Setup

Configuration tl;dr

Files
Sample configuration
Encryption certificate
Listener
Port 5015. For help finding your region’s listener URL, see Account region.
Default log locations
If installed from Omnibus packages: /var/log/gitlab/...
If installed from source: /home/git/gitlab/log/...
See Log system from GitLab for more information.
Log type (for preconfigured parsing)
Production, JSON: gitlab-production-json
Production, plain text: gitlab-production
API: gitlab-api-json
Application: gitlab-application
Guided configuration

You’ll need: GitLab installed locally, Filebeat 7 or Filebeat 6

  1. Download the Logz.io certificate

    For HTTPS shipping, download the Logz.io public certificate to your certificate authority folder.

     sudo wget https://raw.githubusercontent.com/logzio/public-certificates/master/COMODORSADomainValidationSecureServerCA.crt -P /etc/pki/tls/certs/
    
  2. Add GitLab as an input

    In the Filebeat configuration file (/etc/filebeat/filebeat.yml), add GitLab to the filebeat.inputs section.

    GitLab has an advanced logging framework that ships a variety of different system logs. We recommend reading Log system from GitLab and modifying the Filebeat sample configuration according to your needs.

    Replace <ACCOUNT-TOKEN> with the token of the account you want to ship to.

     # Filebeat 7 configuration
    
     filebeat.inputs:
     - type: log
     paths:
     - /var/log/gitlab/gitlab-rails/production_json.log
     fields:
     logzio_codec: json
    
     # Your Logz.io account token. You can find your token at
     #  https://app.logz.io/#/dashboard/settings/manage-accounts
     token: <ACCOUNT-TOKEN>
     type: gitlab-production-json
     fields_under_root: true
     encoding: utf-8
     ignore_older: 3h
    
     - type: log
     paths:
     - /var/log/gitlab/gitlab-rails/production.log
     fields:
     logzio_codec: plain
    
     # Your Logz.io account token. You can find your token at
     #  https://app.logz.io/#/dashboard/settings/manage-accounts
     token: <ACCOUNT-TOKEN>
     type: gitlab-production
     fields_under_root: true
     encoding: utf-8
     ignore_older: 3h
    
     - type: log
     paths:
     - /var/log/gitlab/gitlab-rails/api_json.log
     fields:
     logzio_codec: json
    
     # Your Logz.io account token. You can find your token at
     #  https://app.logz.io/#/dashboard/settings/manage-accounts
     token: <ACCOUNT-TOKEN>
     type: gitlab-api-json
     fields_under_root: true
     encoding: utf-8
     ignore_older: 3h
    
     - type: log
     paths:
     - /var/log/gitlab/gitlab-rails/application.log
     fields:
     logzio_codec: json
    
     # Your Logz.io account token. You can find your token at
     #  https://app.logz.io/#/dashboard/settings/manage-accounts
     token: <ACCOUNT-TOKEN>
     type: gitlab-application
     fields_under_root: true
     encoding: utf-8
     ignore_older: 3h
    
     filebeat.registry.path: /var/lib/filebeat
     processors:
     - rename:
         fields:
         - from: "agent"
           to: "filebeat_agent"
         ignore_missing: true
     - rename:
         fields:
         - from: "log.file.path"
           to: "source"
         ignore_missing: true
    
     # Filebeat 6 configuration
    
     filebeat.inputs:
     - type: log
       paths:
       - /var/log/gitlab/gitlab-rails/production_json.log
       fields:
         logzio_codec: json
    
         # Your Logz.io account token. You can find your token at
         #  https://app.logz.io/#/dashboard/settings/manage-accounts
         token: <ACCOUNT-TOKEN>
         type: gitlab-production-json
       fields_under_root: true
       encoding: utf-8
       ignore_older: 3h
    
     - type: log
       paths:
       - /var/log/gitlab/gitlab-rails/production.log
       fields:
         logzio_codec: plain
    
         # Your Logz.io account token. You can find your token at
         #  https://app.logz.io/#/dashboard/settings/manage-accounts
         token: <ACCOUNT-TOKEN>
         type: gitlab-production
       fields_under_root: true
       encoding: utf-8
       ignore_older: 3h
    
     - type: log
       paths:
       - /var/log/gitlab/gitlab-rails/api_json.log
       fields:
         logzio_codec: json
    
         # Your Logz.io account token. You can find your token at
         #  https://app.logz.io/#/dashboard/settings/manage-accounts
         token: <ACCOUNT-TOKEN>
         type: gitlab-api-json
       fields_under_root: true
       encoding: utf-8
       ignore_older: 3h
    
     - type: log
       paths:
       - /var/log/gitlab/gitlab-rails/application.log
       fields:
         logzio_codec: json
    
         # Your Logz.io account token. You can find your token at
         #  https://app.logz.io/#/dashboard/settings/manage-accounts
         token: <ACCOUNT-TOKEN>
         type: gitlab-application
       fields_under_root: true
       encoding: utf-8
       ignore_older: 3h
    
     registry_file: /var/lib/filebeat/registry
    
  3. Add Logz.io as an output

    If Logz.io is not an output, add it now.

    Replace <LISTENER-URL> with your region’s listener URL. For more information on finding your account’s region, see Account region.

     output.logstash:
       hosts: ["<LISTENER-URL>:5015"]
       ssl:
         certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
    
  4. Restart Filebeat

     sudo systemctl restart filebeat
    
  5. Check Logz.io for your logs

    Give your logs a few minutes to get from your system to ours, and then open Kibana.

    If you still don’t see your logs, see log shipping troubleshooting.

</div>

</div>