NOTE
To run properly
Linux
sysctl -w vm.max_map_count=262144
Windows
wsl -d docker-desktop
sysctl -w vm.max_map_count=262144
sudo docker run -p 5601:5601 -p 9200:9200 -p 5044:5044 -it --net elk -d --memory=4096m -v /home/chris/Downloads/Downloads/ELK_example/logs:/mnt/logs --name elk sebp/elk
- Open a shell prompt in the container
sudo docker exec -it elk /bin/bash
- Create a
logstash.conf
file
vim /etc/logstash/conf.d/logstash.conf
# logstash.conf
input {
file {
type => "log"
path => "/mnt/logs/application.log" # Make sure you provide the absolute path of the file here
}
}
filter {
if [message] =~ "\tat" {
grok {
match => ["message", "^(\tat)"]
add_tag => ["stacktrace"]
}
}
}
output {
stdout {
codec => rubydebug
}
elasticsearch {
hosts => ["localhost"]
}
}
- restart your elk container
sudo docker restart elk
- Check what indexes you have
http://localhost:9200/_cat/indices
- Next, go to
http://localhost:5601/app/management/kibana/indexPatterns
-
Enter a name and type your index name as
NAME*
-
Optionally, in the next step, you can pick a field for filtering the data. You can choose
@timestamp
and then click on Create index pattern. -
View your logs
http://localhost:5601/app/discover