Installing and configuring MI Log File Collector (Filebeat)

Filebeat for Granta MI log aggregation is delivered in the MI Log File Collector, an installation and configuration 'wrapper' that ensures Filebeat is installed on a Granta MI application server with the correct configuration settings for MI log aggregation.

Prerequisites:

Ensure that Elasticsearch and Kibana are already configured and running on your log aggregation Elasticsearch instance, as described in the previous topics.
Ensure you have the Elasticsearch API key copied from Kibana on your log aggregation Elasticsearch server.
Copy the ca.P12 certificate file from the config\certs folder on your log aggregation Elasticsearch instance to your Granta MI application server. This file holds the Elasticsearch CA and the private key for the CA.

On each node in the cluster:

Log in using an account with Administrator privileges.
Double-click the ca.P12 file you copied from your log aggregation Elasticsearch server and import the CA to the Local Machine Trusted Root Certification Authorities certificate store.
Install MI Log File Collector:
1. Locate the installer MSI for MI Log File Collector, inside the main Granta MI installer package. For example:
  InstallationManager\MILogFileCollector\
2. Double-click the MSI file to run the installer in your preferred language, and follow the on-screen instructions in the wizard.
Create a Filebeat keystore and add the Log Collector Elasticsearch API key to it. This will ensure that communications between Filebeat and Elasticsearch are secure.
1. Open an Administrator command-line shell (Command shell or PowerShell), and navigate to the Filebeat folder in the Granta MI %PROGAMFILES% folder. For example (you may have a different version number):
```
cd "C:\Program Files\Granta\Granta MI\Filebeat\8.17.4"
```
2. Run the following command to create the Filebeat secrets keystore:
```
.\filebeat keystore create --path.data "C:\ProgramData\Granta\Granta MI\Filebeat"
```
3. Now add the Elasticsearch API key information to the Filebeat keystore, using a command with this format, replacing the beats_api_key placeholder text shown here with the Beats format key you copied from Kibana:
  Required format:
```
echo <beats_api_key> | .\filebeat keystore add ES_API_KEY --path.data "C:\ProgramData\Granta\Granta MI\Filebeat" --stdin --force
```
  Example:
```
echo enspP4wBLp_-7U8ePcIN:idzoz0lZSmu7t-jc5yNqiQ | .\filebeat keystore add ES_API_KEY --path.data "C:\ProgramData\Granta\Granta MI\Filebeat" --stdin --force
```
Navigate to the C:\ProgramData\Granta\Granta MI\Filebeat\config folder, open MILogFileCollector.yml, and make the following changes under output.elasticsearch:
1. Set hosts: to the URL and port of your Elasticsearch instance:
```
hosts: ["https://your.es-server.name:9200"]
```
2. Set api_key as follows:
```
api_key: "${ES_API_KEY}"
```
Save the changes to MILogFileCollector.yml.
Start the MI Log File Collector Windows service.
1. From the Windows Start menu, click Run, type services.msc, and click OK.
2. In the Services window, select the 'Granta MI Log File Collector Service' and click Start.