ELK docker

http://elk-docker.readthedocs.io/

you have to adjust permanently the max_map_count parameter:

sysctl -w vm.max_map_count=262144

(sysctl - configure kernel parameters at runtime)

ls /proc/sys/vm to get list of available parameters

sudo vi /etc/sysctl.conf
vm.max_map_count=262144

try starting the container like this:

sudo docker run -p 5601:5601 -p 9200:9200 -p 5044:5044 -it --name elk sebp/elk

if it fails with this error:

waiting for Elasticsearch to be up (30/30)
Couln't start Elasticsearch. Exiting.

try allowing more time:

sudo docker run -e ES_CONNECT_RETRY=300 -p 5601:5601 -p 9200:9200 -p 5044:5044 -it --name elk sebp/elk

(see https://docs.docker.com/engine/reference/commandline/run/#set-environment-variables--e---env---env-file )

then

http://127.0.0.1:5601/app/kibana KIBANA (you have to wait 1 minute for Kibana to come up)

http://127.0.0.1:9200/ Elasticsearch JSON

to create dummy entry:

docker exec -it elk /bin/bash
/opt/logstash/bin/logstash --path.data /tmp/logstash/data -e 'input { stdin { } } output { elasticsearch { hosts => ["localhost"] } }'
this is a dummy entry
this is a dummy entry2
CTRL-C


Kibana logs : less /var/log/kibana/kibana5.log
Elasticsearch logs : less /var/log/elasticsearch/elasticsearch.log
Logstash logs: less /var/log/logstash/logstash-plain.log

tail -f /var/log/elasticsearch/elasticsearch.log /var/log/logstash/logstash-plain.log /var/log/kibana/kibana5.log



docker network create -d bridge elknet


good practical presentation of ELK:

Logstash, getting my feet wet

Some instructions on how to get started: http://logstash.net/docs/1.3.2/tutorials/getting-started-simple

Also this video tutorial is a lifesaver.

mkdir /opt/logstash/
cd /opt/logstash/
wget https://download.elasticsearch.org/logstash/logstash/logstash-1.3.2-flatjar.jar -O logstash.jar

Exercise one: simple input, simple output:
vi sample.conf

input {
  stdin { }
}
output {
  stdout {
    debug => true
  }
}

run it:
java -jar logstash.jar agent -v -f sample.conf

Pipeline started {:level=>:info}
pippo
output received {:event=>#"pippo", "@version"=>"1", 
"@timestamp"=>"2014-01-04T11:11:42.559Z", 
"host"=>"osb-vagrant.acme.com"}, @cancelled=false>, :level=>:info}
{
       "message" => "pippo",
      "@version" => "1",
    "@timestamp" => "2014-01-04T11:11:42.559Z",
          "host" => "osb-vagrant.acme.com"
}

Running "java -jar logstash.jar agent -vv -f sample.conf" can be quite educational.

Removing the "debug => true" from the sample.conf:

java -jar logstash.jar agent -f sample.conf

pippo
2014-01-04T11:34:40.255+0000 osb-vagrant.acme.com pippo

To activate the embedded elasticsearch:
vi es.conf

input {
  file {
    path => "/opt/logstash/myfile.log"
  }
}

output {
  elasticsearch {
    embedded => true
  }
}

at this point, whatever you add in myfile.log will automatically appear in elasticsearch.
If you run logstash with the "web" option:
java -jar logstash.jar agent -f es.conf -- web
then access kibana: http://yourhost:9292
Here http://logstash.net/docs/1.3.2/ you find detailed documentation of each input, codec, output, filter stanzas.

Analyzing logs with logstash

http://logstash.net/


I feel that if you find yourself running shell scripts in crontab to search for events in logs, then you might take a look at some better engineered alternatives.(skip the first 5 minutes of the video)