Skip to content

Changes

Page history
Update configuring elk stack authored by K1558's avatar K1558
Show whitespace changes
Inline Side-by-side
configuring-elk-stack.md
View page @ c2cd9172
...@@ -120,4 +120,16 @@ You only need to change the server.host:"your-elk-server" and add the URL of ela ...@@ -120,4 +120,16 @@ You only need to change the server.host:"your-elk-server" and add the URL of ela
Systemctl restart kibana Systemctl restart kibana
systemctl enable kibana systemctl enable kibana
``` ```
Now you can access kibana in your browser's localhost. To get the logs you have to configure the Index Pattern. If the connection is set up correctly it should suggest the filebeat*- automatically. Just add it the default index pattern. Now you can access Kibana in your browser's localhost. To get the logs you have to configure the Index Pattern. If the connection is set up correctly it should suggest the Filebeat*- automatically. Just add it the default index pattern.
\ No newline at end of file
![image](/uploads/01894c0d350e45c983272a03878ef2f3/image.png)
It is supposed to look something like this when you have logs coming from Filebeat to your Kibana.
### Troubleshooting
If you don't see any logs coming for your Kibana or it doesn't recognize index pattern you should check that the Filebeat is sending logs correctly to Logstash. The Filebeat log file is at /var/log/filebeat and it should look something like this when the logs are sent to the Logstash:
![image](/uploads/63bec32f376c5893b004e6b3fbddcd7f/image.png)
The Logstash log is located in /var/log/logstash and it should look something like this:
![image](/uploads/0e49809e5aaeadd7218bf3622d23b42f/image.png)
If you get a ERR Connecting error publishing events (retrying): dial tcp {remote.logstash.host.ip}:5044 in your Filebeat log it means that there is something wrong in the connection. You should check both Filebeat and Logstash config files from typos and check that the port 5044 is available in the firewall.
\ No newline at end of file