installation footprint, use
+limited system resources, and have no runtime dependencies.
+
+This repository contains
+[libbeat](https://github.com/elastic/beats/tree/master/libbeat), our Go
+framework for creating Beats, and all the officially supported Beats:
+
+Beat  | Description
+--- | ---
+[Filebeat](https://github.com/elastic/beats/tree/master/filebeat) | Tails and ships log files
+[Heartbeat](https://github.com/elastic/beats/tree/master/heartbeat) | Ping remote services for availability
+[Metricbeat](https://github.com/elastic/beats/tree/master/metricbeat) | Fetches sets of metrics from the operating system and services
+[Packetbeat](https://github.com/elastic/beats/tree/master/packetbeat) | Monitors the network and applications by sniffing packets
+[Winlogbeat](https://github.com/elastic/beats/tree/master/winlogbeat) | Fetches and ships Windows Event logs
+
+In addition to the above Beats, which are officially supported by
+[Elastic](https://elastic.co), the
+community has created a set of other Beats that make use of libbeat but live
+outside of this Github repository. We maintain a list of community Beats
+[here](https://www.elastic.co/guide/en/beats/libbeat/master/community-beats.html).
+
+## Documentation and Getting Started
+
+You can find the documentation and getting started guides for each of the Beats
+on the [elastic.co site](https://www.elastic.co/guide/):
+
+* [Beats platform](https://www.elastic.co/guide/en/beats/libbeat/current/index.html)
+* [Filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/index.html)
+* [Heartbeat](https://www.elastic.co/guide/en/beats/heartbeat/current/index.html)
+* [Metricbeat](https://www.elastic.co/guide/en/beats/metricbeat/current/index.html)
+* [Packetbeat](https://www.elastic.co/guide/en/beats/packetbeat/current/index.html)
+* [Winlogbeat](https://www.elastic.co/guide/en/beats/winlogbeat/current/index.html)
+
+
+## Getting Help
+
+If you need help or hit an issue, please start by opening a topic on our
+[discuss forums](https://discuss.elastic.co/c/beats). Please note that we
+reserve GitHub tickets for confirmed bugs and enhancement requests.
+
+## Downloads
+
+You can download pre-compiled Beats binaries, as well as packages for the
+supported platforms, from [this page](https://www.elastic.co/downloads/beats).
+
+## Contributing
+
+We'd love working with you! You can help make the Beats better in many ways:
+report issues, help us reproduce issues, fix bugs, add functionality, or even
+create your own Beat.
+
+Please start by reading our [CONTRIBUTING](CONTRIBUTING.md) file.
+
+If you are creating a new Beat, you don't need to submit the code to this
+repository. You can simply start working in a new repository and make use of
+the libbeat packages, by following our [developer
+guide](https://www.elastic.co/guide/en/beats/libbeat/current/new-beat.html).
+After you have a working prototype, open a pull request to add your Beat to the
+list of [community
+Beats](https://github.com/elastic/beats/blob/master/libbeat/docs/communitybeats.asciidoc).
+
+## Building Beats from the Source
+
+See our [CONTRIBUTING](CONTRIBUTING.md) file for information about setting up your dev
+environment to build Beats from the source.

vendor/github.com/elastic/beats/Vagrantfile

@@ -0,0 +1,137 @@
+### Documentation
+# This is a Vagrantfile for Beats development.
+#
+# Boxes
+# =====
+#
+# win2012
+# -------
+# This box is used as a Windows development and testing environment for Beats.
+#
+# Usage and Features:
+#   - Two users exist: Administrator and Vagrant. Both have the password: vagrant
+#   - Use 'vagrant ssh' to open a Windows command prompt.
+#   - Use 'vagrant rdp' to open a Windows Remote Deskop session. Mac users must
+#     install the Microsoft Remote Desktop Client from the App Store.
+#   - There is a desktop shortcut labeled "Beats Shell" that opens a command prompt
+#     to C:\Gopath\src\github.com\elastic\beats where the code is mounted.
+#
+# solaris
+# -------------------
+#   - Use gmake instead of make.
+#
+# freebsd and openbsd
+# -------------------
+#   - Use gmake instead of make.
+#   - Folder syncing doesn't work well. Consider copying the files into the box or
+#     cloning the project inside the box.
+
+# Provisioning for Windows PowerShell
+$winPsProvision = <<SCRIPT
+echo 'Creating github.com\elastic in the GOPATH'
+New-Item -itemtype directory -path "C:\\Gopath\\src\\github.com\\elastic" -force
+echo "Symlinking C:\\Vagrant to C:\\Gopath\\src\\github.com\\elastic"
+cmd /c mklink /d C:\\Gopath\\src\\github.com\\elastic\\beats \\\\vboxsvr\\vagrant
+
+echo "Creating Beats Shell desktop shortcut"
+$WshShell = New-Object -comObject WScript.Shell
+$Shortcut = $WshShell.CreateShortcut("$Home\\Desktop\\Beats Shell.lnk")
+$Shortcut.TargetPath = "cmd.exe"
+$Shortcut.Arguments = "/K cd /d C:\\Gopath\\src\\github.com\\elastic\\beats"
+$Shortcut.Save()
+
+echo "Disable automatic updates"
+$AUSettigns = (New-Object -com "Microsoft.Update.AutoUpdate").Settings
+$AUSettigns.NotificationLevel = 1
+$AUSettigns.Save()
+SCRIPT
+
+# Provisioning for Unix/Linux
+$unixProvision = <<SCRIPT
+echo 'Creating github.com/elastic in the GOPATH'
+mkdir -p ~/go/src/github.com/elastic
+echo 'Symlinking /vagrant to ~/go/src/github.com/elastic'
+cd ~/go/src/github.com/elastic
+if [ -d "/vagrant" ]; then ln -s /vagrant beats; fi
+SCRIPT
+
+# Linux GVM
+$linuxGvmProvision = <<SCRIPT
+mkdir -p ~/bin
+curl -sL -o ~/bin/gvm https://github.com/andrewkroh/gvm/releases/download/v0.0.1/gvm-linux-amd64
+chmod +x ~/bin/gvm
+echo 'export PATH=~/bin:$PATH' >> ~/.bash_profile
+echo 'eval "$(gvm 1.9.2)"' >> ~/.bash_profile
+SCRIPT
+
+Vagrant.configure(2) do |config|
+
+  # Windows Server 2012 R2
+  config.vm.define "win2012", primary: true do |win2012|
+
+    win2012.vm.box = "https://s3.amazonaws.com/beats-files/vagrant/beats-win2012-r2-virtualbox-2016-10-28_1224.box"
+    win2012.vm.guest = :windows
+
+    # Communicator for windows boxes
+    win2012.vm.communicator = "winrm"
+
+    # Port forward WinRM and RDP
+    win2012.vm.network :forwarded_port, guest: 22,   host: 2222,  id: "ssh", auto_correct: true
+    win2012.vm.network :forwarded_port, guest: 3389, host: 33389, id: "rdp", auto_correct: true
+    win2012.vm.network :forwarded_port, guest: 5985, host: 55985, id: "winrm", auto_correct: true
+
+    win2012.vm.provision "shell", inline: $winPsProvision
+  end
+
+  # Solaris 11.2
+  config.vm.define "solaris", primary: true do |solaris|
+    solaris.vm.box = "https://s3.amazonaws.com/beats-files/vagrant/beats-solaris-11.2-virtualbox-2016-11-02_1603.box"
+    solaris.vm.network :forwarded_port, guest: 22,   host: 2223,  id: "ssh", auto_correct: true
+
+    solaris.vm.provision "shell", inline: $unixProvision, privileged: false
+  end
+
+  # FreeBSD 11.0
+  config.vm.define "freebsd", primary: true do |freebsd|
+    freebsd.vm.box = "https://s3.amazonaws.com/beats-files/vagrant/beats-freebsd-11.0-virtualbox-2016-11-02_1638.box"
+    freebsd.vm.network :forwarded_port, guest: 22,   host: 2224,  id: "ssh", auto_correct: true
+
+    # Must use NFS to sync a folder on FreeBSD and this requires a host-only network.
+    # To enable the /vagrant folder, set disabled to false and uncomment the private_network.
+    config.vm.synced_folder ".", "/vagrant", id: "vagrant-root", :nfs => true, disabled: true
+    #config.vm.network "private_network", ip: "192.168.135.18"
+
+    freebsd.vm.hostname = "beats-tester"
+    freebsd.vm.provision "shell", inline: $unixProvision, privileged: false
+  end
+
+  # OpenBSD 5.9-stable
+  config.vm.define "openbsd", primary: true do |openbsd|
+    openbsd.vm.box = "https://s3.amazonaws.com/beats-files/vagrant/beats-openbsd-5.9-current-virtualbox-2016-11-02_2007.box"
+    openbsd.vm.network :forwarded_port, guest: 22,   host: 2225,  id: "ssh", auto_correct: true
+
+    config.vm.synced_folder ".", "/vagrant", type: "rsync", disabled: true
+    config.vm.provider :virtualbox do |vbox|
+      vbox.check_guest_additions = false
+      vbox.functional_vboxsf = false
+    end
+
+    openbsd.vm.provision "shell", inline: $unixProvision, privileged: false
+  end
+
+  # CentOS 7
+  config.vm.define "centos7", primary: true do |centos7|
+    #centos7.vm.box = "http://cloud.centos.org/centos/7/vagrant/x86_64/images/CentOS-7-x86_64-Vagrant-1706_02.VirtualBox.box"
+    centos7.vm.box = "ubuntu/precise64"
+    centos7.vm.network :forwarded_port, guest: 22,   host: 2226,  id: "ssh", auto_correct: true
+
+    centos7.vm.provision "shell", inline: $unixProvision, privileged: false
+    centos7.vm.provision "shell", inline: $linuxGvmProvision, privileged: false
+
+    centos7.vm.synced_folder ".", "/vagrant", type: "virtualbox"
+  end
+
+end
+
+# -*- mode: ruby -*-
+# vi: set ft=ruby :

vendor/github.com/elastic/beats/auditbeat/.gitignore

@@ -0,0 +1,10 @@
+build
+_meta/kibana
+_meta/beat.yml
+_meta/beat.reference.yml
+module/*/_meta/config.yml
+
+/auditbeat
+/auditbeat.test
+/docs/html_docs
+

vendor/github.com/elastic/beats/auditbeat/Makefile

@@ -0,0 +1,77 @@
+BEAT_NAME=auditbeat
+BEAT_TITLE=Auditbeat
+BEAT_DESCRIPTION=Audit the activities of users and processes on your system.
+SYSTEM_TESTS=false
+TEST_ENVIRONMENT=false
+
+# Path to the libbeat Makefile
+-include ../libbeat/scripts/Makefile
+
+# This is called by the beats packer before building starts
+.PHONY: before-build
+before-build:
+	@cat ${ES_BEATS}/auditbeat/_meta/common.p1.yml \
+	     <(go run scripts/generate_config.go -os windows -concat) \
+	     ${ES_BEATS}/auditbeat/_meta/common.p2.yml \
+	     ${ES_BEATS}/libbeat/_meta/config.yml > \
+	     ${PREFIX}/${BEAT_NAME}-win.yml
+	@cat ${ES_BEATS}/auditbeat/_meta/common.reference.yml \
+	     <(go run scripts/generate_config.go -os windows -concat) \
+	     ${ES_BEATS}/libbeat/_meta/config.reference.yml > \
+	     ${PREFIX}/${BEAT_NAME}-win.reference.yml
+
+	@cat ${ES_BEATS}/auditbeat/_meta/common.p1.yml \
+	     <(go run scripts/generate_config.go -os darwin -concat) \
+	     ${ES_BEATS}/auditbeat/_meta/common.p2.yml \
+	     ${ES_BEATS}/libbeat/_meta/config.yml > \
+	     ${PREFIX}/${BEAT_NAME}-darwin.yml
+	@cat ${ES_BEATS}/auditbeat/_meta/common.reference.yml \
+	     <(go run scripts/generate_config.go -os darwin -concat) \
+	     ${ES_BEATS}/libbeat/_meta/config.reference.yml > \
+	     ${PREFIX}/${BEAT_NAME}-darwin.reference.yml
+
+	@cat ${ES_BEATS}/auditbeat/_meta/common.p1.yml \
+	     <(go run scripts/generate_config.go -os linux -concat) \
+	     ${ES_BEATS}/auditbeat/_meta/common.p2.yml \
+	     ${ES_BEATS}/libbeat/_meta/config.yml > \
+	     ${PREFIX}/${BEAT_NAME}-linux.yml
+	@cat ${ES_BEATS}/auditbeat/_meta/common.reference.yml \
+	     <(go run scripts/generate_config.go -os linux -concat) \
+	     ${ES_BEATS}/libbeat/_meta/config.reference.yml > \
+	     ${PREFIX}/${BEAT_NAME}-linux.reference.yml
+
+# Collects all dependencies and then calls update
+.PHONY: collect
+collect: fields collect-docs configs kibana
+
+# Collects all module and metricset fields
+.PHONY: fields
+fields: python-env
+	@mkdir -p _meta
+	@cp ${ES_BEATS}/metricbeat/_meta/fields.common.yml _meta/fields.generated.yml
+	@${PYTHON_ENV}/bin/python ${ES_BEATS}/metricbeat/scripts/fields_collector.py >> _meta/fields.generated.yml
+
+# Collects all module configs
+.PHONY: configs
+configs: python-env
+	@cat ${ES_BEATS}/auditbeat/_meta/common.p1.yml \
+	     <(go run scripts/generate_config.go -os linux -concat) \
+		 ${ES_BEATS}/auditbeat/_meta/common.p2.yml > _meta/beat.yml
+	@cat ${ES_BEATS}/auditbeat/_meta/common.reference.yml \
+	     <(go run scripts/generate_config.go -os linux -ref -concat) > _meta/beat.reference.yml
+
+# Collects all module docs
+.PHONY: collect-docs
+collect-docs: python-env
+	@rm -rf docs/modules
+	@mkdir -p docs/modules
+	@go run scripts/generate_config.go -os linux
+	@${PYTHON_ENV}/bin/python ${ES_BEATS}/auditbeat/scripts/docs_collector.py --beat ${BEAT_NAME}
+
+# Collects all module dashboards
+.PHONY: kibana
+kibana:
+	@-rm -rf _meta/kibana/dashboard _meta/kibana/search _meta/kibana/visualization # Skip index-pattern
+	@mkdir -p _meta/kibana
+	@-cp -pr module/*/_meta/kibana _meta/
+

vendor/github.com/elastic/beats/auditbeat/_meta/common.p1.yml

@@ -0,0 +1,12 @@
+###################### Auditbeat Configuration Example #########################
+
+# This is an example configuration file highlighting only the most common
+# options. The auditbeat.reference.yml file from the same directory contains all
+# the supported options with more comments. You can use it as a reference.
+#
+# You can find the full configuration reference here:
+# https://www.elastic.co/guide/en/beats/auditbeat/index.html
+
+#==========================  Modules configuration =============================
+auditbeat.modules:
+

vendor/github.com/elastic/beats/auditbeat/_meta/common.p2.yml

@@ -0,0 +1,6 @@
+
+#==================== Elasticsearch template setting ==========================
+setup.template.settings:
+  index.number_of_shards: 3
+  #index.codec: best_compression
+  #_source.enabled: false

vendor/github.com/elastic/beats/auditbeat/_meta/common.reference.yml

@@ -0,0 +1,31 @@
+########################## Auditbeat Configuration #############################
+
+# This is a reference configuration file documenting all non-deprecated options
+# in comments. For a shorter configuration example that contains only the most
+# common options, please see auditbeat.yml in the same directory.
+#
+# You can find the full configuration reference here:
+# https://www.elastic.co/guide/en/beats/auditbeat/index.html
+
+#============================  Config Reloading ================================
+
+# Config reloading allows to dynamically load modules. Each file which is
+# monitored must contain one or multiple modules as a list.
+auditbeat.config.modules:
+
+  # Glob pattern for configuration reloading
+  path: ${path.config}/conf.d/*.yml
+
+  # Period on which files under path should be checked for changes
+  reload.period: 10s
+
+  # Set to true to enable config reloading
+  reload.enabled: false
+
+# Maximum amount of time to randomly delay the start of a metricset. Use 0 to
+# disable startup delay.
+auditbeat.max_start_delay: 10s
+
+#==========================  Modules configuration =============================
+auditbeat.modules:
+

vendor/github.com/elastic/beats/auditbeat/_meta/fields.common.yml

@@ -0,0 +1,36 @@
+- key: common
+  title: Common
+  description: >
+    Contains common fields available in all event types.
+  fields:
+
+    - name: metricset.module
+      description: >
+        The name of the module that generated the event.
+
+    - name: metricset.name
+      description: >
+        The name of the metricset that generated the event.
+
+    - name: metricset.host
+      description: >
+        Hostname of the machine from which the metricset was collected. This
+        field may not be present when the data was collected locally.
+
+    - name: metricset.rtt
+      type: long
+      required: true
+      description: >
+        Event round trip time in microseconds.
+
+    - name: metricset.namespace
+      type: keyword
+      description: >
+        Namespace of dynamic metricsets.
+
+    - name: type
+      required: true
+      example: metricsets
+      description: >
+        The document type. Always set to "metricsets".
+

vendor/github.com/elastic/beats/auditbeat/auditbeat.reference.yml

@@ -0,0 +1,872 @@
+########################## Auditbeat Configuration #############################
+
+# This is a reference configuration file documenting all non-deprecated options
+# in comments. For a shorter configuration example that contains only the most
+# common options, please see auditbeat.yml in the same directory.
+#
+# You can find the full configuration reference here:
+# https://www.elastic.co/guide/en/beats/auditbeat/index.html
+
+#============================  Config Reloading ================================
+
+# Config reloading allows to dynamically load modules. Each file which is
+# monitored must contain one or multiple modules as a list.
+auditbeat.config.modules:
+
+  # Glob pattern for configuration reloading
+  path: ${path.config}/conf.d/*.yml
+
+  # Period on which files under path should be checked for changes
+  reload.period: 10s
+
+  # Set to true to enable config reloading
+  reload.enabled: false
+
+# Maximum amount of time to randomly delay the start of a metricset. Use 0 to
+# disable startup delay.
+auditbeat.max_start_delay: 10s
+
+#==========================  Modules configuration =============================
+auditbeat.modules:
+
+# The kernel metricset collects events from the audit framework in the Linux
+# kernel. You need to specify audit rules for the events that you want to audit.
+- module: audit
+  metricsets: [kernel]
+  kernel.resolve_ids: true
+  kernel.failure_mode: silent
+  kernel.backlog_limit: 8196
+  kernel.rate_limit: 0
+  kernel.include_raw_message: false
+  kernel.include_warnings: false
+  kernel.audit_rules: |
+    ## Define audit rules here.
+    ## Create file watches (-w) or syscall audits (-a or -A). Uncomment these
+    ## examples or add your own rules.
+
+    ## If you are on a 64 bit platform, everything should be running
+    ## in 64 bit mode. This rule will detect any use of the 32 bit syscalls
+    ## because this might be a sign of someone exploiting a hole in the 32
+    ## bit API.
+    #-a always,exit -F arch=b32 -S all -F key=32bit-abi
+
+    ## Executions.
+    #-a always,exit -F arch=b64 -S execve,execveat -k exec
+
+    ## External access.
+    #-a always,exit -F arch=b64 -S accept,bind,connect,recvfrom -F key=external-access
+
+    ## Identity changes.
+    #-w /etc/group -p wa -k identity
+    #-w /etc/passwd -p wa -k identity
+    #-w /etc/gshadow -p wa -k identity
+
+    ## Unauthorized access attempts.
+    #-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -k access
+    #-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access
+
+# The file integrity metricset sends events when files are changed (created,
+# updated, deleted). The events contain file metadata and hashes.
+- module: audit
+  metricsets: [file]
+  file.paths:
+  - /bin
+  - /usr/bin
+  - /sbin
+  - /usr/sbin
+  - /etc
+  
+  # Scan over the configured file paths at startup and send events for new or
+  # modified files since the last time Auditbeat was running.
+  file.scan_at_start: true
+
+  # Average scan rate. This throttles the amount of CPU and I/O that Auditbeat
+  # consumes at startup while scanning. Default is "50 MiB".
+  file.scan_rate_per_sec: 50 MiB
+
+  # Limit on the size of files that will be hashed. Default is "100 MiB".
+  file.max_file_size: 100 MiB
+
+  # Hash types to compute when the file changes. Supported types are md5, sha1,
+  # sha224, sha256, sha384, sha512, sha512_224, sha512_256, sha3_224, sha3_256,
+  # sha3_384 and sha3_512. Default is sha1.
+  file.hash_types: [sha1]
+
+
+#================================ General ======================================
+
+# The name of the shipper that publishes the network data. It can be used to group
+# all the transactions sent by a single shipper in the web interface.
+# If this options is not defined, the hostname is used.
+#name:
+
+# The tags of the shipper are included in their own field with each
+# transaction published. Tags make it easy to group servers by different
+# logical properties.
+#tags: ["service-X", "web-tier"]
+
+# Optional fields that you can specify to add additional information to the
+# output. Fields can be scalar values, arrays, dictionaries, or any nested
+# combination of these.
+#fields:
+#  env: staging
+
+# If this option is set to true, the custom fields are stored as top-level
+# fields in the output document instead of being grouped under a fields
+# sub-dictionary. Default is false.
+#fields_under_root: false
+
+# Internal queue configuration for buffering events to be published.
+#queue:
+  # Queue type by name (default 'mem')
+  # The memory queue will present all available events (up to the outputs
+  # bulk_max_size) to the output, the moment the output is ready to server
+  # another batch of events.
+  #mem:
+    # Max number of events the queue can buffer.
+    #events: 4096
+
+    # Hints the minimum number of events stored in the queue,
+    # before providing a batch of events to the outputs.
+    # A value of 0 (the default) ensures events are immediately available
+    # to be sent to the outputs.
+    #flush.min_events: 2048
+
+    # Maximum duration after which events are available to the outputs,
+    # if the number of events stored in the queue is < min_flush_events.
+    #flush.timeout: 1s
+
+# Sets the maximum number of CPUs that can be executing simultaneously. The
+# default is the number of logical CPUs available in the system.
+#max_procs:
+
+#================================ Processors ===================================
+
+# Processors are used to reduce the number of fields in the exported event or to
+# enhance the event with external metadata. This section defines a list of
+# processors that are applied one by one and the first one receives the initial
+# event:
+#
+#   event -> filter1 -> event1 -> filter2 ->event2 ...
+#
+# The supported processors are drop_fields, drop_event, include_fields, and
+# add_cloud_metadata.
+#
+# For example, you can use the following processors to keep the fields that
+# contain CPU load percentages, but remove the fields that contain CPU ticks
+# values:
+#
+#processors:
+#- include_fields:
+#    fields: ["cpu"]
+#- drop_fields:
+#    fields: ["cpu.user", "cpu.system"]
+#
+# The following example drops the events that have the HTTP response code 200:
+#
+#processors:
+#- drop_event:
+#    when:
+#       equals:
+#           http.code: 200
+#
+# The following example enriches each event with metadata from the cloud
+# provider about the host machine. It works on EC2, GCE, DigitalOcean,
+# Tencent Cloud, and Alibaba Cloud.
+#
+#processors:
+#- add_cloud_metadata: ~
+#
+# The following example enriches each event with the machine's local time zone
+# offset from UTC.
+#
+#processors:
+#- add_locale:
+#    format: offset
+#
+# The following example enriches each event with docker metadata, it matches
+# given fields to an existing container id and adds info from that container:
+#
+#processors:
+#- add_docker_metadata:
+#    host: "unix:///var/run/docker.sock"
+#    match_fields: ["system.process.cgroup.id"]
+#    # To connect to Docker over TLS you must specify a client and CA certificate.
+#    #ssl:
+#    #  certificate_authority: "/etc/pki/root/ca.pem"
+#    #  certificate:           "/etc/pki/client/cert.pem"
+#    #  key:                   "/etc/pki/client/cert.key"
+#
+# The following example enriches each event with docker metadata, it matches
+# container id from log path available in `source` field (by default it expects
+# it to be /var/lib/docker/containers/*/*.log).
+#
+#processors:
+#- add_docker_metadata: ~
+
+#============================= Elastic Cloud ==================================
+
+# These settings simplify using auditbeat with the Elastic Cloud (https://cloud.elastic.co/).
+
+# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
+# `setup.kibana.host` options.
+# You can find the `cloud.id` in the Elastic Cloud web UI.
+#cloud.id:
+
+# The cloud.auth setting overwrites the `output.elasticsearch.username` and
+# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
+#cloud.auth:
+
+#================================ Outputs ======================================
+
+# Configure what output to use when sending the data collected by the beat.
+
+#-------------------------- Elasticsearch output -------------------------------
+output.elasticsearch:
+  # Boolean flag to enable or disable the output module.
+  #enabled: true
+
+  # Array of hosts to connect to.
+  # Scheme and port can be left out and will be set to the default (http and 9200)
+  # In case you specify and additional path, the scheme is required: http://localhost:9200/path
+  # IPv6 addresses should always be defined as: https://[2001:db8::1]:9200
+  hosts: ["localhost:9200"]
+
+  # Set gzip compression level.
+  #compression_level: 0
+
+  # Optional protocol and basic auth credentials.
+  #protocol: "https"
+  #username: "elastic"
+  #password: "changeme"
+
+  # Dictionary of HTTP parameters to pass within the url with index operations.
+  #parameters:
+    #param1: value1
+    #param2: value2
+
+  # Number of workers per Elasticsearch host.
+  #worker: 1
+
+  # Optional index name. The default is "auditbeat" plus date
+  # and generates [auditbeat-]YYYY.MM.DD keys.
+  # In case you modify this pattern you must update setup.template.name and setup.template.pattern accordingly.
+  #index: "auditbeat-%{[beat.version]}-%{+yyyy.MM.dd}"
+
+  # Optional ingest node pipeline. By default no pipeline will be used.
+  #pipeline: ""
+
+  # Optional HTTP Path
+  #path: "/elasticsearch"
+
+  # Custom HTTP headers to add to each request
+  #headers:
+  #  X-My-Header: Contents of the header
+
+  # Proxy server url
+  #proxy_url: http://proxy:3128
+
+  # The number of times a particular Elasticsearch index operation is attempted. If
+  # the indexing operation doesn't succeed after this many retries, the events are
+  # dropped. The default is 3.
+  #max_retries: 3
+
+  # The maximum number of events to bulk in a single Elasticsearch bulk API index request.
+  # The default is 50.
+  #bulk_max_size: 50
+
+  # Configure http request timeout before failing an request to Elasticsearch.
+  #timeout: 90
+
+  # Use SSL settings for HTTPS. Default is true.
+  #ssl.enabled: true
+
+  # Configure SSL verification mode. If `none` is configured, all server hosts
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `full`.
+  #ssl.verification_mode: full
+
+  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
+  # 1.2 are enabled.
+  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+
+  # SSL configuration. By default is off.
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  # Certificate for SSL client authentication
+  #ssl.certificate: "/etc/pki/client/cert.pem"
+
+  # Client Certificate Key
+  #ssl.key: "/etc/pki/client/cert.key"
+
+  # Optional passphrase for decrypting the Certificate Key.
+  #ssl.key_passphrase: ''
+
+  # Configure cipher suites to be used for SSL connections
+  #ssl.cipher_suites: []
+
+  # Configure curve types for ECDHE based cipher suites
+  #ssl.curve_types: []
+
+  # Configure what types of renegotiation are supported. Valid options are
+  # never, once, and freely. Default is never.
+  #ssl.renegotiation: never
+
+
+#----------------------------- Logstash output ---------------------------------
+#output.logstash:
+  # Boolean flag to enable or disable the output module.
+  #enabled: true
+
+  # The Logstash hosts
+  #hosts: ["localhost:5044"]
+
+  # Number of workers per Logstash host.
+  #worker: 1
+
+  # Set gzip compression level.
+  #compression_level: 3
+
+  # Optional maximum time to live for a connection to Logstash, after which the
+  # connection will be re-established.  A value of `0s` (the default) will
+  # disable this feature.
+  #
+  # Not yet supported for async connections (i.e. with the "pipelining" option set)
+  #ttl: 30s
+
+  # Optional load balance the events between the Logstash hosts. Default is false.
+  #loadbalance: false
+
+  # Number of batches to be sent asynchronously to logstash while processing
+  # new batches.
+  #pipelining: 5
+
+  # If enabled only a subset of events in a batch of events is transferred per
+  # transaction.  The number of events to be sent increases up to `bulk_max_size`
+  # if no error is encountered.
+  #slow_start: false
+
+  # Optional index name. The default index name is set to auditbeat
+  # in all lowercase.
+  #index: 'auditbeat'
+
+  # SOCKS5 proxy server URL
+  #proxy_url: socks5://user:password@socks5-server:2233
+
+  # Resolve names locally when using a proxy server. Defaults to false.
+  #proxy_use_local_resolver: false
+
+  # Enable SSL support. SSL is automatically enabled, if any SSL setting is set.
+  #ssl.enabled: true
+
+  # Configure SSL verification mode. If `none` is configured, all server hosts
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `full`.
+  #ssl.verification_mode: full
+
+  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
+  # 1.2 are enabled.
+  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+
+  # Optional SSL configuration options. SSL is off by default.
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  # Certificate for SSL client authentication
+  #ssl.certificate: "/etc/pki/client/cert.pem"
+
+  # Client Certificate Key
+  #ssl.key: "/etc/pki/client/cert.key"
+
+  # Optional passphrase for decrypting the Certificate Key.
+  #ssl.key_passphrase: ''
+
+  # Configure cipher suites to be used for SSL connections
+  #ssl.cipher_suites: []
+
+  # Configure curve types for ECDHE based cipher suites
+  #ssl.curve_types: []
+
+  # Configure what types of renegotiation are supported. Valid options are
+  # never, once, and freely. Default is never.
+  #ssl.renegotiation: never
+
+#------------------------------- Kafka output ----------------------------------
+#output.kafka:
+  # Boolean flag to enable or disable the output module.
+  #enabled: true
+
+  # The list of Kafka broker addresses from where to fetch the cluster metadata.
+  # The cluster metadata contain the actual Kafka brokers events are published
+  # to.
+  #hosts: ["localhost:9092"]
+
+  # The Kafka topic used for produced events. The setting can be a format string
+  # using any event field. To set the topic from document type use `%{[type]}`.
+  #topic: beats
+
+  # The Kafka event key setting. Use format string to create unique event key.
+  # By default no event key will be generated.
+  #key: ''
+
+  # The Kafka event partitioning strategy. Default hashing strategy is `hash`
+  # using the `output.kafka.key` setting or randomly distributes events if
+  # `output.kafka.key` is not configured.
+  #partition.hash:
+    # If enabled, events will only be published to partitions with reachable
+    # leaders. Default is false.
+    #reachable_only: false
+
+    # Configure alternative event field names used to compute the hash value.
+    # If empty `output.kafka.key` setting will be used.
+    # Default value is empty list.
+    #hash: []
+
+  # Authentication details. Password is required if username is set.
+  #username: ''
+  #password: ''
+
+  # Kafka version auditbeat is assumed to run against. Defaults to the oldest
+  # supported stable version (currently version 0.8.2.0)
+  #version: 0.8.2
+
+  # Metadata update configuration. Metadata do contain leader information
+  # deciding which broker to use when publishing.
+  #metadata:
+    # Max metadata request retry attempts when cluster is in middle of leader
+    # election. Defaults to 3 retries.
+    #retry.max: 3
+
+    # Waiting time between retries during leader elections. Default is 250ms.
+    #retry.backoff: 250ms
+
+    # Refresh metadata interval. Defaults to every 10 minutes.
+    #refresh_frequency: 10m
+
+  # The number of concurrent load-balanced Kafka output workers.
+  #worker: 1
+
+  # The number of times to retry publishing an event after a publishing failure.
+  # After the specified number of retries, the events are typically dropped.
+  # Some Beats, such as Filebeat, ignore the max_retries setting and retry until
+  # all events are published.  Set max_retries to a value less than 0 to retry
+  # until all events are published. The default is 3.
+  #max_retries: 3
+
+  # The maximum number of events to bulk in a single Kafka request. The default
+  # is 2048.
+  #bulk_max_size: 2048
+
+  # The number of seconds to wait for responses from the Kafka brokers before
+  # timing out. The default is 30s.
+  #timeout: 30s
+
+  # The maximum duration a broker will wait for number of required ACKs. The
+  # default is 10s.
+  #broker_timeout: 10s
+
+  # The number of messages buffered for each Kafka broker. The default is 256.
+  #channel_buffer_size: 256
+
+  # The keep-alive period for an active network connection. If 0s, keep-alives
+  # are disabled. The default is 0 seconds.
+  #keep_alive: 0
+
+  # Sets the output compression codec. Must be one of none, snappy and gzip. The
+  # default is gzip.
+  #compression: gzip
+
+  # The maximum permitted size of JSON-encoded messages. Bigger messages will be
+  # dropped. The default value is 1000000 (bytes). This value should be equal to
+  # or less than the broker's message.max.bytes.
+  #max_message_bytes: 1000000
+
+  # The ACK reliability level required from broker. 0=no response, 1=wait for
+  # local commit, -1=wait for all replicas to commit. The default is 1.  Note:
+  # If set to 0, no ACKs are returned by Kafka. Messages might be lost silently
+  # on error.
+  #required_acks: 1
+
+  # The configurable ClientID used for logging, debugging, and auditing
+  # purposes.  The default is "beats".
+  #client_id: beats
+
+  # Enable SSL support. SSL is automatically enabled, if any SSL setting is set.
+  #ssl.enabled: true
+
+  # Optional SSL configuration options. SSL is off by default.
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  # Configure SSL verification mode. If `none` is configured, all server hosts
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `full`.
+  #ssl.verification_mode: full
+
+  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
+  # 1.2 are enabled.
+  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+
+  # Certificate for SSL client authentication
+  #ssl.certificate: "/etc/pki/client/cert.pem"
+
+  # Client Certificate Key
+  #ssl.key: "/etc/pki/client/cert.key"
+
+  # Optional passphrase for decrypting the Certificate Key.
+  #ssl.key_passphrase: ''
+
+  # Configure cipher suites to be used for SSL connections
+  #ssl.cipher_suites: []
+
+  # Configure curve types for ECDHE based cipher suites
+  #ssl.curve_types: []
+
+  # Configure what types of renegotiation are supported. Valid options are
+  # never, once, and freely. Default is never.
+  #ssl.renegotiation: never
+
+#------------------------------- Redis output ----------------------------------
+#output.redis:
+  # Boolean flag to enable or disable the output module.
+  #enabled: true
+
+  # The list of Redis servers to connect to. If load balancing is enabled, the
+  # events are distributed to the servers in the list. If one server becomes
+  # unreachable, the events are distributed to the reachable servers only.
+  #hosts: ["localhost:6379"]
+
+  # The Redis port to use if hosts does not contain a port number. The default
+  # is 6379.
+  #port: 6379
+
+  # The name of the Redis list or channel the events are published to. The
+  # default is auditbeat.
+  #key: auditbeat
+
+  # The password to authenticate with. The default is no authentication.
+  #password:
+
+  # The Redis database number where the events are published. The default is 0.
+  #db: 0
+
+  # The Redis data type to use for publishing events. If the data type is list,
+  # the Redis RPUSH command is used. If the data type is channel, the Redis
+  # PUBLISH command is used. The default value is list.
+  #datatype: list
+
+  # The number of workers to use for each host configured to publish events to
+  # Redis. Use this setting along with the loadbalance option. For example, if
+  # you have 2 hosts and 3 workers, in total 6 workers are started (3 for each
+  # host).
+  #worker: 1
+
+  # If set to true and multiple hosts or workers are configured, the output
+  # plugin load balances published events onto all Redis hosts. If set to false,
+  # the output plugin sends all events to only one host (determined at random)
+  # and will switch to another host if the currently selected one becomes
+  # unreachable. The default value is true.
+  #loadbalance: true
+
+  # The Redis connection timeout in seconds. The default is 5 seconds.
+  #timeout: 5s
+
+  # The number of times to retry publishing an event after a publishing failure.
+  # After the specified number of retries, the events are typically dropped.
+  # Some Beats, such as Filebeat, ignore the max_retries setting and retry until
+  # all events are published. Set max_retries to a value less than 0 to retry
+  # until all events are published. The default is 3.
+  #max_retries: 3
+
+  # The maximum number of events to bulk in a single Redis request or pipeline.
+  # The default is 2048.
+  #bulk_max_size: 2048
+
+  # The URL of the SOCKS5 proxy to use when connecting to the Redis servers. The
+  # value must be a URL with a scheme of socks5://.
+  #proxy_url:
+
+  # This option determines whether Redis hostnames are resolved locally when
+  # using a proxy. The default value is false, which means that name resolution
+  # occurs on the proxy server.
+  #proxy_use_local_resolver: false
+
+  # Enable SSL support. SSL is automatically enabled, if any SSL setting is set.
+  #ssl.enabled: true
+
+  # Configure SSL verification mode. If `none` is configured, all server hosts
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `full`.
+  #ssl.verification_mode: full
+
+  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
+  # 1.2 are enabled.
+  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+
+  # Optional SSL configuration options. SSL is off by default.
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  # Certificate for SSL client authentication
+  #ssl.certificate: "/etc/pki/client/cert.pem"
+
+  # Client Certificate Key
+  #ssl.key: "/etc/pki/client/cert.key"
+
+  # Optional passphrase for decrypting the Certificate Key.
+  #ssl.key_passphrase: ''
+
+  # Configure cipher suites to be used for SSL connections
+  #ssl.cipher_suites: []
+
+  # Configure curve types for ECDHE based cipher suites
+  #ssl.curve_types: []
+
+  # Configure what types of renegotiation are supported. Valid options are
+  # never, once, and freely. Default is never.
+  #ssl.renegotiation: never
+
+#------------------------------- File output -----------------------------------
+#output.file:
+  # Boolean flag to enable or disable the output module.
+  #enabled: true
+
+  # Path to the directory where to save the generated files. The option is
+  # mandatory.
+  #path: "/tmp/auditbeat"
+
+  # Name of the generated files. The default is `auditbeat` and it generates
+  # files: `auditbeat`, `auditbeat.1`, `auditbeat.2`, etc.
+  #filename: auditbeat
+
+  # Maximum size in kilobytes of each file. When this size is reached, and on
+  # every auditbeat restart, the files are rotated. The default value is 10240
+  # kB.
+  #rotate_every_kb: 10000
+
+  # Maximum number of files under path. When this number of files is reached,
+  # the oldest file is deleted and the rest are shifted from last to first. The
+  # default is 7 files.
+  #number_of_files: 7
+
+  # Permissions to use for file creation. The default is 0600.
+  #permissions: 0600
+
+
+#----------------------------- Console output ---------------------------------
+#output.console:
+  # Boolean flag to enable or disable the output module.
+  #enabled: true
+
+  # Pretty print json event
+  #pretty: false
+
+#================================= Paths ======================================
+
+# The home path for the auditbeat installation. This is the default base path
+# for all other path settings and for miscellaneous files that come with the
+# distribution (for example, the sample dashboards).
+# If not set by a CLI flag or in the configuration file, the default for the
+# home path is the location of the binary.
+#path.home:
+
+# The configuration path for the auditbeat installation. This is the default
+# base path for configuration files, including the main YAML configuration file
+# and the Elasticsearch template file. If not set by a CLI flag or in the
+# configuration file, the default for the configuration path is the home path.
+#path.config: ${path.home}
+
+# The data path for the auditbeat installation. This is the default base path
+# for all the files in which auditbeat needs to store its data. If not set by a
+# CLI flag or in the configuration file, the default for the data path is a data
+# subdirectory inside the home path.
+#path.data: ${path.home}/data
+
+# The logs path for a auditbeat installation. This is the default location for
+# the Beat's log files. If not set by a CLI flag or in the configuration file,
+# the default for the logs path is a logs subdirectory inside the home path.
+#path.logs: ${path.home}/logs
+
+#============================== Dashboards =====================================
+# These settings control loading the sample dashboards to the Kibana index. Loading
+# the dashboards are disabled by default and can be enabled either by setting the
+# options here, or by using the `-setup` CLI flag or the `setup` command.
+#setup.dashboards.enabled: false
+
+# The directory from where to read the dashboards. The default is the `kibana`
+# folder in the home path.
+#setup.dashboards.directory: ${path.home}/kibana
+
+# The URL from where to download the dashboards archive. It is used instead of
+# the directory if it has a value.
+#setup.dashboards.url:
+
+# The file archive (zip file) from where to read the dashboards. It is used instead
+# of the directory when it has a value.
+#setup.dashboards.file:
+
+# In case the archive contains the dashboards from multiple Beats, this lets you
+# select which one to load. You can load all the dashboards in the archive by
+# setting this to the empty string.
+#setup.dashboards.beat: auditbeat
+
+# The name of the Kibana index to use for setting the configuration. Default is ".kibana"
+#setup.dashboards.kibana_index: .kibana
+
+# The Elasticsearch index name. This overwrites the index name defined in the
+# dashboards and index pattern. Example: testbeat-*
+#setup.dashboards.index:
+
+# Always use the Kibana API for loading the dashboards instead of autodetecting
+# how to install the dashboards by first querying Elasticsearch.
+#setup.dashboards.always_kibana: false
+
+#============================== Template =====================================
+
+# A template is used to set the mapping in Elasticsearch
+# By default template loading is enabled and the template is loaded.
+# These settings can be adjusted to load your own template or overwrite existing ones.
+
+# Set to false to disable template loading.
+#setup.template.enabled: true
+
+# Template name. By default the template name is "auditbeat-%{[beat.version]}"
+# The template name and pattern has to be set in case the elasticsearch index pattern is modified.
+#setup.template.name: "auditbeat-%{[beat.version]}"
+
+# Template pattern. By default the template pattern is "-%{[beat.version]}-*" to apply to the default index settings.
+# The first part is the version of the beat and then -* is used to match all daily indices.
+# The template name and pattern has to be set in case the elasticsearch index pattern is modified.
+#setup.template.pattern: "auditbeat-%{[beat.version]}-*"
+
+# Path to fields.yml file to generate the template
+#setup.template.fields: "${path.config}/fields.yml"
+
+# Overwrite existing template
+#setup.template.overwrite: false
+
+# Elasticsearch template settings
+setup.template.settings:
+
+  # A dictionary of settings to place into the settings.index dictionary
+  # of the Elasticsearch template. For more details, please check
+  # https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html
+  #index:
+    #number_of_shards: 1
+    #codec: best_compression
+    #number_of_routing_shards: 30
+
+  # A dictionary of settings for the _source field. For more details, please check
+  # https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-source-field.html
+  #_source:
+    #enabled: false
+
+#============================== Kibana =====================================
+
+# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
+# This requires a Kibana endpoint configuration.
+setup.kibana:
+
+  # Kibana Host
+  # Scheme and port can be left out and will be set to the default (http and 5601)
+  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
+  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
+  #host: "localhost:5601"
+
+  # Optional protocol and basic auth credentials.
+  #protocol: "https"
+  #username: "elastic"
+  #password: "changeme"
+
+  # Optional HTTP Path
+  #path: ""
+
+  # Use SSL settings for HTTPS. Default is true.
+  #ssl.enabled: true
+
+  # Configure SSL verification mode. If `none` is configured, all server hosts
+  # and certificates will be accepted. In this mode, SSL based connections are
+  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
+  # `full`.
+  #ssl.verification_mode: full
+
+  # List of supported/valid TLS versions. By default all TLS versions 1.0 up to
+  # 1.2 are enabled.
+  #ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]
+
+  # SSL configuration. By default is off.
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  # Certificate for SSL client authentication
+  #ssl.certificate: "/etc/pki/client/cert.pem"
+
+  # Client Certificate Key
+  #ssl.key: "/etc/pki/client/cert.key"
+
+  # Optional passphrase for decrypting the Certificate Key.
+  #ssl.key_passphrase: ''
+
+  # Configure cipher suites to be used for SSL connections
+  #ssl.cipher_suites: []
+
+  # Configure curve types for ECDHE based cipher suites
+  #ssl.curve_types: []
+
+
+
+#================================ Logging ======================================
+# There are three options for the log output: syslog, file, stderr.
+# Under Windows systems, the log files are per default sent to the file output,
+# under all other system per default to syslog.
+
+# Sets log level. The default log level is info.
+# Available log levels are: critical, error, warning, info, debug
+#logging.level: info
+
+# Enable debug output for selected components. To enable all selectors use ["*"]
+# Other available selectors are "beat", "publish", "service"
+# Multiple selectors can be chained.
+#logging.selectors: [ ]
+
+# Send all logging output to syslog. The default is false.
+#logging.to_syslog: true
+
+# If enabled, auditbeat periodically logs its internal metrics that have changed
+# in the last period. For each metric that changed, the delta from the value at
+# the beginning of the period is logged. Also, the total values for
+# all non-zero internal metrics are logged on shutdown. The default is true.
+#logging.metrics.enabled: true
+
+# The period after which to log the internal metrics. The default is 30s.
+#logging.metrics.period: 30s
+
+# Logging to rotating files. Set logging.to_files to false to disable logging to
+# files.
+logging.to_files: true
+logging.files:
+  # Configure the path where the logs are written. The default is the logs directory
+  # under the home path (the binary location).
+  #path: /var/log/auditbeat
+
+  # The name of the files where the logs are written to.
+  #name: auditbeat
+
+  # Configure log file size limit. If limit is reached, log file will be
+  # automatically rotated
+  #rotateeverybytes: 10485760 # = 10MB
+
+  # Number of rotated log files to keep. Oldest files will be deleted first.
+  #keepfiles: 7
+
+  # The permissions mask to apply when rotating log files. The default value is 0600.
+  # Must be a valid Unix-style file permissions mask expressed in octal notation.
+  #permissions: 0600
+
+# Set to true to log messages in json format.
+#logging.json: false

vendor/github.com/elastic/beats/auditbeat/auditbeat.yml

@@ -0,0 +1,149 @@
+###################### Auditbeat Configuration Example #########################
+
+# This is an example configuration file highlighting only the most common
+# options. The auditbeat.reference.yml file from the same directory contains all
+# the supported options with more comments. You can use it as a reference.
+#
+# You can find the full configuration reference here:
+# https://www.elastic.co/guide/en/beats/auditbeat/index.html
+
+#==========================  Modules configuration =============================
+auditbeat.modules:
+
+- module: audit
+  metricsets: [kernel]
+  kernel.audit_rules: |
+    ## Define audit rules here.
+    ## Create file watches (-w) or syscall audits (-a or -A). Uncomment these
+    ## examples or add your own rules.
+
+    ## If you are on a 64 bit platform, everything should be running
+    ## in 64 bit mode. This rule will detect any use of the 32 bit syscalls
+    ## because this might be a sign of someone exploiting a hole in the 32
+    ## bit API.
+    #-a always,exit -F arch=b32 -S all -F key=32bit-abi
+
+    ## Executions.
+    #-a always,exit -F arch=b64 -S execve,execveat -k exec
+
+    ## External access.
+    #-a always,exit -F arch=b64 -S accept,bind,connect,recvfrom -F key=external-access
+
+    ## Identity changes.
+    #-w /etc/group -p wa -k identity
+    #-w /etc/passwd -p wa -k identity
+    #-w /etc/gshadow -p wa -k identity
+
+    ## Unauthorized access attempts.
+    #-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -k access
+    #-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access
+
+- module: audit
+  metricsets: [file]
+  file.paths:
+  - /bin
+  - /usr/bin
+  - /sbin
+  - /usr/sbin
+  - /etc
+  
+
+
+#==================== Elasticsearch template setting ==========================
+setup.template.settings:
+  index.number_of_shards: 3
+  #index.codec: best_compression
+  #_source.enabled: false
+
+#================================ General =====================================
+
+# The name of the shipper that publishes the network data. It can be used to group
+# all the transactions sent by a single shipper in the web interface.
+#name:
+
+# The tags of the shipper are included in their own field with each
+# transaction published.
+#tags: ["service-X", "web-tier"]
+
+# Optional fields that you can specify to add additional information to the
+# output.
+#fields:
+#  env: staging
+
+
+#============================== Dashboards =====================================
+# These settings control loading the sample dashboards to the Kibana index. Loading
+# the dashboards is disabled by default and can be enabled either by setting the
+# options here, or by using the `-setup` CLI flag or the `setup` command.
+#setup.dashboards.enabled: false
+
+# The URL from where to download the dashboards archive. By default this URL
+# has a value which is computed based on the Beat name and version. For released
+# versions, this URL points to the dashboard archive on the artifacts.elastic.co
+# website.
+#setup.dashboards.url:
+
+#============================== Kibana =====================================
+
+# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
+# This requires a Kibana endpoint configuration.
+setup.kibana:
+
+  # Kibana Host
+  # Scheme and port can be left out and will be set to the default (http and 5601)
+  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
+  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
+  #host: "localhost:5601"
+
+#============================= Elastic Cloud ==================================
+
+# These settings simplify using auditbeat with the Elastic Cloud (https://cloud.elastic.co/).
+
+# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
+# `setup.kibana.host` options.
+# You can find the `cloud.id` in the Elastic Cloud web UI.
+#cloud.id:
+
+# The cloud.auth setting overwrites the `output.elasticsearch.username` and
+# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
+#cloud.auth:
+
+#================================ Outputs =====================================
+
+# Configure what output to use when sending the data collected by the beat.
+
+#-------------------------- Elasticsearch output ------------------------------
+output.elasticsearch:
+  # Array of hosts to connect to.
+  hosts: ["localhost:9200"]
+
+  # Optional protocol and basic auth credentials.
+  #protocol: "https"
+  #username: "elastic"
+  #password: "changeme"
+
+#----------------------------- Logstash output --------------------------------
+#output.logstash:
+  # The Logstash hosts
+  #hosts: ["localhost:5044"]
+
+  # Optional SSL. By default is off.
+  # List of root certificates for HTTPS server verifications
+  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
+
+  # Certificate for SSL client authentication
+  #ssl.certificate: "/etc/pki/client/cert.pem"
+
+  # Client Certificate Key
+  #ssl.key: "/etc/pki/client/cert.key"
+
+#================================ Logging =====================================
+
+# Sets log level. The default log level is info.
+# Available log levels are: critical, error, warning, info, debug
+#logging.level: debug
+
+# At debug level, you can selectively enable logging only for some components.
+# To enable all selectors use ["*"]. Examples of other selectors are "beat",
+# "publish", "service".
+#logging.selectors: ["*"]

vendor/github.com/elastic/beats/auditbeat/cmd/root.go

@@ -0,0 +1,20 @@
+package cmd
+
+import (
+	"github.com/spf13/pflag"
+
+	"github.com/elastic/beats/metricbeat/beater"
+
+	cmd "github.com/elastic/beats/libbeat/cmd"
+)
+
+// Name of the beat (auditbeat).
+const Name = "auditbeat"
+
+// RootCmd for running auditbeat.
+var RootCmd *cmd.BeatsRootCmd
+
+func init() {
+	var runFlags = pflag.NewFlagSet(Name, pflag.ExitOnError)
+	RootCmd = cmd.GenRootCmdWithRunFlags(Name, "", beater.New, runFlags)
+}

vendor/github.com/elastic/beats/auditbeat/datastore/datastore.go

@@ -0,0 +1,174 @@
+package datastore
+
+import (
+	"io"
+	"os"
+	"sync"
+
+	"github.com/boltdb/bolt"
+
+	"github.com/elastic/beats/libbeat/paths"
+)
+
+var (
+	initDatastoreOnce sync.Once
+	ds                *boltDatastore
+)
+
+// OpenBucket returns a new Bucket that stores data in {path.data}/beat.db.
+// The returned Bucket must be closed when finished to ensure all resources
+// are released.
+func OpenBucket(name string) (Bucket, error) {
+	initDatastoreOnce.Do(func() {
+		ds = &boltDatastore{
+			path: paths.Resolve(paths.Data, "beat.db"),
+			mode: 0600,
+		}
+	})
+
+	return ds.OpenBucket(name)
+}
+
+// Datastore
+
+type Datastore interface {
+	OpenBucket(name string) (Bucket, error)
+}
+
+type boltDatastore struct {
+	mutex    sync.Mutex
+	useCount uint32
+	path     string
+	mode     os.FileMode
+	db       *bolt.DB
+}
+
+func New(path string, mode os.FileMode) Datastore {
+	return &boltDatastore{path: path, mode: mode}
+}
+
+func (ds *boltDatastore) OpenBucket(bucket string) (Bucket, error) {
+	ds.mutex.Lock()
+	defer ds.mutex.Unlock()
+
+	// Initialize the Bolt DB.
+	if ds.db == nil {
+		var err error
+		ds.db, err = bolt.Open(ds.path, ds.mode, nil)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Ensure the name exists.
+	err := ds.db.Update(func(tx *bolt.Tx) error {
+		_, err := tx.CreateBucketIfNotExists([]byte(bucket))
+		return err
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return &boltBucket{ds, bucket}, nil
+}
+
+func (ds *boltDatastore) done() {
+	ds.mutex.Lock()
+	defer ds.mutex.Unlock()
+
+	if ds.useCount > 0 {
+		ds.useCount--
+
+		if ds.useCount == 0 {
+			ds.db.Close()
+			ds.db = nil
+		}
+	}
+}
+
+// Bucket
+
+type Bucket interface {
+	io.Closer
+	Load(key string, f func(blob []byte) error) error
+	Store(key string, blob []byte) error
+	Delete(key string) error // Delete removes a key from the bucket. If the key does not exist then nothing is done and a nil error is returned.
+	DeleteBucket() error     // Deletes and closes the bucket.
+}
+
+// BoltBucket is a Bucket that exposes some Bolt specific APIs.
+type BoltBucket interface {
+	Bucket
+	View(func(tx *bolt.Bucket) error) error
+	Update(func(tx *bolt.Bucket) error) error
+}
+
+type boltBucket struct {
+	ds   *boltDatastore
+	name string
+}
+
+func (b *boltBucket) Load(key string, f func(blob []byte) error) error {
+	return b.ds.db.View(func(tx *bolt.Tx) error {
+		b := tx.Bucket([]byte(b.name))
+
+		data := b.Get([]byte(key))
+		if data == nil {
+			return nil
+		}
+
+		return f(data)
+	})
+}
+
+func (b *boltBucket) Store(key string, blob []byte) error {
+	return b.ds.db.Update(func(tx *bolt.Tx) error {
+		b := tx.Bucket([]byte(b.name))
+		return b.Put([]byte(key), blob)
+	})
+}
+
+func (b *boltBucket) ForEach(f func(key string, blob []byte) error) error {
+	return b.ds.db.View(func(tx *bolt.Tx) error {
+		b := tx.Bucket([]byte(b.name))
+
+		return b.ForEach(func(k, v []byte) error {
+			return f(string(k), v)
+		})
+	})
+}
+
+func (b *boltBucket) Delete(key string) error {
+	return b.ds.db.Update(func(tx *bolt.Tx) error {
+		b := tx.Bucket([]byte(b.name))
+		return b.Delete([]byte(key))
+	})
+}
+
+func (b *boltBucket) DeleteBucket() error {
+	err := b.ds.db.Update(func(tx *bolt.Tx) error {
+		return tx.DeleteBucket([]byte(b.name))
+	})
+	b.Close()
+	return err
+}
+
+func (b *boltBucket) View(f func(*bolt.Bucket) error) error {
+	return b.ds.db.View(func(tx *bolt.Tx) error {
+		b := tx.Bucket([]byte(b.name))
+		return f(b)
+	})
+}
+
+func (b *boltBucket) Update(f func(*bolt.Bucket) error) error {
+	return b.ds.db.Update(func(tx *bolt.Tx) error {
+		b := tx.Bucket([]byte(b.name))
+		return f(b)
+	})
+}
+
+func (b *boltBucket) Close() error {
+	b.ds.done()
+	b.ds = nil
+	return nil
+}

vendor/github.com/elastic/beats/auditbeat/docs/auditbeat-filtering.asciidoc

@@ -0,0 +1,6 @@
+[[filtering-and-enhancing-data]]
+== Filter and enhance the exported data
+
+include::../../libbeat/docs/processors.asciidoc[]
+
+include::../../libbeat/docs/processors-using.asciidoc[]

vendor/github.com/elastic/beats/auditbeat/docs/auditbeat-general-options.asciidoc

@@ -0,0 +1,7 @@
+[[configuration-general-options]]
+== Specify general settings
+
+You can specify settings in the +{beatname_lc}.yml+ config file to control the
+general behavior of {beatname_uc}.
+
+include::../../libbeat/docs/generalconfig.asciidoc[]

vendor/github.com/elastic/beats/auditbeat/docs/auditbeat-modules-config.asciidoc

@@ -0,0 +1,33 @@
+[id="configuration-{beatname_lc}"]
+== Specify which modules to run
+
+To enable specific modules and metricsets, you add entries to the
+`auditbeat.modules` list in the +{beatname_lc}.yml+ config file. Each entry in
+the list begins with a dash (-) and is followed by settings for that module.
+
+The following example shows a configuration that runs the `audit` module with
+the `kernel` and `file` metricsets enabled:
+
+[source,yaml]
+----
+auditbeat.modules:
+
+- module: audit
+  metricsets: [kernel]
+  kernel.audit_rules: |
+    -w /etc/passwd -p wa -k identity
+    -a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access
+
+- module: audit
+  metricsets: [file]
+  file.paths:
+  - /bin
+  - /usr/bin
+  - /sbin
+  - /usr/sbin
+  - /etc
+----
+
+The configuration details vary by module. See the
+<<{beatname_lc}-modules,module documentation>> for more detail about
+configuring the available modules and metricsets.

vendor/github.com/elastic/beats/auditbeat/docs/configuring-howto.asciidoc

@@ -0,0 +1,77 @@
+[id="configuring-howto-{beatname_lc}"]
+= Configuring {beatname_uc}
+
+[partintro]
+--
+Before modifying configuration settings, make sure you've completed the
+<<{beatname_lc}-configuration,configuration steps>> in the Getting Started.
+This section describes some common use cases for changing configuration options.
+
+To configure {beatname_uc}, you edit the configuration file. For rpm and deb,
+you’ll find the configuration file at +/etc/{beatname_lc}/{beatname_lc}.yml+.
+There's also a full example configuration file at
++/etc/{beatname_lc}/{beatname_lc}.reference.yml+ that shows all non-deprecated
+options. For mac and win, look in the archive that you extracted.
+
+The {beatname_uc} configuration file uses http://yaml.org/[YAML] for its syntax.
+See the {libbeat}/config-file-format.html[Config File Format] section of the
+_Beats Platform Reference_ for more about the structure of the config file.
+
+The following topics describe how to configure {beatname_uc}:
+
+* <<configuration-{beatname_lc}>>
+* <<configuration-general-options>>
+* <<{beatname_lc}-configuration-reloading>>
+* <<configuring-internal-queue>>
+* <<configuring-output>>
+* <<configuration-ssl>>
+* <<filtering-and-enhancing-data>>
+* <<configuring-ingest-node>>
+* <<configuration-path>>
+* <<setup-kibana-endpoint>>
+* <<configuration-dashboards>>
+* <<configuration-template>>
+* <<configuration-logging>>
+* <<using-environ-vars>>
+* <<yaml-tips>>
+* <<{beatname_lc}-reference-yml>>
+
+After changing configuration settings, you need to restart {beatname_uc} to
+pick up the changes.
+
+--
+
+include::./auditbeat-modules-config.asciidoc[]
+
+include::./auditbeat-general-options.asciidoc[]
+
+include::./reload-configuration.asciidoc[]
+
+:allplatforms:
+include::../../libbeat/docs/queueconfig.asciidoc[]
+
+include::../../libbeat/docs/outputconfig.asciidoc[]
+
+include::../../libbeat/docs/shared-ssl-config.asciidoc[]
+
+include::./auditbeat-filtering.asciidoc[]
+
+include::../../libbeat/docs/shared-config-ingest.asciidoc[]
+
+include::../../libbeat/docs/shared-path-config.asciidoc[]
+
+include::../../libbeat/docs/shared-kibana-config.asciidoc[]
+
+include::../../libbeat/docs/setup-config.asciidoc[]
+
+include::../../libbeat/docs/loggingconfig.asciidoc[]
+
+:standalone:
+include::../../libbeat/docs/shared-env-vars.asciidoc[]
+
+:standalone:
+:allplatforms:
+include::../../libbeat/docs/yaml.asciidoc[]
+
+include::../../libbeat/docs/reference-yml.asciidoc[]
+

vendor/github.com/elastic/beats/auditbeat/docs/faq-ulimit.asciidoc

@@ -0,0 +1,29 @@
+[float]
+[[ulimit]]
+=== {beatname_uc} fails to watch folders because too many files are open?
+
+Because of the way file monitoring is implemented on macOS, you may see a
+warning similar to the following:
+
+[source,shell]
+----
+eventreader_fsnotify.go:42: WARN [audit.file] Failed to watch /usr/bin: too many
+open files (check the max number of open files allowed with 'ulimit -a')
+----
+
+To resolve this issue, run {beatname_uc} with the `ulimit` set to a larger
+value, for example:
+
+["source","sh",subs="attributes"]
+----
+sudo sh -c 'ulimit -n 8192 && ./{beatname_uc} -e
+----
+
+Or:
+
+["source","sh",subs="attributes"]
+----
+sudo su
+ulimit -n 8192
+./{beatname_lc} -e
+----

vendor/github.com/elastic/beats/auditbeat/docs/faq.asciidoc

@@ -0,0 +1,12 @@
+[[faq]]
+== Frequently asked questions
+
+This section contains frequently asked questions about {beatname_uc}. Also check
+out the
+https://discuss.elastic.co/c/beats/{beatname_lc}[{beatname_uc} discussion forum].
+
+include::./faq-ulimit.asciidoc[]
+
+include::../../libbeat/docs/faq-limit-bandwidth.asciidoc[]
+
+include::../../libbeat/docs/shared-faq.asciidoc[]

vendor/github.com/elastic/beats/auditbeat/docs/getting-started.asciidoc

@@ -0,0 +1,294 @@
+[id="{beatname_lc}-getting-started"]
+== Getting started with {beatname_uc}
+
+To get started with your own {beatname_uc} setup, install and configure these
+related products:
+
+ * Elasticsearch for storage and indexing the data.
+ * Kibana for the UI.
+ * Logstash (optional) for inserting data into Elasticsearch.
+
+See {libbeat}/getting-started.html[Getting Started with Beats and the Elastic Stack]
+for more information.
+
+After installing the Elastic Stack, read the following topics to learn how to
+install, configure, and run {beatname_uc}:
+
+* <<{beatname_lc}-installation>>
+* <<{beatname_lc}-configuration>>
+* <<{beatname_lc}-template>>
+* <<load-kibana-dashboards>>
+* <<{beatname_lc}-starting>>
+* <<view-kibana-dashboards>>
+* <<setup-repositories>>
+
+[id="{beatname_lc}-installation"]
+=== Step 1: Install {beatname_uc}
+
+You should install {beatname_uc} on all the servers you want to monitor.
+
+include::../../libbeat/docs/shared-download-and-install.asciidoc[]
+
+[[deb]]
+*deb:*
+
+ifeval::["{release-state}"=="unreleased"]
+
+Version {stack-version} of {beatname_uc} has not yet been released.
+
+endif::[]
+
+ifeval::["{release-state}"!="unreleased"]
+
+["source","sh",subs="attributes"]
+------------------------------------------------
+curl -L -O https://artifacts.elastic.co/downloads/beats/{beatname_lc}/{beatname_lc}-{version}-amd64.deb
+sudo dpkg -i {beatname_lc}-{version}-amd64.deb
+------------------------------------------------
+
+endif::[]
+
+[[rpm]]
+*rpm:*
+
+ifeval::["{release-state}"=="unreleased"]
+
+Version {stack-version} of {beatname_uc} has not yet been released.
+
+endif::[]
+
+ifeval::["{release-state}"!="unreleased"]
+
+["source","sh",subs="attributes"]
+------------------------------------------------
+curl -L -O https://artifacts.elastic.co/downloads/beats/{beatname_lc}/{beatname_lc}-{version}-x86_64.rpm
+sudo rpm -vi {beatname_lc}-{version}-x86_64.rpm
+------------------------------------------------
+
+endif::[]
+
+[[mac]]
+*mac:*
+
+ifeval::["{release-state}"=="unreleased"]
+
+Version {stack-version} of {beatname_uc} has not yet been released.
+
+endif::[]
+
+ifeval::["{release-state}"!="unreleased"]
+
+["source","sh",subs="attributes"]
+------------------------------------------------
+curl -L -O https://artifacts.elastic.co/downloads/beats/{beatname_lc}/{beatname_lc}-{version}-darwin-x86_64.tar.gz
+tar xzvf {beatname_lc}-{version}-darwin-x86_64.tar.gz
+------------------------------------------------
+
+endif::[]
+
+[[docker]]
+*docker:*
+
+ifeval::["{release-state}"=="unreleased"]
+
+Version {stack-version} of {beatname_uc} has not yet been released.
+
+endif::[]
+
+ifeval::["{release-state}"!="unreleased"]
+
+["source", "shell", subs="attributes"]
+------------------------------------------------
+docker pull {dockerimage}
+------------------------------------------------
+
+endif::[]
+
+[[win]]
+*win:*
+
+ifeval::["{release-state}"=="unreleased"]
+
+Version {stack-version} of {beatname_uc} has not yet been released.
+
+endif::[]
+
+ifeval::["{release-state}"!="unreleased"]
+
+. Download the {beatname_uc} Windows zip file from the
+https://www.elastic.co/downloads/beats/{beatname_lc}[downloads page].
+
+. Extract the contents of the zip file into `C:\Program Files`.
+
+. Rename the +{beatname_lc}-<version>-windows+ directory to +{beatname_uc}+.
+
+. Open a PowerShell prompt as an Administrator (right-click the PowerShell icon
+and select *Run As Administrator*). If you are running Windows XP, you may need
+to download and install PowerShell.
+
+. From the PowerShell prompt, run the following commands to install {beatname_uc}
+as a Windows service:
++
+["source","sh",subs="attributes"]
+----------------------------------------------------------------------
+PS > cd 'C:{backslash}Program Files{backslash}{beatname_uc}'
+PS C:{backslash}Program Files{backslash}{beatname_uc}> .{backslash}install-service-{beatname_lc}.ps1
+----------------------------------------------------------------------
+
+NOTE: If script execution is disabled on your system, you need to set the
+execution policy for the current session to allow the script to run. For
+example: +PowerShell.exe -ExecutionPolicy UnRestricted -File
+.\install-service-{beatname_lc}.ps1+.
+
+endif::[]
+
+Before starting {beatname_uc}, you should look at the configuration options in the
+configuration file, for example +C:{backslash}Program Files{backslash}{beatname_uc}{backslash}{beatname_lc}.yml+.
+For more information about these options, see
+<<configuring-howto-{beatname_lc}>>.
+
+[id="{beatname_lc}-configuration"]
+=== Step 2: Configure {beatname_uc}
+
+include::../../libbeat/docs/shared-configuring.asciidoc[]
+
+To configure {beatname_uc}:
+
+. Define the {beatname_uc} modules that you want to enable. {beatname_uc} uses
+modules to collect the audit information. For each module, specify the
+metricsets that you want to collect.
++
+The following example shows the `file` metricset configured to generate
+events whenever a file in one of the specified paths changes on disk:
++
+["source","sh",subs="attributes"]
+-------------------------------------
+auditbeat.modules:
+
+- module: audit
+  metricsets: [file]
+  file.paths:
+  - /bin
+  - /usr/bin
+  - /sbin
+  - /usr/sbin
+  - /etc
+-------------------------------------
++
+If you accept the default configuration without specifying additional modules,
+{beatname_uc} uses a configuration that's tailored to the operating system where
+{beatname_uc} is running.
++
+See <<configuring-howto-{beatname_lc}>> for more details about configuring modules.
+
+. If you are sending output to Elasticsearch (and not using Logstash), set the
+IP address and port where {beatname_uc} can find the Elasticsearch installation:
++
+[source,yaml]
+----------------------------------------------------------------------
+output.elasticsearch:
+  hosts: ["127.0.0.1:9200"]
+----------------------------------------------------------------------
++
+If you are sending output to Logstash, make sure you
+<<logstash-output,Configure the Logstash output>> instead.
+
+include::../../libbeat/docs/step-configure-kibana-endpoint.asciidoc[]
+
+include::../../libbeat/docs/step-configure-credentials.asciidoc[]
+
+include::../../libbeat/docs/step-test-config.asciidoc[]
+
+include::../../libbeat/docs/step-look-at-config.asciidoc[]
+
+[id="{beatname_lc}-template"]
+=== Step 3: Load the index template in Elasticsearch
+
+:allplatforms:
+include::../../libbeat/docs/shared-template-load.asciidoc[]
+
+[[load-kibana-dashboards]]
+=== Step 4: Set up the Kibana dashboards
+
+:allplatforms:
+include::../../libbeat/docs/dashboards.asciidoc[]
+
+[id="{beatname_lc}-starting"]
+=== Step 5: Start {beatname_uc}
+
+Run {beatname_uc} by issuing the appropriate command for your platform. If you
+are accessing a secured Elasticsearch cluster, make sure you've configured
+credentials as described in <<{beatname_lc}-configuration>>.
+
+NOTE: If you use an init.d script to start {beatname_uc} on deb or rpm, you can't
+specify command line flags (see <<command-line-options>>). To specify flags,
+start {beatname_uc} in the foreground.
+
+*deb:*
+
+["source","sh",subs="attributes"]
+----------------------------------------------------------------------
+sudo service {beatname_lc} start
+----------------------------------------------------------------------
+
+*rpm:*
+
+["source","sh",subs="attributes"]
+----------------------------------------------------------------------
+sudo service {beatname_lc} start
+----------------------------------------------------------------------
+
+*mac:*
+
+["source","sh",subs="attributes"]
+----------------------------------------------------------------------
+sudo chown root {beatname_lc}.yml <1>
+sudo ./{beatname_lc} -e -c {beatname_lc}.yml -d "publish"
+----------------------------------------------------------------------
+<1> To monitor system files, you'll be running {beatname_uc} as root, so you
+need to change ownership of the configuration file, or run {beatname_uc} with
+`-strict.perms=false` specified. See
+{libbeat}/config-file-permissions.html[Config File Ownership and Permissions]
+in the _Beats Platform Reference_.
+
+If you see a warning about too many open files, you need to increase the
+`ulimit`. See the <<ulimit,FAQ>> for more details.
+
+*win:*
+
+["source","sh",subs="attributes"]
+----------------------------------------------------------------------
+PS C:{backslash}Program Files{backslash}{beatname_uc}> Start-Service {beatname_lc}
+----------------------------------------------------------------------
+
+By default the log files are stored in +C:{backslash}ProgramData{backslash}{beatname_lc}{backslash}Logs+.
+
+==== Test the {beatname_uc} installation
+
+To verify that your server's statistics are present in Elasticsearch, issue
+the following command:
+
+["source","sh",subs="attributes"]
+----------------------------------------------------------------------
+curl -XGET 'http://localhost:9200/{beatname_lc}-*/_search?pretty'
+----------------------------------------------------------------------
+
+Make sure that you replace `localhost:9200` with the address of your
+Elasticsearch instance.
+
+On Windows, if you don't have cURL installed, simply point your browser to the
+URL.
+
+[[view-kibana-dashboards]]
+=== Step 6: View the sample Kibana dashboards
+
+To make it easier for you to start auditing the activities of users and
+processes on your system, we have created example {beatname_uc} dashboards.
+You loaded the dashboards earlier when you ran the `setup` command.
+
+include::../../libbeat/docs/opendashboards.asciidoc[]
+
+The dashboards are provided as examples. We recommend that you
+{kibana-ref}/dashboard.html[customize] them to meet your needs.
+
+image:./images/auditbeat-file-integrity-dashboard.png[Auditbeat File Integrity Dashboard]