# Installing Event Monitoring in Talend Runtime Container - 8.0

## Talend ESB Infrastructure Services Configuration Guide

Version
8.0
Language
English
Product
Talend Data Fabric
Talend Data Services Platform
Talend ESB
Talend MDM Platform
Talend Open Studio for ESB
Talend Real-Time Big Data Platform
Module
Talend ESB
Talend Runtime
Content
Design and Development

Event Monitoring are supported on all platforms which are supported for the related release of Talend Runtime.

The Event Monitoring feature is not activated by default but preinstalled in the Talend Runtime Container. It can be activated with the tesb:start-em-XXX commands. For more information, see Event Monitoring Appenders.

The primary use case is to use Event Monitoring together with Talend LogServer which brings the capabilities of Filebeat, Logstash, ElasticSearch and Kibana. However, for the pure local use case the Talend LogServer is not needed and by this optional for the use of Event Monitoring.

For the standard use case to send Event to the Talend LogServer, the following setup steps need to be done before to get Events transferred to the Talend LogServer and accessible via the Talend Administration Center Logging UI:
1. Copy the Filebeat that is provided as a subfolder of the Talend LogServer distribution package to the machine where the Talend Runtime is installed.
2. A default filebeat configuration file is provided with Talend Runtime, which needs to be adapted to the environment by updating the LOG_PATH in {KARAF_HOME}/etc/filebeat_em.yml to point to {KARAF_DATA}/eventmonitoring/em*.log.*

Below is an example of the filebeat_em.yml where the paths and hosts entry must be adapted to the environment. It is essential to change the localhost and port to the remote Talend LogServer host and port (Logstash Endpoint).

#======= Filebeat prospectors =======

filebeat.prospectors:

- type: log
enabled: true
paths:
- ${LOG_PATH:D:\talend\ESB\runtime\container\data\eventmonitoring\em*.log*} fields: app_id:${APP_NAME:ESB}
fields_under_root: true
json.keys_under_root: true
json.message_key: log

logging.metrics.enabled: false
#------- Logstash output -------
output.logstash:
# The Logstash hosts
hosts: ["${LOGSTASH_HOSTS:localhost}:${LOGSTASH_PORT:5044}"]

To start filebeat, use the following command, in which {KARAF_HOME} needs to be replaced by the absolute path to the root Talend Runtime folder in your installation.

filebeat -e -c {KARAF_HOME}/etc/filebeat_em.yml