Skip to content

Report

Read events from a Filebeat forwarder to transform into typed TenXObjects to aggregate and report on. This module is a component of the Edge Reporter app.

Architecture

graph LR
    A["<div style='font-size: 14px;'>📂 Filebeat</div><div style='font-size: 10px;'>inputs</div>"] --> B["<div style='font-size: 14px;'>🔧 Script</div><div style='font-size: 10px;'>processor</div>"]
    B --> C["<div style='font-size: 14px;'>⚡ 10x Reporter</div><div style='font-size: 10px;'>sidecar</div>"]
    C --> D["<div style='font-size: 14px;'>📊 Metrics</div><div style='font-size: 10px;'>Prometheus</div>"]
    B --> E["<div style='font-size: 14px;'>📤 Filebeat</div><div style='font-size: 10px;'>outputs</div>"]

    classDef input fill:#2563eb,stroke:#1d4ed8,color:#ffffff,stroke-width:2px,rx:8,ry:8
    classDef filter fill:#ea580c,stroke:#c2410c,color:#ffffff,stroke-width:2px,rx:8,ry:8
    classDef engine fill:#7c3aed,stroke:#6d28d9,color:#ffffff,stroke-width:2px,rx:8,ry:8
    classDef metrics fill:#16a34a,stroke:#15803d,color:#ffffff,stroke-width:2px,rx:8,ry:8
    classDef output fill:#0891b2,stroke:#0e7490,color:#ffffff,stroke-width:2px,rx:8,ry:8

    class A input
    class B filter
    class C engine
    class D metrics
    class E output

Data Flow

  • 📂 Filebeat Inputs - Collect logs from files, containers, or other sources
  • 🔧 Script Processor - JavaScript processor launches 10x sidecar and pipes events
  • ⚡ 10x Reporter - Transforms events into TenXObjects, aggregates metrics
  • 📊 Metrics Output - Publishes time-series data to Prometheus/metrics backends
  • 📤 Filebeat Outputs - Original events continue unchanged to final destinations

Key Characteristics

Feature Description
📊 Read-Only Reporter observes events without modifying the pipeline
🔗 Parallel Flow Events flow to both 10x Reporter AND original outputs
📈 Metrics Publishing Aggregates and publishes to time-series backends
🔧 Script Processor Uses Filebeat's native JavaScript processor for sidecar launch

Sidecar Relay

This module configures a Filebeat script processor. The script processor launches a 10x sidecar process and pipes collected events to aggregate and publish to time-series outputs.

Install

See the Log10x Edge Reporter Filebeat run instructions

Deploy to k8s via Helm

See the Log10x Edge Reporter Filebeat deployment instructions

Configuration

To configure the Filebeat reporter module, Edit these settings.

Below is the default configuration from: report/config.yaml.

Edit Online

Edit config.yaml Locally 

# 🔟❎ 'run' Filebeat reporter configuration

# Configure an input that reads events from a Filebeat forwarder.
# To learn more see https://doc.log10x.com/run/input/forwarder/filebeat/report/

# Set the 10x pipeline to 'run' 
tenx: run

# =============================== Dependencies ================================

include:

  # Input module to read events from Filebeat into 10x pipeline
  - run/modules/input/forwarder/filebeat/input


This module is defined in report/module.yaml.