I’m currently trying to integrate a WSO2 Api Manager with the ELK stack, I followed the instructions in Apim Docs but so far I didn’t got a single log or analytics.

I’m sending all my Filebeat, Logstash, Kibana and Elasticsearch configs and the WSO2 repository/config too.

Filebeat config file:

filebeat.inputs:


- type: log

  paths:
    - /home/aluno/wso2am-4.2.0/repository/logs/apim_metrics.log
  include_lines: ['(apimMetrics):']

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1

setup.kibana:

output.logstash:
  # The Logstash hosts
  hosts: ["192.168.56.104:5044"]

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

Logstash config file:

input {
    beats {
        port => 5044
    }
}

filter {
    grok {
        match => ["message", "%{GREEDYDATA:UNWANTED} apimMetrics:%{GREEDYDATA:apimMetrics}, %{GREEDYDATA:UNWANTED} :%{GREEDYDATA:properties}"]
    }
    json {
        source => "properties"
    }
}
output {
    if [apimMetrics] == " apim:response" {
        elasticsearch {
            hosts => ["http://192.168.56.104:9200"]
            index => "apim_event_response"
            user => "elastic"
            password => "alunowso2"
        }
    } else if [apimMetrics] == " apim:faulty" {
        elasticsearch {
            hosts => ["http://192.168.56.104:9200"]
            index => "apim_event_faulty"
            user => "elastic"
            password => "alunowso2"
        }
    }
}

Kibana:

server.port: 5601

server.publicBaseUrl: "http://192.168.56.104:5601"

elasticsearch.username: "kibana_system"
elasticsearch.password: "alunowso2"
  appenders:
    file:
      type: file
      fileName: /var/log/kibana/kibana.log
      layout:
        type: json
  root:
    appenders:
      - default
      - file

Elasticsearch:

node.name: wso2-elastic
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch


xpack.security.enabled: true

xpack.security.enrollment.enabled: true

xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12
http.host: 0.0.0.0

I’ve configured the [apim.analytics] to be true and use “elk” in wso2 repository/config

I was expecting with this configuration I had acess to logs provided by WSO2 APIM but I’m getting Kibana Dashboard this screen and seems that my apim_metrics.log is empty too, what can I do?

(I’ve ommited the comments because StackOverflow was accusing spam)