Better Stack Elasticsearch logging

Start logging in 2 minutes

What you would like to collect from your Elasticsearch?

Collect both logs and metrics from your Elasticsearch
Collect only logs from your Elasticsearch

Collect logs & metrics

Collect logs and metrics from your Elasticsearch using Vector and elasticsearch exporter .

1. Set up Elasticsearch exporter

Install and start latest elasticsearch exporter:

Install and start elasticsearch exporter

Copied!

curl -sSL https://logs.betterstack.com/install/elasticsearch_exporter | sudo -E bash

2. Run exporter

Start the Elasticsearch exporter:

Linux macOS

Copied!

systemctl start elasticsearch_exporter

launchctl start com.prometheus.elasticsearch_exporter

3. Set up Vector

Select your platform:

Ubuntu • Debian

Install and configure Vector on Ubuntu or Debian:

Set up Vector

Copied!

curl -sSL https://logs.betterstack.com/setup-vector/elasticsearch_with_metrics/$SOURCE_TOKEN \
  -o /tmp/setup-vector.sh && \
  bash /tmp/setup-vector.sh

Curious about what the script does?

Installs Vector using official package.
Configures Vector for your Better Stack source.
Enables and restarts Vector.

The script will ask for confirmation before making any changes.

Install

Install Vector on Windows using official installer:

Install Vector

Copied!

powershell Invoke-WebRequest https://packages.timber.io/vector/latest/vector-x64.msi -OutFile vector-latest-x64.msi
msiexec /i vector-latest-x64.msi

Setup

Run in Powershell as administrator to download Vector config:

Download Vector config using Powershell

Copied!

$config_yaml_path = "C:\Program Files\Vector\config\vector.yaml"
$backup_path = "C:\Program Files\Vector\config\vector-backup.yaml"
Move-Item -Path "$config_yaml_path" -Destination "$backup_path"
Invoke-RestMethod -Uri https://logs.betterstack.com/vector-yaml/elasticsearch_with_metrics/$SOURCE_TOKEN |
  Add-Content $config_yaml_path

Run Vector

Run Vector with new configuration:

Start Vector

Copied!

& "C:\Program Files\Vector\bin\vector" --config "C:\Program Files\Vector\config\vector.yaml"

Install

Install Vector using official installer:

Install Vector

Copied!

curl --proto '=https' --tlsv1.2 -sSf https://sh.vector.dev | sh -s -- -y

Create a Vector service :

Create a Vector service

Copied!

mkdir -p /etc/vector
mkdir -p /var/lib/vector/
cat <<-'SERVICE' >> /etc/systemd/system/vector.service
[Unit]
Description=Vector
Documentation=https://vector.dev
After=network-online.target
Requires=network-online.target

[Service]
User=vector
Group=vector
ExecStart=/root/.vector/bin/vector
ExecReload=/bin/kill -HUP $MAINPID
Restart=no
AmbientCapabilities=CAP_NET_BIND_SERVICE
EnvironmentFile=-/etc/default/vector

[Install]
WantedBy=multi-user.target
SERVICE

Setup

Download Vector configuration for your source:

Download Vector config

Copied!

CONFIG_YAML_PATH="/etc/vector/vector.yaml"
BACKUP_SUFFIX=".bak-$(date +%Y%m%d%H%M%S)"
mv "${CONFIG_YAML_PATH}" "${CONFIG_YAML_PATH}${BACKUP_SUFFIX}"
mv "${CONFIG_YAML_PATH%.yaml}.toml" "${CONFIG_YAML_PATH%.yaml}.toml${BACKUP_SUFFIX}"
curl -o "$CONFIG_YAML_PATH" \
  https://logs.betterstack.com/vector-yaml/elasticsearch_with_metrics/$SOURCE_TOKEN

Restart Vector

Restart Vector to reload the configuration:

Restart Vector

Copied!

systemctl restart vector

You should see your logs in Better Stack → Live tail .

Collect only logs

Collect logs from your Elasticsearch using Vector.

Select your platform:

Ubuntu • Debian

Install and configure Vector on Ubuntu or Debian:

Set up Vector

Copied!

curl -sSL https://logs.betterstack.com/setup-vector/elasticsearch/$SOURCE_TOKEN \
  -o /tmp/setup-vector.sh && \
  bash /tmp/setup-vector.sh

Curious about what the script does?

Installs Vector using official package.
Configures Vector for your Better Stack source.
Enables and restarts Vector.

The script will ask for confirmation before making any changes.

Install

Install Vector on Windows using official installer:

Install Vector

Copied!

powershell Invoke-WebRequest https://packages.timber.io/vector/latest/vector-x64.msi -OutFile vector-latest-x64.msi
msiexec /i vector-latest-x64.msi

Setup

Run in Powershell as administrator to download Vector config:

Download Vector config using Powershell

Copied!

$config_yaml_path = "C:\Program Files\Vector\config\vector.yaml"
$backup_path = "C:\Program Files\Vector\config\vector-backup.yaml"
Move-Item -Path "$config_yaml_path" -Destination "$backup_path"
Invoke-RestMethod -Uri https://logs.betterstack.com/vector-yaml/elasticsearch/$SOURCE_TOKEN |
  Add-Content $config_yaml_path

Run Vector

Run Vector with new configuration:

Start Vector

Copied!

& "C:\Program Files\Vector\bin\vector" --config "C:\Program Files\Vector\config\vector.yaml"

Install

Install Vector using official installer:

Install Vector

Copied!

curl --proto '=https' --tlsv1.2 -sSf https://sh.vector.dev | sh -s -- -y

Create a Vector service :

Create a Vector service

Copied!

mkdir -p /etc/vector
mkdir -p /var/lib/vector/
cat <<-'SERVICE' >> /etc/systemd/system/vector.service
[Unit]
Description=Vector
Documentation=https://vector.dev
After=network-online.target
Requires=network-online.target

[Service]
User=vector
Group=vector
ExecStart=/root/.vector/bin/vector
ExecReload=/bin/kill -HUP $MAINPID
Restart=no
AmbientCapabilities=CAP_NET_BIND_SERVICE
EnvironmentFile=-/etc/default/vector

[Install]
WantedBy=multi-user.target
SERVICE

Setup

Download Vector configuration for your source:

Download Vector config

Copied!

CONFIG_YAML_PATH="/etc/vector/vector.yaml"
BACKUP_SUFFIX=".bak-$(date +%Y%m%d%H%M%S)"
mv "${CONFIG_YAML_PATH}" "${CONFIG_YAML_PATH}${BACKUP_SUFFIX}"
mv "${CONFIG_YAML_PATH%.yaml}.toml" "${CONFIG_YAML_PATH%.yaml}.toml${BACKUP_SUFFIX}"
curl -o "$CONFIG_YAML_PATH" \
  https://logs.betterstack.com/vector-yaml/elasticsearch/$SOURCE_TOKEN

Restart Vector

Restart Vector to reload the configuration:

Restart Vector

Copied!

systemctl restart vector

You should see your logs in Better Stack → Live tail .

Need help?

Please let us know at hello@betterstack.com.
We're happy to help! 🙏

Better Stack RabbitMQ logging

Better Stack Docker logging

Explore documentation

Better Stack Elasticsearch logging

Start logging in 2 minutes

Collect logs & metrics

1. Set up Elasticsearch exporter

2. Run exporter

3. Set up Vector

Install

Setup

Run Vector

Install

Setup

Restart Vector

Collect only logs

Install

Setup

Run Vector

Install

Setup

Restart Vector

Need help?

On this page