We are trying to develop a PoC for Elastic on Azure Cloud
We installed the Elastic template from Azure Marketplace, selected 3 nodes and now we have following configuration:
1 Kibana VM
3 Data VM
3 Master VM
What we can do so far:
Connect and log in to Kibana (create simple index pattern from console)
Connect to VMs via bash ssh
What is still open and we desperately look for clear documentation:
On which VM runs logstash?
How to start logstash?
Where to store the config files (for logstash but also if using jdbc plugin)?
Installation of Kibana plugins: when trying to install for example https://github.com/Nico-DF/kibana-plugin-traffic-sg I always get 'operation not permitted' even if I am logged in as the owner of the directory
Is it impossible to install extra plugins on VMs?
I work on the Elastic Azure ARM Marketplace template so let me see if I can answer your questions:
The template currently deploys only Elasticsearch and Kibana, so if you would like to also use Logstash and Beats, you will need to install those separately. We have discussed including Logstash in the template in future and I have opened an issue on github to track this.
After some more research and attempts I did managed yesterday to install Logstash and many plugins for both Kibana and Logstash
I'm still stuck with the jdbc plugin but I'll investigate this still a bit more
Now there is still something I still do not understand 100%
What is the best approach for Logstash?
Currently I only installed Logstash on my Kibana VM (I actually installed everything on Kibana VM only so far). Was this a mistake or correct move?
Would it be better to have Logstash installed on all my 3 Data VMs or on all my 3 Master VMs instead?