where to install filebeat in ubuntu 18.04 and How to configure logstash to fetch logs in logfiles - elastic-stack

I need help on the following,
Where to install filebeat in ubuntu 18.04 and How to configure logstash to fetch logs in logfiles
how to parse the IPs(intrusion Prevention logs using logstash grok filter?

Related

Logstash shutdown with an eexception

enter image description here
I tried to install logstash and i run
logstash -f ./conf/logstash-sample.conf
command but it gives me that error
i am new in ELK stack

Could not validate a connection to Elasticsearch. No alive nodes found in your cluster

Platform: Magento 2 (V2.4.0) |
Server: Linux Centos
When I run the command below,
COMPOSER_MEMORY_LIMIT=-1 php bin/magento setup:static-content:deploy -f
I get the error,
Could not validate a connection to Elasticsearch. No alive nodes found in your cluster
When I run,
systemctl restart elasticsearch.service
I get the error,
Failed to restart elasticsearch.service: Unit not found.
And when I run the command,
systemctl status elasticsearch
I get the error,
Unit elasticsearch.service could not be found
However, I can see Elasticsearch folder and files in the following path:
vendor/elasticsearch/elasticsearch
Any suggestions?
Thank you!
Hi try using these commands, i use them on my ubuntu instance
sudo -i service elasticsearch start
service elasticsearch restart
sudo -i service elasticsearch stop

Filebeat is not running in ubuntu machine after ELK setup

I was trying to configure ELK in one of ubuntu server and filebeat in another ubuntu machine. After changing the file configuration which is /etc/filebeat/filebeat.yml I am not seeing that filebeat is running.
Where I can check filebeat logs and what I am missing?
if installed filebeat from installer search for log path in /var/log/filebeat.
check for yml for any syntax error and user permission to run the filebeat.

Local Kubernetes on CentOS

I am trying to install Kubernetes locally on my CentOS. I am following this blog http://containertutorials.com/get_started_kubernetes/index.html, with appropriate changes to match CentOS and latest Kubernetes version.
./kube-up.sh script runs and exists with no errors and I don't see the server started on port 8080. Is there a way to know what was the error and if there is any other procedure to follow on CentOS 6.3
The easiest way to install the kubernetes cluster is using kubeadm. The initial post which details the steps of setup is here. And the detailed documentation for the kubeadm can be found here. With this you will get the latest released kubernetes.
If you really want to use the script to bring up the cluster, I did following:
Install the required packages
yum install -y git docker etcd
Start docker process
systemctl enable --now docker
Install golang
Latest go version because default centos golang is old and for kubernetes to compile we need at least go1.7
curl -O https://storage.googleapis.com/golang/go1.8.1.linux-amd64.tar.gz
tar -C /usr/local -xzf go1.8.1.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin
Setup GOPATH
export GOPATH=~/go
export GOBIN=$GOPATH/bin
export PATH=$PATH:$GOBIN
Download k8s source and other golang dependencies
Note: this might take sometime depending on your internet speed
go get -d k8s.io/kubernetes
go get -u github.com/cloudflare/cfssl/cmd/...
Start cluster
cd $GOPATH/src/k8s.io/kubernetes
./hack/local-up-cluster.sh
In new terminal
alias kubectl=$GOPATH/src/k8s.io/kubernetes/cluster/kubectl.sh
kubectl get nodes

Alternative commands for chkconfig in ubuntu

I'm a new to linux platform. I need to establish mongodb as a start-up service. In fedora, I was able to run following commands and successfully did the task.
chkconfig —add mongodb
chkconfig mongodb on
But in ubuntu 13.10, this chkconfig command is not available. I found the update-rc.dcommand is an alternative for that. But I'm still unable to execute those cammands. How can I achieve this task in ubuntu ?
Contrary to Fedora the services that are installed on an Ubuntu system are enabled by default, so you don't need to add or enable them to the init system.
You can check the service status with:
$ service mongodb status
On 12.04 LTS the 10gen mongodb package provides integration into the upstart init system provided in Ubuntu, you can find the job file in /etc/init/mongodb.conf