{"id":622,"date":"2022-01-16T19:08:00","date_gmt":"2022-01-16T19:08:00","guid":{"rendered":"http:\/\/www.canchito-dev.com\/public\/blog\/?p=622"},"modified":"2022-01-16T19:16:39","modified_gmt":"2022-01-16T19:16:39","slug":"getting-started-with-logstash","status":"publish","type":"post","link":"http:\/\/www.canchito-dev.com\/public\/blog\/2022\/01\/16\/getting-started-with-logstash\/","title":{"rendered":"Getting Started with Logstash"},"content":{"rendered":"<h1>Getting Started with Logstash<\/h1>\n<div class=\"perfect-pullquote vcard pullquote-align-full pullquote-border-placement-left\"><blockquote><p><\/p>\n<p>In this post, we give a brief introduction to Logstash, and afterwards, we deploy it in a dockerized environment.<\/p>\n<p><\/p><\/blockquote><\/div>\n<div><a class=\"donate-with-crypto\" href=\"https:\/\/commerce.coinbase.com\/checkout\/faf64f90-2e80-46ee-aeba-0fde14cbeb46\"><br \/>\nBuy Me a Coffee<br \/>\n<\/a><br \/>\n<script src=\"https:\/\/commerce.coinbase.com\/v1\/checkout.js?version=201807\">\n  <\/script><\/div>\n<div class=\"titlepage\">\n<div>\n<div>\n<h2 class=\"title\">Introduction<\/h2>\n<\/div>\n<\/div>\n<\/div>\n<p style=\"text-align: justify;\">So far, we have <a href=\"http:\/\/www.canchito-dev.com\/public\/blog\/2021\/12\/26\/introduction-to-elastic-stack\/\">learn about Elasticsearch for storing the data that we collect and how to deploy it, Kibana as a Web UI for visualizing the collected data<\/a>, and <a href=\"http:\/\/www.canchito-dev.com\/public\/blog\/2022\/01\/02\/elastic-stack-beats\/\">Filebeat for collecting data from our cluster<\/a>. Now, it is time to learn about Logstash and how it can enrich the collected data.<\/p>\n<p style=\"text-align: justify;\">Logstash is an open source engine designed for collecting data in real-time using pipelines. Thanks to Logstash, we can dynamically unify data from disparate sources and normalize the data into destinations of our choice.<\/p>\n<div class=\"titlepage\">\n<div>\n<div>\n<h2 class=\"title\">How does Logstash work?<\/h2>\n<\/div>\n<\/div>\n<\/div>\n<p style=\"text-align: justify;\">The Logstash event processing pipeline has three stages: inputs \u2192 filters \u2192 outputs. Inputs generate events, filters modify them, and outputs send the data to a specific destination. Inputs and outputs support codecs that enable you to encode or decode the data as it enters or exits the pipeline without having to use a separate filter.<\/p>\n<p style=\"text-align: justify;\">In this post, we will learn about Logstash, configure and deploy one as a docker service. This Logstash will:<\/p>\n<ul>\n<li>Have multiple inputs:\n<ul>\n<li>One input of type heartbeat, which generates heartbeat messages. The general intention of this is to test the performance and availability of Logstash.<\/li>\n<li>One exec input, which periodically run a shell command and capture the whole output as an event.<\/li>\n<li>And from a Filebeat that will be deployed as a Daemonset.<\/li>\n<\/ul>\n<\/li>\n<li>Use filters to enrich the input message generated from the exec input.<\/li>\n<li>Use data-stream for storing append-only time series data across multiple indices while giving you a single named resource for requests. Data streams are well-suited for logs, events, metrics, and other continuously generated data.<\/li>\n<li>Use Logstash pipeline-to-pipeline communications for connecting multiple pipelines within the same Logstash instance.<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">In other posts, we will go deeper into data-streams and pipeline-to-pipeline communications. For now, lets see how to deploy Logstash in a dockerized environment.<\/p>\n<h2>Deploying Logstash in Docker<\/h2>\n<p style=\"text-align: justify;\">Let&#8217;s start by adding a folder which will have Logstash&#8217;s files. The changes in the project should be highlighted.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-highlight=\"9,15-21,25\">elastic-stack-demo\r\n  +- elasticsearch-single-node-cluster\r\n       +- elasticsearch\r\n       |    +- Dockerfile-elasticsearch-single-node\r\n       |    +- elasticsearch-single-node.yml\r\n       +-filebeat\r\n       |    +- Dockerfile\r\n       |    +- filebeat-to-elasticsearch.yml\r\n       |    +- filebeat-to-logstash.yml\r\n       +-kibana\r\n       |    +- Dockerfile-kibana-single-node\r\n       |    +- kibana-single-node.yml\r\n       +-logstash\r\n       |    +- config\r\n       |    |    +- logstash.yml\r\n       |    |    +- pipelines.yml\r\n       |    +- pipeline\r\n       |    |    +- beats-example.conf\r\n       |    |    +- data-stream-example.conf\r\n       |    |    +- output.conf\r\n       |    +- Dockerfile\r\n       +- .env\r\n       +- docker-compose-es-single-node.yml\r\n       +- docker-compose-filebeat-to-elasticseach.yml\r\n       +- docker-compose-logstash.yml\r\n<\/pre>\n<p style=\"text-align: justify;\">The first file we will be creating is the <code class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">Dockerfile<\/code>. Create it under <code class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">elastic-stack-single-node-cluster\/logstash\/<\/code>, and paste the following code:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">ARG ELK_VERSION\r\n\r\nFROM docker.elastic.co\/logstash\/logstash:${ELK_VERSION}\r\n\r\nRUN rm -f \/usr\/share\/logstash\/pipeline\/logstash.conf\r\n\r\n# pipeline source folder\r\nADD --chown=logstash:logstash pipeline\/ \/usr\/share\/logstash\/pipeline\/\r\n\r\n# pipeline configurations\r\nADD --chown=root:logstash config\/pipelines.yml \/usr\/share\/logstash\/config\/pipelines.yml\r\n\r\n# add logstash configuration\r\nADD --chown=root:logstash config\/logstash.yml \/usr\/share\/logstash\/config\/logstash.yml\r\n\r\n# add any plug in\r\n# RUN bin\/logstash-plugin install logstash-filter-math\r\n<\/pre>\n<p style=\"text-align: justify;\">This is what we are doing in this <code class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">Dockerfile<\/code> file:<\/p>\n<ul>\n<li>Line 5: Removing default Logstash configuration file.<\/li>\n<li>Line 8: Adding our customized pipelines configurations.<\/li>\n<li>Line 11: Since we are running more than one pipeline in the same process, we need to add the configuration for each pipeline.<\/li>\n<li>Line 14: Adding our customized Logstash configuration file.<\/li>\n<li>Line 17: An example on how to add additional plugins.<\/li>\n<\/ul>\n<p>Next, create a <code class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">logstash.yml<\/code> file under <code class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">elastic-stack-single-node-cluster\/logstash\/config<\/code>, and paste the following:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">http.host: \"0.0.0.0\"\r\nxpack.monitoring.enabled: true\r\nxpack.monitoring.elasticsearch.hosts: [ \"http:\/\/elasticsearch-demo:9200\" ]\r\nlog.level: info<\/pre>\n<p>In the same folder, we will create a file called <code class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">pipelines.yml<\/code>, and paste this:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\"># This file is where you define your pipelines. You can define multiple.\r\n# For more information on multiple pipelines, see the documentation:\r\n#   https:\/\/www.elastic.co\/guide\/en\/logstash\/current\/multiple-pipelines.html\r\n\r\n - pipeline.id: data-stream-example\r\n   path.config: \".\/pipeline\/data-stream-example.conf\"\r\n - pipeline.id: beats-example\r\n   path.config: \".\/pipeline\/beats-example.conf\"\r\n - pipeline.id: output\r\n   path.config: \".\/pipeline\/output.conf\"<\/pre>\n<p style=\"text-align: justify;\">This file contains the configuration for the three pipelines we will be using. As you can see, we just specified the basic information. An id for each pipeline, and a route to where the configuration of that pipeline is.<\/p>\n<p style=\"text-align: justify;\"><em>data-stream-example<\/em> pipeline will generate events from a heartbeat input and from an exec input. Whereas, <em>beats-example<\/em> pipeline will receive the information from a Filebeat that we will configure later on. Both pipelines will send the events to <em>output<\/em> pipeline, which is in charge of sending the already processed events to Elasticsearch.<\/p>\n<p style=\"text-align: justify;\">As we have said, each pipeline has a configuation file. Here is <em>data-stream-example<\/em> configuration file. The name of the file is <code class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">data-stream-example.yml<\/code> file, found under <code class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">elastic-stack-single-node-cluster\/logstash\/pipeline<\/code>:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">input {\r\n    heartbeat {\r\n        interval =&gt; 5\r\n        message  =&gt; 'Hello World from heartbeat-data-stream &#x1f493;'\r\n        tags =&gt; [ 'heartbeat-data-stream' ]\r\n        add_field =&gt; { '[data_stream][namespace]' =&gt; 'local' }\r\n        add_field =&gt; { '[data_stream][type]' =&gt; 'logs' }\r\n        add_field =&gt; { '[data_stream][dataset]' =&gt; 'heartbeat.data.stream' }\r\n    }\r\n\r\n    exec {\r\n        command =&gt; \"uptime\"\r\n        interval =&gt; 10\r\n        tags =&gt; [ 'uptime-data-stream' ]\r\n        add_field =&gt; { '[data_stream][namespace]' =&gt; 'local' }\r\n        add_field =&gt; { '[data_stream][type]' =&gt; 'logs' }\r\n        add_field =&gt; { '[data_stream][dataset]' =&gt; 'uptime.data.stream' }\r\n    }\r\n}\r\n\r\nfilter {\r\n    mutate { remove_field =&gt; [ 'host' ] }\r\n\r\n    if 'uptime-data-stream' in [tags] {\r\n        grok {\r\n            match =&gt; { 'message' =&gt; '%{TIME:currentTime} %{WORD:status}  %{HOUR:hoursUp}:%{MINUTE:minutesUp},  %{NUMBER:users} users,  load average: %{NUMBER:loadAverageCpuPerMinute}, %{NUMBER:loadAverageCpuPerFiveMinutes}, %{NUMBER:loadAverageCpuPerFifteenMinutes}' }\r\n        }\r\n        mutate {\r\n            remove_field =&gt; [ 'message' ]\r\n        }\r\n    }\r\n}\r\n\r\noutput {\r\n    pipeline { send_to =&gt; [commonOut] }\r\n}<\/pre>\n<p style=\"text-align: justify;\">As you can see, it has two inputs:<\/p>\n<ul>\n<li>One input of type heartbeat, which generates heartbeat messages. The general intention of this is to test the performance and availability of Logstash.<\/li>\n<li>One exec input, which periodically run a shell command and capture the whole output as an event.<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">Notice that in each input, we are adding three fields. These fields will be used later in the output pipeline, to determine where the capture event should be sent.<\/p>\n<p style=\"text-align: justify;\">In the filter section, if the event was generated by the exec input, we parse and split the message field, into independent fields.<\/p>\n<p style=\"text-align: justify;\">Here is <em>beats-example<\/em> configuration file. The name of the file is <code class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">beats-example.yml<\/code> file, found under <code class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">elastic-stack-single-node-cluster\/logstash\/pipeline<\/code>:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">input {\r\n    beats {\r\n        tags =&gt; [ 'filebeat' ]\r\n        port =&gt; 5044\r\n        add_field =&gt; { '[data_stream][namespace]' =&gt; 'local' }\r\n        add_field =&gt; { '[data_stream][type]' =&gt; 'logs' }\r\n        add_field =&gt; { '[data_stream][dataset]' =&gt; 'filebeat' }\r\n    }\r\n}\r\n\r\noutput {\r\n    pipeline { send_to =&gt; [commonOut] }\r\n}<\/pre>\n<p style=\"text-align: justify;\">And finally, Here is <em>beats-example<\/em> configuration file. The name of the file is <code class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">output.yml<\/code> file, found under <code class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">elastic-stack-single-node-cluster\/logstash\/pipeline<\/code>:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">input {\r\n  pipeline {\r\n    address =&gt; commonOut\r\n  }\r\n}\r\n\r\noutput {\r\n#    stdout { codec =&gt;  'rubydebug' }\r\n\r\n    elasticsearch {\r\n        hosts =&gt; [ 'http:\/\/elasticsearch-demo:9200' ]\r\n        data_stream =&gt; 'true'\r\n        data_stream_auto_routing =&gt; 'true'\r\n    }\r\n}<\/pre>\n<p style=\"text-align: justify;\">We have configured Logstash. The next thing would be to create a <em>docker-compose<\/em> file under <code class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">elastic-stack-single-node-cluster\/<\/code> and name it <code class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">docker-compose-logstash.yml<\/code>.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\">version: '3.9'\r\nservices:\r\n  logstash-demo:\r\n    build:\r\n      context: logstash\/\r\n      args:\r\n        - ELK_VERSION=${ELK_VERSION}\r\n    ports:\r\n      - 9600:9600\r\n    hostname: logstash-demo\r\n    container_name: logstash-demo\r\n    logging:\r\n      driver: \"json-file\"\r\n      options:\r\n        max-size: \"10k\"\r\n        max-file: \"10\"\r\n    environment:\r\n      - \"LS_JAVA_OPTS=-Xms512m -Xmx512m\"\r\n    labels:\r\n      co.elastic.logs\/module: logstash\r\n      co.elastic.metrics\/module: logstash\r\n    networks:\r\n      - elastic-stack-service-network\r\n\r\n# Networks to be created to facilitate communication between containers\r\nnetworks:\r\n  elastic-stack-service-network:\r\n    name: elastic-stack-service-network<\/pre>\n<p style=\"text-align: justify;\">Great. We are ready to start Logstash, by executing the following command:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">$ docker-compose -f docker-compose-logstash.yml up -d --build<\/pre>\n<p style=\"text-align: justify;\">Once up, wait a few minutes and go to <a href=\"http:\/\/localhost:5601\/app\/monitoring\">Management &gt; Stack Monitoring<\/a>. You should be able to see Logstash as part of your cluster monitoring.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"627\" data-permalink=\"http:\/\/www.canchito-dev.com\/public\/blog\/2022\/01\/16\/getting-started-with-logstash\/management_stack_monitoring_with_logstash\/\" data-orig-file=\"http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/management_stack_monitoring_with_logstash.png\" data-orig-size=\"3838,2524\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"CANCHITO-DEV: Kibana&amp;#8217;s Management &gt; Stack Monitoring with Logstash\" data-image-description=\"\" data-image-caption=\"&lt;p&gt;CANCHITO-DEV: Kibana&amp;#8217;s Management &gt; Stack Monitoring with Logstash&lt;\/p&gt;\n\" data-large-file=\"http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/management_stack_monitoring_with_logstash-1024x673.png\" class=\"aligncenter wp-image-627 size-large\" src=\"http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/management_stack_monitoring_with_logstash-1024x673.png\" alt=\"CANCHITO-DEV: Kibana's Management &gt; Stack Monitoring with Logstash\" width=\"625\" height=\"411\" srcset=\"http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/management_stack_monitoring_with_logstash-1024x673.png 1024w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/management_stack_monitoring_with_logstash-300x197.png 300w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/management_stack_monitoring_with_logstash-768x505.png 768w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/management_stack_monitoring_with_logstash-1536x1010.png 1536w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/management_stack_monitoring_with_logstash-2048x1347.png 2048w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/management_stack_monitoring_with_logstash-624x410.png 624w\" sizes=\"auto, (max-width: 625px) 100vw, 625px\" \/><\/p>\n<p style=\"text-align: justify;\">And if you go to <a href=\"http:\/\/localhost:5601\/app\/management\/data\/index_management\">Management &gt; Stack Monitoring &gt; Index Management<\/a>, and click in the <em>Data Streams<\/em>, you should see the three data streams created by out Logstash pipelines.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"628\" data-permalink=\"http:\/\/www.canchito-dev.com\/public\/blog\/2022\/01\/16\/getting-started-with-logstash\/stack_management_index_management_with_data_streams\/\" data-orig-file=\"http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/stack_management_index_management_with_data_streams.png\" data-orig-size=\"3254,1978\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"CANCHITO-DEV: Kibana&amp;#8217;s Stack Management &gt; Index Management &gt; Data Streams\" data-image-description=\"\" data-image-caption=\"&lt;p&gt;CANCHITO-DEV: Kibana&amp;#8217;s Stack Management &gt; Index Management &gt; Data Streams&lt;\/p&gt;\n\" data-large-file=\"http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/stack_management_index_management_with_data_streams-1024x622.png\" class=\"wp-image-628 size-large aligncenter\" src=\"http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/stack_management_index_management_with_data_streams-1024x622.png\" alt=\"CANCHITO-DEV: Kibana's Stack Management &gt; Index Management &gt; Data Streams\" width=\"625\" height=\"380\" srcset=\"http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/stack_management_index_management_with_data_streams-1024x622.png 1024w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/stack_management_index_management_with_data_streams-300x182.png 300w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/stack_management_index_management_with_data_streams-768x467.png 768w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/stack_management_index_management_with_data_streams-1536x934.png 1536w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/stack_management_index_management_with_data_streams-2048x1245.png 2048w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/stack_management_index_management_with_data_streams-624x379.png 624w\" sizes=\"auto, (max-width: 625px) 100vw, 625px\" \/><\/p>\n<p style=\"text-align: justify;\">However, even though the data streams are already created, the data stream from <em>beats-example<\/em> pipeline is not receiving anything. This is because there is no beat sending events to Logstash. In the following section, we will start a Filebeat and read our cluster logs. This is the same Filebeat that we have already deployed in this <a href=\"http:\/\/www.canchito-dev.com\/public\/blog\/2021\/12\/31\/deploying-filebeat-in-docker\/\">post<\/a>. The only difference, is that we will be sending the events to Logstash.<\/p>\n<h2>Deploying Filebeat in Docker<\/h2>\n<p style=\"text-align: justify;\">In one of our previous <a href=\"http:\/\/www.canchito-dev.com\/public\/blog\/2021\/12\/31\/deploying-filebeat-in-docker\/\">posts<\/a>, we deployed a Filebeat that captures all the logs generated by all our containers and by our cluster. But this Filebeat sent those captured events directly to Elasticsearch. Now, we will be deploying the same Filebeat, but the events will be sent to Logstash.<\/p>\n<p style=\"text-align: justify;\">Let&#8217;s begin by creating a <em>docker-compose<\/em> file under <code class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">elastic-stack-single-node-cluster\/<\/code> and name it <code class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">docker-compose-filebeat-to-logstash.yml<\/code>.<\/p>\n<p style=\"text-align: justify;\">Next, we need the configuration <code class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">YAML<\/code> file named <code class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">filebeat-to-logstash.yml<\/code>. Created it under <code class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">elastic-stack-single-node-cluster\/filebeat\/<\/code>. Here is the code you will need:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"yaml\" data-enlighter-highlight=\"39-50\">######################## Filebeat Configuration ############################\r\n# You can find the full configuration reference here:\r\n# https:\/\/www.elastic.co\/guide\/en\/beats\/filebeat\/index.html\r\n\r\n# ========================== Filebeat global options ===========================\r\n# Enable filebeat config reloading\r\nfilebeat.config:\r\n  modules:\r\n    path: ${path.config}\/modules.d\/*.yml\r\n    reload.enabled: false\r\n\r\n# =========================== Filebeat autodiscover ============================\r\n# Autodiscover allows you to detect changes in the system and spawn new modules\r\n# or inputs as they happen.\r\nfilebeat.autodiscover:\r\n  # List of enabled autodiscover providers\r\n  providers:\r\n    - type: docker\r\n      hints.enabled: true\r\n\r\n# ================================= Processors =================================\r\n# Processors are used to reduce the number of fields in the exported event or to\r\n# enhance the event with external metadata. This section defines a list of\r\n# processors that are applied one by one and the first one receives the initial\r\n# event:\r\n#\r\n#   event -&gt; filter1 -&gt; event1 -&gt; filter2 -&gt;event2 ...\r\n#\r\n# The supported processors are drop_fields, drop_event, include_fields,\r\n# decode_json_fields, and add_cloud_metadata.\r\nprocessors:\r\n  # The following example enriches each event with docker metadata, it matches\r\n  # container id from log path available in `source` field (by default it expects\r\n  # it to be \/var\/lib\/docker\/containers\/*\/*.log).\r\n  - add_docker_metadata: ~\r\n  # The following example enriches each event with host metadata.\r\n  - add_host_metadata: ~\r\n\r\n# ================================== Outputs ===================================\r\n# Configure what output to use when sending the data collected by the beat.\r\n# ------------------------------ Logstash Output -------------------------------\r\noutput.logstash:\r\n  # Boolean flag to enable or disable the output module.\r\n  enabled: true\r\n\r\n  # The Logstash hosts\r\n  hosts: [\"logstash-demo:5044\"]\r\n\r\n  # Optionally load-balance events between Logstash hosts. Default is false.\r\n  #loadbalance: false\r\n\r\n# ================================= Dashboards =================================\r\n# These settings control loading the sample dashboards to the Kibana index. Loading\r\n# the dashboards are disabled by default and can be enabled either by setting the\r\n# options here, or by using the `-setup` CLI flag or the `setup` command.\r\nsetup.dashboards.enabled: true\r\n\r\n# =================================== Kibana ===================================\r\n# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.\r\n# This requires a Kibana endpoint configuration.\r\nsetup.kibana:\r\n  # Kibana Host\r\n  # Scheme and port can be left out and will be set to the default (http and 5601)\r\n  # In case you specify and additional path, the scheme is required: http:\/\/localhost:5601\/path\r\n  # IPv6 addresses should always be defined as: https:\/\/[2001:db8::1]:5601\r\n  host: \"kibana-demo:5601\"\r\n\r\n# ================================== Logging ===================================\r\n# There are four options for the log output: file, stderr, syslog, eventlog\r\n# The file output is the default.\r\n# Sets log level. The default log level is info.\r\n# Available log levels are: error, warning, info, debug\r\nlogging.level: info\r\n\r\n# Write Filebeat own logs only to file to avoid catching them with itself in docker log files\r\n# When true, writes all logging output to files. The log files are automatically rotated when the\r\n# log file size limit is reached.\r\nlogging.to_files: true\r\n\r\n# When true, writes all logging output to the syslog. This option is not supported on Windows.\r\nlogging.to_syslog: false\r\n\r\n# ============================= X-Pack Monitoring ==============================\r\n# Filebeat can export internal metrics to a central Elasticsearch monitoring\r\n# cluster.  This requires xpack monitoring to be enabled in Elasticsearch.  The\r\n# reporting is disabled by default.\r\n\r\n# Set to true to enable the monitoring reporter.\r\nmonitoring.enabled: true\r\n\r\n# Uncomment to send the metrics to Elasticsearch. Most settings from the\r\n# Elasticsearch output are accepted here as well.\r\n# Note that the settings should point to your Elasticsearch *monitoring* cluster.\r\n# Any setting that is not set is automatically inherited from the Elasticsearch\r\n# output configuration, so if you have the Elasticsearch output configured such\r\n# that it is pointing to your Elasticsearch monitoring cluster, you can simply\r\n# uncomment the following line.\r\nmonitoring.elasticsearch:\r\n  # Array of hosts to connect to.\r\n  # Scheme and port can be left out and will be set to the default (http and 9200)\r\n  # In case you specify and additional path, the scheme is required: http:\/\/localhost:9200\/path\r\n  # IPv6 addresses should always be defined as: https:\/\/[2001:db8::1]:9200\r\n  hosts: ['elasticsearch-demo:9200']\r\n\r\n# =============================== HTTP Endpoint ================================\r\n# Each beat can expose internal metrics through a HTTP endpoint. For security\r\n# reasons the endpoint is disabled by default. This feature is currently experimental.\r\n# Stats can be access through http:\/\/localhost:5066\/stats . For pretty JSON output\r\n# append ?pretty to the URL.\r\n# Defines if the HTTP endpoint is enabled.\r\nhttp.enabled: true\r\n\r\n# The HTTP endpoint will bind to this hostname, IP address, unix socket or named pipe.\r\n# When using IP addresses, it is recommended to only use localhost.\r\nhttp.host: filebeat-to-logstash-demo\r\n\r\n# Port on which the HTTP endpoint will bind. Default is 5066.\r\nhttp.port: 5066<\/pre>\n<p style=\"text-align: justify;\">Lines 39 to 50 specify the output configuration. See that we have specified the port to which the events should be sent, and that it is the same port as the one configure in the input section of the <em>beats-example<\/em> pipeline.<\/p>\n<p style=\"text-align: justify;\">Great. We are ready to start Filebeat, by executing the following command:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">$ docker-compose -f docker-compose-filebeat-to-logstash.yml up -d --build<\/pre>\n<p style=\"text-align: justify;\">That&#8217;s it. Logstash should be already receiving events from Filebeat. Let&#8217;s make sure of this, by creating first an index patter in Kibana.<\/p>\n<p style=\"text-align: justify;\">Go to <a href=\"http:\/\/localhost:5601\/app\/management\/kibana\/indexPatterns\">Management &gt; Stack Monitoring &gt; Kibana &gt; Index Patterns<\/a>, and click on the <em>Create Index Pattern<\/em> button located in the top right corner. Fill in the information as shown in the below image and click on the <em>Create Index Pattern<\/em> button located in the bottom middle. Repeat the step for the other data sreams.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"631\" data-permalink=\"http:\/\/www.canchito-dev.com\/public\/blog\/2022\/01\/16\/getting-started-with-logstash\/kibana_create_index_pattern\/\" data-orig-file=\"http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/kibana_create_index_pattern.png\" data-orig-size=\"3678,1984\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"CANCHITO-DEV: Kibana&amp;#8217;s Stack Management &gt; Index Management &gt; Index Patterns\" data-image-description=\"\" data-image-caption=\"&lt;p&gt;CANCHITO-DEV: Kibana&amp;#8217;s Stack Management &gt; Index Management &gt; Index Patterns&lt;\/p&gt;\n\" data-large-file=\"http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/kibana_create_index_pattern-1024x552.png\" class=\"aligncenter wp-image-631 size-large\" src=\"http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/kibana_create_index_pattern-1024x552.png\" alt=\"CANCHITO-DEV: Kibana's Stack Management &gt; Index Management &gt; Index Patterns\" width=\"625\" height=\"337\" srcset=\"http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/kibana_create_index_pattern-1024x552.png 1024w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/kibana_create_index_pattern-300x162.png 300w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/kibana_create_index_pattern-768x414.png 768w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/kibana_create_index_pattern-1536x829.png 1536w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/kibana_create_index_pattern-2048x1105.png 2048w, http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/kibana_create_index_pattern-624x337.png 624w\" sizes=\"auto, (max-width: 625px) 100vw, 625px\" \/><\/p>\n<p style=\"text-align: justify;\">If you would like to see the indexed logs, go to <a href=\"http:\/\/localhost:5601\/app\/monitoring\">Analytics &gt; Discover<\/a>.<\/p>\n<h2>Clean Up<\/h2>\n<p>To do a complete clean up, execute this command:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">$ docker-compose -f docker-compose-es-single-node.yml -f docker-compose-filebeat-to-elasticseach.yml -f docker-compose-filebeat-to-logstash.yml -f docker-compose-logstash.yml down -v<\/pre>\n<h2 style=\"text-align: justify;\">Summary<\/h2>\n<p style=\"text-align: justify;\">In this post, we learn about Logstash and how to configure and deploy it in a dockerized environment. We also saw how to configure Logstash to use pipeline-to-pipeline communications and data-streams (although we will go deeper into them in other posts).<\/p>\n<p style=\"text-align: justify;\">In addition, we have deployed Filebeat in a dockerized environment, using hints with autodiscover to monitor Elasticsearch and Kibana, but configure it so send the capture events to Logstash.<\/p>\n<p style=\"text-align: justify;\">Please feel free to contact us. We will gladly response to any doubt or question you might have. In the mean time, you can download the source code from our official <a href=\"https:\/\/github.com\/canchito-dev\/elastic-stack-demo\">GitHub<\/a> repository.<\/p>\n<p style=\"text-align: justify;\">\n","protected":false},"excerpt":{"rendered":"<p>In this post, we give a brief introduction to Logstash.<\/p>\n","protected":false},"author":1,"featured_media":612,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[62,74,88,84,95,87],"tags":[104,63,114,89,106,92,93],"class_list":["post-622","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-docker","category-docker-compose","category-elastic-stack","category-elk","category-filebeat","category-logstash","tag-beat","tag-docker","tag-elasticseach","tag-elk","tag-filebeat","tag-kibana","tag-logstash"],"aioseo_notices":[],"jetpack_featured_media_url":"http:\/\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/logstash-logo-color.png","jetpack_shortlink":"https:\/\/wp.me\/p8EwXo-a2","jetpack-related-posts":[{"id":564,"url":"http:\/\/www.canchito-dev.com\/public\/blog\/2021\/12\/26\/introduction-to-elastic-stack\/","url_meta":{"origin":622,"position":0},"title":"Introduction to Elastic Stack","author":"canchitodev","date":"December 26, 2021","format":false,"excerpt":"Hello friends! In this post, we will give you a small introduction to Elastic Stack including all the products that build it.","rel":"","context":"In &quot;Beat&quot;","block_context":{"text":"Beat","link":"http:\/\/www.canchito-dev.com\/public\/blog\/category\/elk\/beat\/"},"img":{"alt_text":"CANCHITO-DEV: Elastic Stack architecture in Docker","src":"https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2021\/12\/docker_elastic_stack_architecture.png?resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2021\/12\/docker_elastic_stack_architecture.png?resize=350%2C200 1x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2021\/12\/docker_elastic_stack_architecture.png?resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2021\/12\/docker_elastic_stack_architecture.png?resize=700%2C400 2x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2021\/12\/docker_elastic_stack_architecture.png?resize=1050%2C600 3x"},"classes":[]},{"id":590,"url":"http:\/\/www.canchito-dev.com\/public\/blog\/2022\/01\/02\/elastic-stack-beats\/","url_meta":{"origin":622,"position":1},"title":"Introduction to Elastic Stack Beats","author":"canchitodev","date":"January 2, 2022","format":false,"excerpt":"How is information sent to Elasticsearch? The answer is simple, using Beats or Logstash. In this post, we will give a brief introduction to Beats.","rel":"","context":"In &quot;Auditbeat&quot;","block_context":{"text":"Auditbeat","link":"http:\/\/www.canchito-dev.com\/public\/blog\/category\/elk\/auditbeat\/"},"img":{"alt_text":"CANCHITO-DEV: Beats basic diagram","src":"https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2021\/12\/beats_diagram.png?resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2021\/12\/beats_diagram.png?resize=350%2C200 1x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2021\/12\/beats_diagram.png?resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2021\/12\/beats_diagram.png?resize=700%2C400 2x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2021\/12\/beats_diagram.png?resize=1050%2C600 3x"},"classes":[]},{"id":647,"url":"http:\/\/www.canchito-dev.com\/public\/blog\/2022\/01\/31\/know-if-your-service-is-available-with-heartbeat\/","url_meta":{"origin":622,"position":2},"title":"Know if your Service is Available with Heartbeat","author":"canchitodev","date":"January 31, 2022","format":false,"excerpt":"Learn how Heartbeat periodically checks the status of your services and determine whether they are available. All within a dockerized enviroment.","rel":"","context":"In &quot;Beat&quot;","block_context":{"text":"Beat","link":"http:\/\/www.canchito-dev.com\/public\/blog\/category\/elk\/beat\/"},"img":{"alt_text":"CANCHITO-DEV: [Heartbeat] HTTP Monitoring","src":"https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/heartbeat_dashboard_http_monitoring.png?resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/heartbeat_dashboard_http_monitoring.png?resize=350%2C200 1x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/heartbeat_dashboard_http_monitoring.png?resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/heartbeat_dashboard_http_monitoring.png?resize=700%2C400 2x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/heartbeat_dashboard_http_monitoring.png?resize=1050%2C600 3x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/heartbeat_dashboard_http_monitoring.png?resize=1400%2C800 4x"},"classes":[]},{"id":636,"url":"http:\/\/www.canchito-dev.com\/public\/blog\/2022\/01\/27\/collect-metrics-with-metricbet\/","url_meta":{"origin":622,"position":3},"title":"Collect Metrics with Metricbet","author":"canchitodev","date":"January 27, 2022","format":false,"excerpt":"Learn how you could use Metricbeat to monitor your servers by collecting metrics from the system and services running on the server.","rel":"","context":"In &quot;Beat&quot;","block_context":{"text":"Beat","link":"http:\/\/www.canchito-dev.com\/public\/blog\/category\/elk\/beat\/"},"img":{"alt_text":"CANCHITO-DEV: [Metricbeat System] Host overview ECS","src":"https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/metricbeat_system_dashboard__host_overview_ecs.png?resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/metricbeat_system_dashboard__host_overview_ecs.png?resize=350%2C200 1x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/metricbeat_system_dashboard__host_overview_ecs.png?resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/metricbeat_system_dashboard__host_overview_ecs.png?resize=700%2C400 2x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/metricbeat_system_dashboard__host_overview_ecs.png?resize=1050%2C600 3x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/01\/metricbeat_system_dashboard__host_overview_ecs.png?resize=1400%2C800 4x"},"classes":[]},{"id":588,"url":"http:\/\/www.canchito-dev.com\/public\/blog\/2021\/12\/31\/deploying-filebeat-in-docker\/","url_meta":{"origin":622,"position":4},"title":"Deploying Filebeat in docker","author":"canchitodev","date":"December 31, 2021","format":false,"excerpt":"Learn about Filebeat and how it interact with the rest of the Elastic Stack components while you deploy it using docker.","rel":"","context":"In &quot;Beat&quot;","block_context":{"text":"Beat","link":"http:\/\/www.canchito-dev.com\/public\/blog\/category\/elk\/beat\/"},"img":{"alt_text":"CANCHITO-DEV: Filebeat Overview","src":"https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2021\/12\/filebeat_overview.png?resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2021\/12\/filebeat_overview.png?resize=350%2C200 1x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2021\/12\/filebeat_overview.png?resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2021\/12\/filebeat_overview.png?resize=700%2C400 2x"},"classes":[]},{"id":665,"url":"http:\/\/www.canchito-dev.com\/public\/blog\/2022\/02\/05\/audit-the-activities-of-users-and-processes-on-your-systems-with-auditbeat\/","url_meta":{"origin":622,"position":5},"title":"Audit the activities of users and processes on your systems with Auditbeat","author":"canchitodev","date":"February 5, 2022","format":false,"excerpt":"Get to know Auditbeat and learn how it can help you by auditing the activities of the users and processes on your systems. All within a dockerized enviroment.","rel":"","context":"In &quot;Auditbeat&quot;","block_context":{"text":"Auditbeat","link":"http:\/\/www.canchito-dev.com\/public\/blog\/category\/elk\/auditbeat\/"},"img":{"alt_text":"CANCHITO-DEV: Kibana's Management > Stack Monitoring Complete","src":"https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/02\/stack_monitoring_whole_architecture.png?resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/02\/stack_monitoring_whole_architecture.png?resize=350%2C200 1x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/02\/stack_monitoring_whole_architecture.png?resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/02\/stack_monitoring_whole_architecture.png?resize=700%2C400 2x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/02\/stack_monitoring_whole_architecture.png?resize=1050%2C600 3x, https:\/\/i0.wp.com\/www.canchito-dev.com\/public\/blog\/wp-content\/uploads\/2022\/02\/stack_monitoring_whole_architecture.png?resize=1400%2C800 4x"},"classes":[]}],"jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"http:\/\/www.canchito-dev.com\/public\/blog\/wp-json\/wp\/v2\/posts\/622","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.canchito-dev.com\/public\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.canchito-dev.com\/public\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.canchito-dev.com\/public\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.canchito-dev.com\/public\/blog\/wp-json\/wp\/v2\/comments?post=622"}],"version-history":[{"count":8,"href":"http:\/\/www.canchito-dev.com\/public\/blog\/wp-json\/wp\/v2\/posts\/622\/revisions"}],"predecessor-version":[{"id":634,"href":"http:\/\/www.canchito-dev.com\/public\/blog\/wp-json\/wp\/v2\/posts\/622\/revisions\/634"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.canchito-dev.com\/public\/blog\/wp-json\/wp\/v2\/media\/612"}],"wp:attachment":[{"href":"http:\/\/www.canchito-dev.com\/public\/blog\/wp-json\/wp\/v2\/media?parent=622"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.canchito-dev.com\/public\/blog\/wp-json\/wp\/v2\/categories?post=622"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.canchito-dev.com\/public\/blog\/wp-json\/wp\/v2\/tags?post=622"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}