Install elk on debian 9

2017-08-31

Package installation

  1. Install java jre 8 : sudo apt-get install openjdk-8-jre
  2. Add elastic key : wget -qO - https://packages.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
  3. Install apt-transport-https : sudo apt-get install apt-transport-https
  4. Add elastic apt source : echo "deb https://artifacts.elastic.co/packages/5.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-5.x.lis
  5. Install ELK packages : sudo apt-get update && sudo apt-get install elasticsearch kibana logstash

Configuration files

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
input {
  file {
    path => "/path/to/access.log"
    start_position => "beginning"
  }
}
filter {
  if [path] =~ "access" {
    mutate { replace => { "type" => "apache_access" } }
    grok {
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
  }
  date {
    match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
  }
}
output {
  elasticsearch {
    hosts => ["localhost:9200"]
  }
  stdout { codec => rubydebug }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
input {
  file {
    path => "/path/to/access.log"
    start_position => "beginning"
  }
}
filter {
    grok {
    match => [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
    overwrite => [ "message" ]
  }
  mutate {
    convert => ["response", "integer"]
    convert => ["bytes", "integer"]
    convert => ["responsetime", "float"]
  }
  geoip {
    source => "clientip"
    target => "geoip"
    add_tag => [ "nginx-geoip" ]
  }
  date {
    convert => ["bytes", "integer"]
    convert => ["responsetime", "float"]
  }
  geoip {
    source => "clientip"
    target => "geoip"
    add_tag => [ "nginx-geoip" ]
  }
  date {
    match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
    remove_field => [ "timestamp" ]
  }
  useragent {
    source => "agent"
  }
}
output {
  elasticsearch {
    hosts => ["localhost:9200"]
  }
  stdout { codec => rubydebug }
}

Start service

1
2
sudo service elasticsearch start
sudo service kibana start

Test

To test lesticsearch installation execute this command curl localhost:9200, if elesticsearch is already started you see this result :

1
2
3
4
5
6
7
8
9
10
11
12
13
{
  "name" : "zC7k6v2",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "P7XaxSNcR5yYaqdLOOpHWQ",
  "version" : {
    "number" : "5.5.2",
    "build_hash" : "b2f0c09",
    "build_date" : "2017-08-14T12:33:14.154Z",
    "build_snapshot" : false,
    "lucene_version" : "6.6.0"
  },
  "tagline" : "You Know, for Search"
}

To test kibana installation go to this url in your browser : http://localhost:5601

Get data from elasticsearch

Sources