lel99999 / dev_elkrh7

ELK (Elastic Search, Logstash, Kibana) Deployment & Development

dev_ELKRH7

ELK (Elastic Search, Logstash, Kibana) Deployment & Development

Base Requirements

Host setup

• Docker Engine version 17.05 or newer
• Docker Compose version 1.20.0 or newer
• 1.5 GB of RAM information_source Especially on Linux, make sure your user has the required permissions to interact with the Docker daemon.

By default, the stack exposes the following ports:

• 5044: Logstash Beats input
• 5000: Logstash TCP input
• 9600: Logstash monitoring API
• 9200: Elasticsearch HTTP
• 9300: Elasticsearch TCP transport
• 5601: Kibana

SELINUX
On distributions which have SELinux enabled out-of-the-box you will need to either re-context the files or set SELinux into Permissive mode in order for docker-elk to start properly. For example on Redhat and CentOS, the following will apply the proper context:NUX***

$chcon -R system_u:object_r:admin_home_t:s0 docker-elk/

Elastic Search

• /etc/elasticsearch/elasticsearch.yml
  

network.host: <localhost>

Restart Elasticsearch:

$sudo systemctl enable elasticsearch

Elastick Search Latest v8

• Install GPG Key

  $sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
  

• Install from RPM Repository
  Create file elasticsearch.repo
  

  [elasticsearch]
  name=Elasticsearch repository for 8.x packages
  baseurl=https://artifacts.elastic.co/packages/8.x/yum
  gpgcheck=1
  gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
  enabled=0
  autorefresh=1
  type=rpm-md
  

• Add Repository

Update

Test Elasticsearch service bin sending HTTP request:

$curl -x GET "localhost:9200"

You should see:

Output
{
  "name" : "8oSCBFJ",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "1Nf9ZymBQaOWKpMRBfisog",
  "version" : {
    "number" : "6.5.2",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "9434bed",
    "build_date" : "2018-11-29T23:58:20.891072Z",
    "build_snapshot" : false,
    "lucene_version" : "7.5.0",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  },
  "tagline" : "You Know, for Search"
}