DevToolsELK

ELK Installation Guide v2

E(B)LK Installation Guide

fig

  • Log Collection : [log file] -> [file beat] —–> [logstash] -> [elasticseach]
  • Visualization : [Kibana] -> [elasticseach]

�����غ�

1
2
# JDK & JAVA_HOME
$ sudo apt-get install openjdk-7-jre

Elasticsearch ��ġ

  1. Download and unzip the latest Elasticsearch distribution : Elasticsearch 2.0.0

    1
    2
    $ curl -L -O  https://download.elasticsearch.org/elasticsearch/release/org/elasticsearch/distribution/tar/elasticsearch/2.0.0/elasticsearch-2.0.0.tar.gz
    $ tar xzvf elasticsearch-2.0.0.tar.gz

  2. Run 

    1
    $ bin/elasticsearch

  3. Test 

    1
    http://localhost:9200?pretty=true

Kibana Installation

  1. Download and unzip Kibana 4.X : Kibana 4.2.1

    1
    2
    3
    $ curl -L -O https://download.elastic.co/kibana/kibana/kibana-4.2.1-linux-x64.tar.gz
    $ tar xzvf kibana-4.2.1-linux-x64.tar.gz
    $ cd kibana-4.2.1-linux-x64/

  2. edit config/kibana.yml 

    1
    2
    (default)
    # elasticsearch.url: "http://localhost:9200"

  3. Run 

    1
    ./bin/kibana

  4. Test 

    1
    http://localhost:5601

Logstash(Log Aggregation) ��ġ

  1. Download and unzip the latest Logstash release : Logstash 2.0.0

    1
    2
    $ curl -L -O https://download.elastic.co/logstash/logstash/logstash-2.0.0.tar.gz
    $ tar xzvf logstash-2.0.0.tar.gz

  2. create a config file 

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    # config/logstash.conf
    input {
      beats {
        port => 5044
      }
    }
    output {
      elasticsearch {
        hosts => "localhost:9200"
        sniffing => true
        manage_template => false
        index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
        document_type => "%{[@metadata][type]}"
      }
    }

  3. plugin updates 

    1
    2
    3
    4
    $ ./plugin update logstash-input-beats
    or
    $ ./plugin uninstall logstash-input-beats
    $ ./plugin install logstash-input-beats

  4. Run 

    1
    $ ./logstash agent -f ../config/logstash.conf

Filebeat(Log forwarder) ��ġ

  1. Download and install or unzip Filebeat : Filebeat 1.0.0

    1
    2
    $ curl -L -O https://download.elastic.co/beats/filebeat/filebeat-1.0.0-rc2-x86_64.tar.gz
    $ sudo tar xzvf filebeat-1.0.0-rc2-x86_64.tar.gz

  2. Edit the filebeat.yml 

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    #filebeat.yml
    ...
      prospectors:
        ...
          paths:
            - /tmp/*.log
        ...
      output:
        #elasticsearch:
          #hosts: ["localhost:9200"]
        ...
        logstash:
          hosts: ["localhost:5044"]

  3. dynamic template ���� : filebeat.template.json 

    1
    $ curl -XPUT 'http://localhost:9200/_template/filebeat?pretty' -d@filebeat.template.json

  4. Run

    1
    $ sudo ./filebeat -e -c filebeat.yml

  5. Test

    1
    $ echo {"hello":"world"} > /tmp/mylog.log
Share