| ... | @@ -69,16 +69,16 @@ Now we have a logstash-forwarder.crt and key. |
... | @@ -69,16 +69,16 @@ Now we have a logstash-forwarder.crt and key. |
|
|
##### Configuring Logstash
|
|
##### Configuring Logstash
|
|
|
|
|
|
|
|
The configuration is made in /etc/logstash/conf.d/logstash.conf
|
|
The configuration is made in /etc/logstash/conf.d/logstash.conf
|
|
|
|
|
```
|
|
|
` input {
|
|
input {
|
|
|
beats {
|
|
beats {
|
|
|
port => 5044
|
|
port => 5044
|
|
|
ssl => true
|
|
ssl => true
|
|
|
ssl_certificate => "/etc/ssl/logstash-forwarder.crt"
|
|
ssl_certificate => "/etc/ssl/logstash-forwarder.crt"
|
|
|
ssl_key => "/etc/ssl/logstash-forwarder.key"
|
|
ssl_key => "/etc/ssl/logstash-forwarder.key"
|
|
|
}
|
|
}
|
|
|
} `
|
|
}
|
|
|
` filter {
|
|
filter {
|
|
|
grok {
|
|
grok {
|
|
|
match => { "message" => "%{MONTH} %{MONTHDAY}, %{YEAR} %{HOUR}:%{MINUTE}: %{WORD:status} %{WORD:category}: %{GREEDYDATA:key_values}" }
|
|
match => { "message" => "%{MONTH} %{MONTHDAY}, %{YEAR} %{HOUR}:%{MINUTE}: %{WORD:status} %{WORD:category}: %{GREEDYDATA:key_values}" }
|
|
|
}
|
|
}
|
| ... | @@ -93,13 +93,14 @@ The configuration is made in /etc/logstash/conf.d/logstash.conf |
... | @@ -93,13 +93,14 @@ The configuration is made in /etc/logstash/conf.d/logstash.conf |
|
|
json {
|
|
json {
|
|
|
source => "message"
|
|
source => "message"
|
|
|
}
|
|
}
|
|
|
} `
|
|
}
|
|
|
` output {
|
|
output {
|
|
|
elasticsearch {
|
|
elasticsearch {
|
|
|
hosts => ["localhost:9200"]
|
|
hosts => ["localhost:9200"]
|
|
|
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
|
|
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
|
|
|
}
|
|
}
|
|
|
} `
|
|
}
|
|
|
|
```
|
|
|
I have commented out the host part because it was unneccessary.
|
|
I have commented out the host part because it was unneccessary.
|
|
|
|
|
|
|
|
#### Installing Filebeat
|
|
#### Installing Filebeat
|
| ... | @@ -119,7 +120,6 @@ scp -pr <user-name-of-elk-server>@<elk-server_ip>:/etc/ssl/logstash-forwarder.cr |
... | @@ -119,7 +120,6 @@ scp -pr <user-name-of-elk-server>@<elk-server_ip>:/etc/ssl/logstash-forwarder.cr |
|
|
```
|
|
```
|
|
|
##### Configuring Filebeat
|
|
##### Configuring Filebeat
|
|
|
The filebeat configuration file is in /etc/filebeat/filebeat.yml.
|
|
The filebeat configuration file is in /etc/filebeat/filebeat.yml.
|
|
|

|
|
|
|
|
```
|
|
```
|
|
|
- input_type: log
|
|
- input_type: log
|
|
|
|
|
|
| ... | |
... | |
| ... | | ... | |