Vagrant ELK (Elasticsearch, Logstash, Kibana) box
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
elk-master
.gitignore
LICENSE
README.md

README.md

elk

A vagrant based ELK stack (Elasticsearch, Logstash, Kibana).

Installation

git clone https://github.com/apolloclark/elk
cd ./elk/elk-master/elastic5x/ubuntu16/
vagrant box update
vagrant up

# open a browser
# http://127.0.0.1:5601
# username = elastic
# password = changeme
# under "Index name or pattern", type "filebeat-*"
# under "Time-field name", select "@timestamp"
# click "Create"
# on the next page, click the (green/blue) star, setting the default index

# click "Discover", in the top menu
# click drop-down in left-side menu, select "filebeat-*"
# you may have to wait a few minutes for the results to flow in

Guides

I've written a guide to Elasticsearch commands here:

https://gist.github.com/apolloclark/c9eb0c1a01798ac2e48492ceeb367a4f

Versions

The following ELK components are installed:

elastic2x

  • Elasticsearch 2.4.3 (December 13, 2016)
  • Logstash 2.4.1 (November 9, 2016)
  • Kibana 4.6.3 (November 15, 2016)
  • Filebeat 1.3.1 (September 15, 2016)

elastic5x

  • Elasticsearch 5.6.8 (Feb 20, 2018)
  • Logstash 5.6.8 (Feb 20, 2018)
  • Kibana 5.6.8 (Feb 20, 2018)
  • Filebeat 5.6.8 (Feb 20, 2018)
  • Packetbeat 5.6.8 (Feb 20, 2018)
  • Metricbeat 5.6.8 (Feb 20, 2018)
  • Heartbeat 5.6.8 (Feb 20, 2018)

Release Notes

Elastic

Elasticsearch

Logstash

Kibana

Beats

X-Pack

Log files

# filebeat
/var/log/filebeat/filebeat.log

# packetbeat
/var/log/packetbeat/packetbeat.log

# metricbeat
/var/log/metricbeat/metricbeat.log

# heartbeat
/var/log/heartbeat/heartbeat.log

# logstash
/var/log/logstash/logstash-plain.log
/var/log/logstash/logstash.stdout
/var/log/logstash/logstash.log

# elasticsearch
/var/log/elasticsearch/elasticsearch.log
/var/log/elasticsearch/elasticsearch.log.*
/var/log/elasticsearch/elasticsearch_deprecation.log
/var/log/elasticsearch/elasticsearch_index_search_slowlog.log
/var/log/elasticsearch/elasticsearch_index_indexing_slowlog.log.log

# kibana
/var/log/kibana.log
/var/log/kibana/kibana.stderr
/var/log/kibana/kibana.stdout

Application folders

# filebeat
/etc/filebeat
/usr/share/filebeat

# metricbeat
/etc/metricbeat
/usr/share/metricbeat

# heartbeat
/etc/heartbeat
/usr/share/heartbeat

# logstash
/etc/logstash
/usr/share/logstash

# elasticsearch
/etc/elasticsearch/
/usr/share/elasticsearch/

# kibana
/etc/kibana
/usr/share/kibana
/opt/kibana