Tcarters/.env

## .env
ELASTIC_PASSWORD=elastic_password
KIBANA_PASSWORD=kibana_password

## docker-compose.yml
version: "3"
services:
  setup:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.12.1
    environment:
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - KIBANA_PASSWORD=${KIBANA_PASSWORD}
    container_name: setup
    command:
      - bash
      - -c
      - |
        echo "Waiting for Elasticsearch availability";
        until curl -s http://elasticsearch:9200 | grep -q "missing authentication credentials"; do sleep 30; done;
        echo "Setting kibana_system password";
        until curl -s -X POST -u "elastic:${ELASTIC_PASSWORD}" -H "Content-Type: application/json" http://elasticsearch:9200/_security/user/kibana_system/_password -d "{\"password\":\"${KIBANA_PASSWORD}\"}" | grep -q "^{}"; do sleep 10; done;
        echo "All done!";
    networks:
      - elk_network

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.12.1
    # give the container a name
    # this will also set the container's hostname as elasticsearch
    container_name: elasticsearch
    environment:
      - discovery.type=single-node
      - cluster.name=cluster-elasticsearch
      - bootstrap.memory_lock=true
      # limits elasticsearch to 1 GB of RAM
      # - ES_JAVA_OPTS=-Xms1g -Xmx1g
      # The password for the 'elastic' user
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - xpack.security.http.ssl.enabled=false
    volumes:
      - esdata1:/usr/share/elasticsearch/data
    ports:
      - 9200:9200
    networks:
      - elk_network


  kibana:
    image: docker.elastic.co/kibana/kibana:8.12.1
    container_name: kibana
    ports:
      - 5601:5601
    environment:
      # remember the container_name for elasticsearch?
      # we use it here to access that container
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=kibana_system
      - ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
      # Change this to true if you want to sent
      # telemetry data to kibana developers
      - TELEMETRY_ENABLED=false

    depends_on:
      - elasticsearch
    networks:
      - elk_network

  logstash:
    image: docker.elastic.co/logstash/logstash:8.12.1
    container_name: logstash
    command:
      - /bin/bash
      - -c
      - |
        cp /usr/share/logstash/pipeline/logstash.yml /usr/share/logstash/config/logstash.yml
        echo "Waiting for Elasticsearch availability";
        until curl -s http://elasticsearch:9200 | grep -q "missing authentication credentials"; do sleep 1; done;
        echo "Starting logstash";
        /usr/share/logstash/bin/logstash -f /usr/share/logstash/pipeline/logstash.conf
    environment:
      - xpack.monitoring.enabled=false
      - ELASTIC_USER=elastic
      - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
      - ELASTIC_HOSTS=http://elasticsearch:9200
    volumes:
      - ./logstash.conf:/usr/share/logstash/pipeline/logstash.conf
      - /var/log:/var/log  # Make sure Logstash can read host logs


    ports:
      - "5044:5044"  # Maps port 5044 on the host to port 5044 on the container
      - "9600:9600"  # Optionally expose the monitoring API
    depends_on:
      - elasticsearch
    networks:
      - elk_network


volumes:
  esdata1:
    driver: local

networks:
  elk_network:
    driver: bridge

## filebeat.yml
###################### Filebeat Configuration Example #########################

# This file is an example configuration file highlighting only the most common
# options. The filebeat.reference.yml file from the same directory contains all the
# supported options with more comments. You can use it as a reference.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/filebeat/index.html

# For more available modules and options, please see the filebeat.reference.yml sample
# configuration file.

# ============================== Filebeat inputs ===============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input-specific configurations.

# filestream is an input for collecting log messages from files.
- type: filestream

  # Unique ID among all inputs, an ID is required.
  id: my-filestream-id

  # Change to true to enable this input configuration.
  enabled: false

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/*.log
    #- c:\programdata\elasticsearch\logs\*
  # Exclude lines. A list of regular expressions to match. It drops the lines that are
  # matching any regular expression from the list.
  # Line filtering happens after the parsers pipeline. If you would like to filter lines
  # before parsers, use include_message parser.
  #exclude_lines: ['^DBG']

  # Include lines. A list of regular expressions to match. It exports the lines that are
  # matching any regular expression from the list.
  # Line filtering happens after the parsers pipeline. If you would like to filter lines
  # before parsers, use include_message parser.
  #include_lines: ['^ERR', '^WARN']

  # Exclude files. A list of regular expressions to match. Filebeat drops the files that
  # are matching any regular expression from the list. By default, no files are dropped.
  #prospector.scanner.exclude_files: ['.gz$']

  # Optional additional fields. These fields can be freely picked
  # to add additional information to the crawled log files for filtering
  #fields:
  #  level: debug
  #  review: 1

# ============================== Filebeat modules ==============================

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

# ======================= Elasticsearch template setting =======================

setup.template.settings:
  index.number_of_shards: 1
  #index.codec: best_compression
  #_source.enabled: false


# ================================== General ===================================

# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
#name:

# The tags of the shipper are included in their field with each
# transaction published.
#tags: ["service-X", "web-tier"]

# Optional fields that you can specify to add additional information to the
# output.
#fields:
#  env: staging

# ================================= Dashboards =================================
# These settings control loading the sample dashboards to the Kibana index. Loading
# the dashboards is disabled by default and can be enabled either by setting the
# options here or by using the `setup` command.
#setup.dashboards.enabled: false

# The URL from where to download the dashboard archive. By default, this URL
# has a value that is computed based on the Beat name and version. For released
# versions, this URL points to the dashboard archive on the artifacts.elastic.co
# website.
#setup.dashboards.url:

# =================================== Kibana ===================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  #host: "localhost:5601"

  # Kibana Space ID
  # ID of the Kibana Space into which the dashboards should be loaded. By default,
  # the Default Space will be used.
  #space.id:

# =============================== Elastic Cloud ================================

# These settings simplify using Filebeat with the Elastic Cloud (https://cloud.elastic.co/).

# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
# `setup.kibana.host` options.
# You can find the `cloud.id` in the Elastic Cloud web UI.
#cloud.id:

# The cloud.auth setting overwrites the `output.elasticsearch.username` and
# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
#cloud.auth:

# ================================== Outputs ===================================

# Configure what output to use when sending the data collected by the beat.

# ---------------------------- Elasticsearch Output ----------------------------
#output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["192.168.12.95:9200"]

  # Performance preset - one of "balanced", "throughput", "scale",
  # "latency", or "custom".
  #preset: balanced

  # Protocol - either `http` (default) or `https`.
 # protocol: "http"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
#  username: "elastic"
#  password: "elastic"

# ------------------------------ Logstash Output -------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["192.168.12.95:5044"] # this ip of host machine running the logstash container
  loadbalance: true
  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

# ================================= Processors =================================
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

# ================================== Logging ===================================

# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
#logging.level: debug

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors, use ["*"]. Examples of other selectors are "beat",
# "publisher", "service".
#logging.selectors: ["*"]

# ============================= X-Pack Monitoring ==============================
# Filebeat can export internal metrics to a central Elasticsearch monitoring
# cluster.  This requires xpack monitoring to be enabled in Elasticsearch.  The
# reporting is disabled by default.

# Set to true to enable the monitoring reporter.
#monitoring.enabled: false

# Sets the UUID of the Elasticsearch cluster under which monitoring data for this
# Filebeat instance will appear in the Stack Monitoring UI. If output.elasticsearch
## Filebeat instance will appear in the Stack Monitoring UI. If output.elasticsearch
# is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.
#monitoring.cluster_uuid:

# Uncomment to send the metrics to Elasticsearch. Most settings from the
# Elasticsearch outputs are accepted here as well.
# Note that the settings should point to your Elasticsearch *monitoring* cluster.
# Any setting that is not set is automatically inherited from the Elasticsearch
# output configuration, so if you have the Elasticsearch output configured such
# that it is pointing to your Elasticsearch monitoring cluster, you can simply
# uncomment the following line.
#monitoring.elasticsearch:

# ============================== Instrumentation ===============================

# Instrumentation support for the filebeat.
#instrumentation:
    # Set to true to enable instrumentation of filebeat.
    #enabled: false

    # Environment in which filebeat is running on (eg: staging, production, etc.)
    #environment: ""

    # APM Server hosts to report instrumentation results to.
    #hosts:
    #  - http://localhost:8200

    # API Key for the APM Server(s).
    # If api_key is set then secret_token will be ignored.
    #api_key:

    # Secret token for the APM Server(s).
    #secret_token:


# ================================= Migration ==================================

# This allows to enable 6.7 migration aliases
#migration.6_to_7.enabled: true

## logstash.conf
input {
  beats {
    port => 5044  # Ensure this matches your Filebeat configuration
    host => "0.0.0.0"  # Listen on all interfaces

  }
}

filter {
  # Parses the JSON format logs sent from Filebeat
  json {
    source => "message"
    target => "nginx"
  }

  # Convert fields that should be numeric
  mutate {
    convert => {
      "[nginx][status]" => "integer"
      "[nginx][body_bytes_sent]" => "integer"
      "[nginx][request_time]" => "float"
    }
  }

  # Parse the timestamp from the log to set the @timestamp field for better querying in Kibana
  date {
    match => ["[nginx][time_local]", "dd/MMM/YYYY:H:m:s Z"]
    target => "@timestamp"
  }

  # Optional: Remove the original message to save space
  mutate {
    remove_field => ["message"]
  }
}

output {
  elasticsearch {
    hosts => ["http://elasticsearch:9200"]  # Change to your Elasticsearch host
    index => "nginx-logs-%{+YYYY.MM.dd}"  # Daily index format
    user => "elastic"  # Uncomment these if you have X-Pack security enabled
    password => "elastic"
  }

  # Optional: Output to console (useful for debugging)
  # stdout { codec => rubydebug }
}

## modules.d_nginx.yml
# Module: nginx
# Docs: https://www.elastic.co/guide/en/beats/filebeat/8.13/filebeat-module-nginx.html

- module: nginx
  # Access logs
  access:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/var/log/nginx/access.json"]

  # Error logs
  error:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/var/log/nginx.error.log"]

  # Ingress-nginx controller logs. This is disabled by default. It could be used in Kubernetes environments to parse ingress-nginx logs
  ingress_controller:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

## nginx.conf
# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    log_format json_combined escape=json
      '{'
        '"time_local":"$time_local",'
        '"remote_addr":"$remote_addr",'
        '"remote_user":"$remote_user",'
        '"request":"$request",'
        '"status": $status,'
        '"body_bytes_sent": $body_bytes_sent,'
        '"request_time": $request_time,'
        '"http_referrer":"$http_referer",'
        '"http_user_agent":"$http_user_agent"'
      '}';

        access_log /var/log/nginx/access.json json_combined;


    sendfile            on;
    tcp_nopush          on;
    keepalive_timeout   65;
    types_hash_max_size 4096;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.

    include /etc/nginx/conf.d/*.conf;
    # include proxy servers
    #include /etc/nginx/sites-enabled/*;

    #server {
    #    listen       80;
    #    listen       [::]:80;
    #    server_name  _;
    #    root         /usr/share/nginx/html;

        # Load configuration files for the default server block.
        # include /etc/nginx/default.d/*.conf;

    #}

# Settings for a TLS enabled server.
#
#    server {
#        listen       443 ssl;
#        listen       [::]:443 ssl;
#        http2        on;
#        server_name  _;
#        root         /usr/share/nginx/html;
#
#        ssl_certificate "/etc/pki/nginx/server.crt";
#        ssl_certificate_key "/etc/pki/nginx/private/server.key";
#        ssl_session_cache shared:SSL:1m;
#        ssl_session_timeout  10m;
#        ssl_ciphers PROFILE=SYSTEM;
#        ssl_prefer_server_ciphers on;
#
#        # Load configuration files for the default server block.
#        include /etc/nginx/default.d/*.conf;
#    }

}
	ELASTIC_PASSWORD=elastic_password
	KIBANA_PASSWORD=kibana_password
	version: "3"
	services:
	setup:
	image: docker.elastic.co/elasticsearch/elasticsearch:8.12.1
	environment:
	- ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
	- KIBANA_PASSWORD=${KIBANA_PASSWORD}
	container_name: setup
	command:
	- bash
	- -c
	- \|
	echo "Waiting for Elasticsearch availability";
	until curl -s http://elasticsearch:9200 \| grep -q "missing authentication credentials"; do sleep 30; done;
	echo "Setting kibana_system password";
	until curl -s -X POST -u "elastic:${ELASTIC_PASSWORD}" -H "Content-Type: application/json" http://elasticsearch:9200/_security/user/kibana_system/_password -d "{\"password\":\"${KIBANA_PASSWORD}\"}" \| grep -q "^{}"; do sleep 10; done;
	echo "All done!";
	networks:
	- elk_network

	elasticsearch:
	image: docker.elastic.co/elasticsearch/elasticsearch:8.12.1
	# give the container a name
	# this will also set the container's hostname as elasticsearch
	container_name: elasticsearch
	environment:
	- discovery.type=single-node
	- cluster.name=cluster-elasticsearch
	- bootstrap.memory_lock=true
	# limits elasticsearch to 1 GB of RAM
	# - ES_JAVA_OPTS=-Xms1g -Xmx1g
	# The password for the 'elastic' user
	- ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
	- xpack.security.http.ssl.enabled=false
	volumes:
	- esdata1:/usr/share/elasticsearch/data
	ports:
	- 9200:9200
	networks:
	- elk_network


	kibana:
	image: docker.elastic.co/kibana/kibana:8.12.1
	container_name: kibana
	ports:
	- 5601:5601
	environment:
	# remember the container_name for elasticsearch?
	# we use it here to access that container
	- ELASTICSEARCH_HOSTS=http://elasticsearch:9200
	- ELASTICSEARCH_USERNAME=kibana_system
	- ELASTICSEARCH_PASSWORD=${KIBANA_PASSWORD}
	# Change this to true if you want to sent
	# telemetry data to kibana developers
	- TELEMETRY_ENABLED=false

	depends_on:
	- elasticsearch
	networks:
	- elk_network

	logstash:
	image: docker.elastic.co/logstash/logstash:8.12.1
	container_name: logstash
	command:
	- /bin/bash
	- -c
	- \|
	cp /usr/share/logstash/pipeline/logstash.yml /usr/share/logstash/config/logstash.yml
	echo "Waiting for Elasticsearch availability";
	until curl -s http://elasticsearch:9200 \| grep -q "missing authentication credentials"; do sleep 1; done;
	echo "Starting logstash";
	/usr/share/logstash/bin/logstash -f /usr/share/logstash/pipeline/logstash.conf
	environment:
	- xpack.monitoring.enabled=false
	- ELASTIC_USER=elastic
	- ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
	- ELASTIC_HOSTS=http://elasticsearch:9200
	volumes:
	- ./logstash.conf:/usr/share/logstash/pipeline/logstash.conf
	- /var/log:/var/log # Make sure Logstash can read host logs


	ports:
	- "5044:5044" # Maps port 5044 on the host to port 5044 on the container
	- "9600:9600" # Optionally expose the monitoring API
	depends_on:
	- elasticsearch
	networks:
	- elk_network




	volumes:
	esdata1:
	driver: local

	networks:
	elk_network:
	driver: bridge
	###################### Filebeat Configuration Example #########################

	# This file is an example configuration file highlighting only the most common
	# options. The filebeat.reference.yml file from the same directory contains all the
	# supported options with more comments. You can use it as a reference.
	#
	# You can find the full configuration reference here:
	# https://www.elastic.co/guide/en/beats/filebeat/index.html

	# For more available modules and options, please see the filebeat.reference.yml sample
	# configuration file.

	# ============================== Filebeat inputs ===============================

	filebeat.inputs:

	# Each - is an input. Most options can be set at the input level, so
	# you can use different inputs for various configurations.
	# Below are the input-specific configurations.

	# filestream is an input for collecting log messages from files.
	- type: filestream

	# Unique ID among all inputs, an ID is required.
	id: my-filestream-id

	# Change to true to enable this input configuration.
	enabled: false

	# Paths that should be crawled and fetched. Glob based paths.
	paths:
	- /var/log/*.log
	#- c:\programdata\elasticsearch\logs\*
	# Exclude lines. A list of regular expressions to match. It drops the lines that are
	# matching any regular expression from the list.
	# Line filtering happens after the parsers pipeline. If you would like to filter lines
	# before parsers, use include_message parser.
	#exclude_lines: ['^DBG']

	# Include lines. A list of regular expressions to match. It exports the lines that are
	# matching any regular expression from the list.
	# Line filtering happens after the parsers pipeline. If you would like to filter lines
	# before parsers, use include_message parser.
	#include_lines: ['^ERR', '^WARN']

	# Exclude files. A list of regular expressions to match. Filebeat drops the files that
	# are matching any regular expression from the list. By default, no files are dropped.
	#prospector.scanner.exclude_files: ['.gz$']

	# Optional additional fields. These fields can be freely picked
	# to add additional information to the crawled log files for filtering
	#fields:
	# level: debug
	# review: 1

	# ============================== Filebeat modules ==============================

	filebeat.config.modules:
	# Glob pattern for configuration loading
	path: ${path.config}/modules.d/*.yml

	# Set to true to enable config reloading
	reload.enabled: false

	# Period on which files under path should be checked for changes
	#reload.period: 10s

	# ======================= Elasticsearch template setting =======================

	setup.template.settings:
	index.number_of_shards: 1
	#index.codec: best_compression
	#_source.enabled: false


	# ================================== General ===================================

	# The name of the shipper that publishes the network data. It can be used to group
	# all the transactions sent by a single shipper in the web interface.
	#name:

	# The tags of the shipper are included in their field with each
	# transaction published.
	#tags: ["service-X", "web-tier"]

	# Optional fields that you can specify to add additional information to the
	# output.
	#fields:
	# env: staging

	# ================================= Dashboards =================================
	# These settings control loading the sample dashboards to the Kibana index. Loading
	# the dashboards is disabled by default and can be enabled either by setting the
	# options here or by using the `setup` command.
	#setup.dashboards.enabled: false

	# The URL from where to download the dashboard archive. By default, this URL
	# has a value that is computed based on the Beat name and version. For released
	# versions, this URL points to the dashboard archive on the artifacts.elastic.co
	# website.
	#setup.dashboards.url:

	# =================================== Kibana ===================================

	# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
	# This requires a Kibana endpoint configuration.
	setup.kibana:

	# Kibana Host
	# Scheme and port can be left out and will be set to the default (http and 5601)
	# In case you specify and additional path, the scheme is required: http://localhost:5601/path
	# IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
	#host: "localhost:5601"

	# Kibana Space ID
	# ID of the Kibana Space into which the dashboards should be loaded. By default,
	# the Default Space will be used.
	#space.id:

	# =============================== Elastic Cloud ================================

	# These settings simplify using Filebeat with the Elastic Cloud (https://cloud.elastic.co/).

	# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
	# `setup.kibana.host` options.
	# You can find the `cloud.id` in the Elastic Cloud web UI.
	#cloud.id:

	# The cloud.auth setting overwrites the `output.elasticsearch.username` and
	# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
	#cloud.auth:

	# ================================== Outputs ===================================

	# Configure what output to use when sending the data collected by the beat.

	# ---------------------------- Elasticsearch Output ----------------------------
	#output.elasticsearch:
	# Array of hosts to connect to.
	#hosts: ["192.168.12.95:9200"]

	# Performance preset - one of "balanced", "throughput", "scale",
	# "latency", or "custom".
	#preset: balanced

	# Protocol - either `http` (default) or `https`.
	# protocol: "http"

	# Authentication credentials - either API key or username/password.
	#api_key: "id:api_key"
	# username: "elastic"
	# password: "elastic"

	# ------------------------------ Logstash Output -------------------------------
	output.logstash:
	# The Logstash hosts
	hosts: ["192.168.12.95:5044"] # this ip of host machine running the logstash container
	loadbalance: true
	# Optional SSL. By default is off.
	# List of root certificates for HTTPS server verifications
	#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

	# Certificate for SSL client authentication
	#ssl.certificate: "/etc/pki/client/cert.pem"

	# Client Certificate Key
	#ssl.key: "/etc/pki/client/cert.key"

	# ================================= Processors =================================
	processors:
	- add_host_metadata:
	when.not.contains.tags: forwarded
	- add_cloud_metadata: ~
	- add_docker_metadata: ~
	- add_kubernetes_metadata: ~

	# ================================== Logging ===================================

	# Sets log level. The default log level is info.
	# Available log levels are: error, warning, info, debug
	#logging.level: debug

	# At debug level, you can selectively enable logging only for some components.
	# To enable all selectors, use ["*"]. Examples of other selectors are "beat",
	# "publisher", "service".
	#logging.selectors: ["*"]

	# ============================= X-Pack Monitoring ==============================
	# Filebeat can export internal metrics to a central Elasticsearch monitoring
	# cluster. This requires xpack monitoring to be enabled in Elasticsearch. The
	# reporting is disabled by default.

	# Set to true to enable the monitoring reporter.
	#monitoring.enabled: false

	# Sets the UUID of the Elasticsearch cluster under which monitoring data for this
	# Filebeat instance will appear in the Stack Monitoring UI. If output.elasticsearch
	## Filebeat instance will appear in the Stack Monitoring UI. If output.elasticsearch
	# is enabled, the UUID is derived from the Elasticsearch cluster referenced by output.elasticsearch.
	#monitoring.cluster_uuid:

	# Uncomment to send the metrics to Elasticsearch. Most settings from the
	# Elasticsearch outputs are accepted here as well.
	# Note that the settings should point to your Elasticsearch monitoring cluster.
	# Any setting that is not set is automatically inherited from the Elasticsearch
	# output configuration, so if you have the Elasticsearch output configured such
	# that it is pointing to your Elasticsearch monitoring cluster, you can simply
	# uncomment the following line.
	#monitoring.elasticsearch:

	# ============================== Instrumentation ===============================

	# Instrumentation support for the filebeat.
	#instrumentation:
	# Set to true to enable instrumentation of filebeat.
	#enabled: false

	# Environment in which filebeat is running on (eg: staging, production, etc.)
	#environment: ""

	# APM Server hosts to report instrumentation results to.
	#hosts:
	# - http://localhost:8200

	# API Key for the APM Server(s).
	# If api_key is set then secret_token will be ignored.
	#api_key:

	# Secret token for the APM Server(s).
	#secret_token:


	# ================================= Migration ==================================

	# This allows to enable 6.7 migration aliases
	#migration.6_to_7.enabled: true
	input {
	beats {
	port => 5044 # Ensure this matches your Filebeat configuration
	host => "0.0.0.0" # Listen on all interfaces

	}
	}

	filter {
	# Parses the JSON format logs sent from Filebeat
	json {
	source => "message"
	target => "nginx"
	}

	# Convert fields that should be numeric
	mutate {
	convert => {
	"[nginx][status]" => "integer"
	"[nginx][body_bytes_sent]" => "integer"
	"[nginx][request_time]" => "float"
	}
	}

	# Parse the timestamp from the log to set the @timestamp field for better querying in Kibana
	date {
	match => ["[nginx][time_local]", "dd/MMM/YYYY:H:m:s Z"]
	target => "@timestamp"
	}

	# Optional: Remove the original message to save space
	mutate {
	remove_field => ["message"]
	}
	}

	output {
	elasticsearch {
	hosts => ["http://elasticsearch:9200"] # Change to your Elasticsearch host
	index => "nginx-logs-%{+YYYY.MM.dd}" # Daily index format
	user => "elastic" # Uncomment these if you have X-Pack security enabled
	password => "elastic"
	}

	# Optional: Output to console (useful for debugging)
	# stdout { codec => rubydebug }
	}
	# Module: nginx
	# Docs: https://www.elastic.co/guide/en/beats/filebeat/8.13/filebeat-module-nginx.html

	- module: nginx
	# Access logs
	access:
	enabled: true

	# Set custom paths for the log files. If left empty,
	# Filebeat will choose the paths depending on your OS.
	var.paths: ["/var/log/nginx/access.json"]

	# Error logs
	error:
	enabled: true

	# Set custom paths for the log files. If left empty,
	# Filebeat will choose the paths depending on your OS.
	var.paths: ["/var/log/nginx.error.log"]

	# Ingress-nginx controller logs. This is disabled by default. It could be used in Kubernetes environments to parse ingress-nginx logs
	ingress_controller:
	enabled: true

	# Set custom paths for the log files. If left empty,
	# Filebeat will choose the paths depending on your OS.
	#var.paths:
	# For more information on configuration, see:
	# * Official English Documentation: http://nginx.org/en/docs/
	# * Official Russian Documentation: http://nginx.org/ru/docs/

	user nginx;
	worker_processes auto;
	error_log /var/log/nginx/error.log notice;
	pid /run/nginx.pid;

	# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
	include /usr/share/nginx/modules/*.conf;

	events {
	worker_connections 1024;
	}

	http {
	log_format main '$remote_addr - $remote_user [$time_local] "$request" '
	'$status $body_bytes_sent "$http_referer" '
	'"$http_user_agent" "$http_x_forwarded_for"';

	access_log /var/log/nginx/access.log main;

	log_format json_combined escape=json
	'{'
	'"time_local":"$time_local",'
	'"remote_addr":"$remote_addr",'
	'"remote_user":"$remote_user",'
	'"request":"$request",'
	'"status": $status,'
	'"body_bytes_sent": $body_bytes_sent,'
	'"request_time": $request_time,'
	'"http_referrer":"$http_referer",'
	'"http_user_agent":"$http_user_agent"'
	'}';

	access_log /var/log/nginx/access.json json_combined;


	sendfile on;
	tcp_nopush on;
	keepalive_timeout 65;
	types_hash_max_size 4096;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	# Load modular configuration files from the /etc/nginx/conf.d directory.
	# See http://nginx.org/en/docs/ngx_core_module.html#include
	# for more information.

	include /etc/nginx/conf.d/*.conf;
	# include proxy servers
	#include /etc/nginx/sites-enabled/*;

	#server {
	# listen 80;
	# listen [::]:80;
	# server_name _;
	# root /usr/share/nginx/html;

	# Load configuration files for the default server block.
	# include /etc/nginx/default.d/*.conf;

	#}

	# Settings for a TLS enabled server.
	#
	# server {
	# listen 443 ssl;
	# listen [::]:443 ssl;
	# http2 on;
	# server_name _;
	# root /usr/share/nginx/html;
	#
	# ssl_certificate "/etc/pki/nginx/server.crt";
	# ssl_certificate_key "/etc/pki/nginx/private/server.key";
	# ssl_session_cache shared:SSL:1m;
	# ssl_session_timeout 10m;
	# ssl_ciphers PROFILE=SYSTEM;
	# ssl_prefer_server_ciphers on;
	#
	# # Load configuration files for the default server block.
	# include /etc/nginx/default.d/*.conf;
	# }

	}