ELK: Difference between revisions
From artserver wiki
No edit summary |
|||
| Line 17: | Line 17: | ||
=Project: analysing Apache server logs from another server= | =Project: analysing Apache server logs from another server= | ||
On remote: | Use a VPN connection. | ||
'''On remote:''' (IP x.x.x.2) | |||
* FileBeat: Beats are lightweight agents that are installed on client hosts to collect different types of data for forwarding into the stack. | * FileBeat: Beats are lightweight agents that are installed on client hosts to collect different types of data for forwarding into the stack. | ||
** | |||
* test elasticsearch access, from remote: <code>curl http://10.0.20.2:9200</code> | |||
''' | |||
On ELK stack machine: | On ELK stack machine:''' (IP x.x.x.1) | ||
* have elasticsearch and kibana running | |||
* test elasticsearch: </code>curl http://localhost:9200</code> | |||
Revision as of 12:44, 26 September 2022
Installing ELK stack
Followed https://techviewleo.com/install-elastic-stack-elk-on-debian/ ports:
- elasticsearch: 9200
- logstash: 5044
- kibana: 5601
- filebeat
change elasticsearch JVM heap size to use only 1G in /etc/elasticsearch/jvm.options
-Xms1g -Xmx1g
Test ElsticSearch
curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic http://localhost:9200
Project: analysing Apache server logs from another server
Use a VPN connection.
On remote: (IP x.x.x.2)
- FileBeat: Beats are lightweight agents that are installed on client hosts to collect different types of data for forwarding into the stack.
- test elasticsearch access, from remote:
curl http://10.0.20.2:9200
On ELK stack machine: (IP x.x.x.1)
- have elasticsearch and kibana running
- test elasticsearch: curl http://localhost:9200
