Hello,
I followed this tutorial from Digial Ocean on how to install an ELK stack on a CentOS 7 machine.
It seemed pretty good, and got me as far as having an initial Elastic Search node working correctly and have kibana 4 running behind NGINX. So far so good! But in installing Logstash I ran into an issue where it doesn't seem to create any listening ports and if I check elasticsearch I see that LS hasn't created any indexes either. I'm sure it's a config issue somewhere. But where I don't know!
Here's the indexes I have in elastic search:
curl http://localhost:9200/_cat/indices
yellow open .kibana 1 1 1 0 2.4kb 2.4kb
yellow open security 5 1 0 0 575b 575b
Here we have kibana's index and what I think is a standard ES index called 'security'. But it seems that logstash is not communicating with ES!
These are the versions of ES and LS I have installed:
elasticsearch-1.5.2-1.noarch
logstash-1.5.1-1.noarch
logstash-forwarder-0.4.0-1.x86_64
And the way they have it setup in the tutorial I followed, you have 3 config files going into the logstash conf.d directory.
In /etc/logstash/conf.d/01-lumberjack-input.conf I have:
lumberjack {
port => 5000
type => "logs"
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
}
}
In /etc/logstash/conf.d/10-syslog.conf I have:
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
Trying to capture syslog data,
And in /etc/logstash/conf.d/30-lumberjack-output.conf I have ouput going to ES:
output {
elasticsearch { host => localhost }
stdout { codec => rubydebug }
}
And the system that I'm on claims that logstash is running:
systemctl status logstash
logstash.service - LSB: Starts Logstash as a daemon.
Loaded: loaded (/etc/rc.d/init.d/logstash)
Active: active (running) since Sun 2015-06-21 23:16:33 EDT; 3s ago
Process: 1033 ExecStop=/etc/rc.d/init.d/logstash stop (code=exited, status=0/SUCCESS)
Process: 1040 ExecStart=/etc/rc.d/init.d/logstash start (code=exited, status=0/SUCCESS)
CGroup: /system.slice/logstash.service
└─1044 /bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.i...
Jun 21 23:16:33 logs systemd[1]: Starting LSB: Starts Logstash as a daemon....
Jun 21 23:16:33 logs logstash[1040]: logstash started.
Jun 21 23:16:33 logs systemd[1]: Started LSB: Starts Logstash as a daemon..
But despite that I cant seem to find it running in the process list:
[root@logs:~] # ps -ef | grep logstash | grep -v grep
[root@logs:~] #
These are all the ports I have listening on the system:
netstat -tulpn | grep -i listen | grep -v tcp6
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1546/master
tcp 0 0 127.0.0.1:5601 0.0.0.0:* LISTEN 30629/node
tcp 0 0 127.0.0.1:17123 0.0.0.0:* LISTEN 30769/python
tcp 0 0 0.0.0.0:44392 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:9102 0.0.0.0:* LISTEN 7811/bacula-fd
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 2518/nginx: master
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 31527/sshd
So I was hoping to get some help as to why no ports seem to be listening for logstash and why its not creating an index in elastic search,
Any thoughts?
Thanks!
