Please refer to chapter Logging for configuration examples and hints on using the ELK stack.
Elasticsearch, Logstash and Kibana are installed on the loghost.
logstash creates elasticsearch indices of the pattern logstash-YYYY.MM.DD.
elasticsearch-curator deletes indices older than 90 days.
logstash-forwarder ships locally generated logs from all machines to the loghost.
rsyslog forwards all syslog entries to the loghost.
Below is a list of your configuration entry points for the involved components.
All configuration needs to be performed as a service user.
rsyslog: sudo /etc/init.d/rsyslog restart for restarts after configuration changes
rsyslog ignores invalid configuration statements, so be sure to check
/var/log/messagesfor errors after a restart.
logstash-forwarder: sudo /etc/init.d/logstash-forwarder restart for restarts after configuration changes
Logstash: sudo /etc/init.d/logstash restart for restarts after configuration changes
Kibana: refer to our Logging section for how to interact with Kibana
We monitor for:
correctly written log files
correctly pruned Elasticsearch indices