You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/reference/auditbeat/auditbeat-installation-configuration.md
+20-22Lines changed: 20 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,16 +23,13 @@ This guide describes how to get started quickly with audit data collection. You
23
23
24
24
You need {{es}} for storing and searching your data, and {{kib}} for visualizing and managing it.
25
25
26
-
:::::::{tab-set}
27
-
:group: deployment
26
+
:::::::{applies-switch}
28
27
29
-
::::::{tab-item} {{ech}}
30
-
:sync: hosted
28
+
::::::{applies-item} ess: ga
31
29
To get started quickly, spin up an [{{ech}}](https://www.elastic.co/cloud?page=docs&placement=docs-body) deployment. {{ech}} is available on AWS, GCP, and Azure. [Try it out for free](https://cloud.elastic.co/registration?page=docs&placement=docs-body).
32
30
::::::
33
31
34
-
::::::{tab-item} Self-managed
35
-
:sync: self
32
+
::::::{applies-item} self: ga
36
33
To install and run {{es}} and {{kib}}, see [Installing the {{stack}}](docs-content://deploy-manage/deploy/self-managed/installing-elasticsearch.md).
37
34
::::::
38
35
@@ -101,7 +98,7 @@ If script execution is disabled on your system, you need to set the execution po
101
98
:::
102
99
103
100
:::{important}
104
-
{applies_to}`stack: ga 9.1.0` {applies_to}`stack: ga 9.0.6`
101
+
:applies_to: stack: ga 9.0.6+!
105
102
106
103
The base folder has changed from `C:\ProgramData\` to `C:\Program Files\`
107
104
because the latter has stricter permissions. The home path (base for
@@ -133,11 +130,9 @@ Connections to {{es}} and {{kib}} are required to set up Auditbeat.
133
130
134
131
Set the connection information in `auditbeat.yml`. To locate this configuration file, see [Directory layout](/reference/auditbeat/directory-layout.md).
135
132
136
-
:::::::{tab-set}
137
-
:group: deployment
133
+
:::::::{applies-switch}
138
134
139
-
::::::{tab-item} {{ech}}
140
-
:sync: hosted
135
+
::::::{applies-item} ess: ga
141
136
Specify the [cloud.id](/reference/auditbeat/configure-cloud-id.md) of your {{ech}} deployment, and set [cloud.auth](/reference/auditbeat/configure-cloud-id.md) to a user who is authorized to set up Auditbeat. For example:
1. This examples shows a hard-coded password, but you should store sensitive values in the [secrets keystore](/reference/auditbeat/keystore.md).
149
144
::::::
150
145
151
-
::::::{tab-item} Self-managed
152
-
:sync: self
146
+
::::::{applies-item} self: ga
153
147
1. Set the host and port where Auditbeat can find the {{es}} installation, and set the username and password of a user who is authorized to set up Auditbeat. For example:
154
148
155
149
```yaml
@@ -270,9 +264,11 @@ Auditbeat comes with predefined assets for parsing, indexing, and visualizing yo
270
264
`-e`is optional and sends output to standard error instead of the configured log output.
271
265
272
266
273
-
The default location where Windows log files are stored varies:
274
-
* {applies_to}`stack: ga 9.0.6` `C:\Program Files\Auditbeat-Data\logs`
275
-
* {applies_to}`stack: ga 9.0` `C:\ProgramData\auditbeat\logs`
267
+
By default Windows log files are stored in `C:\Program Files\Auditbeat-Data\logs`.
268
+
269
+
:::{note}
270
+
In versions before 9.0.6, the default location for Windows log files was `C:\ProgramData\auditbeat\logs`.
271
+
:::
276
272
277
273
This step loads the recommended [index template](docs-content://manage-data/data-store/templates.md) for writing to {{es}} and deploys the sample dashboards for visualizing the data in {{kib}}.
0 commit comments