Hello/Bonjour
I have installed ELK.
Note : All lines of differents config files not mentionned after are commented (#xyabc)
Elasticsearch conf in "/etc/elasticsearch/elasticsearch.yml" is :
node.name: elastic1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 10.162.188.102
http.port: 9200
Kibana conf in "/etc/kibana/kibana.yml" is :
server.port: 5601
server.host: "10.162.188.102"
server.name: "kibana"
elasticsearch.url: "http://10.162.188.102:9200"
Logstash conf in "/etc/logstash/logstash.yml" is :
node.name: logstash
path.data: /var/lib/logstash
path.config: /etc/logstash/conf.d
config.test_and_exit: true
path.logs: /var/log/logstash
What do you think about that ?
So now, I take an example of config file to monitoring system information of local server where stack is installed. I created file in "/etc/logstash/conf.d/logstash-syslog.conf" :
input {
file {
path => [ "/var/log/*.log", "/var/log/messages", "/var/log/syslog" ]
type => "syslog"
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
output {
elasticsearch {
type => "stdin-type"
host => "10.162.188.102"
port => "9300"
node_name => "elastic1" }
stdout { codec => rubydebug }
}
To perform my file, i go in "/usr/share/logstash/bin" and execute this command :
./logstash -f logstash-syslog.conf (in first i stoped logstash service).
It return this message :
**WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties.
Using default config which logs to console
14:00:36.538 [LogStash::Runner] INFO logstash.agent - No config files found in path {:path=>"/usr/share/logstash/bin/logstash-syslog.conf"}
14:00:36.546 [LogStash::Runner] ERROR logstash.agent - failed to fetch pipeline configuration {:message=>"No config files found: logstash-syslog.conf. Can you make sure this path is a logstash config file?"}**
