CC-Project-ELK

Maintain logs using elk service using docker

Step 1: Create 4 linux instances on cloud

Step 2: Select first instance as the elk server instance and install docker in it. Then type the following commands:

Using 2 different Docker images (official Elastic docker images)

Step 1: Setup Elasticsearch container and verify elastic its working

docker run -d -p 9200:9200 -p 9300:9300 -it -h elasticsearch --name elasticsearch elasticsearch

      curl http://localhost:9200/

Step 2: Setup Kibana container

docker run -d -p 5601:5601 -h kibana --name kibana --link elasticsearch:elasticsearch kibana

      curl http://localhost:9200/_cat/indices

Step 3: On all remaining instances type the following:

Step 1:

    apt-get install filebeat

    mv /etc/filebeat/filebeat.yml /etc/filebeat/filebeat.yml.orig
    
    touch /etc/filebeat/filebeat.yml

Step 2: open the yml file
```
    nano /etc/filebeat/filebeat.yml
```

Step 3: Type the following in yml file and then save and close the file

    filebeat.prospectors:
    - input_type: log
     paths:
     - /var/log/apache2/access.log
    output.elasticsearch:
     hosts: ["server-ip-address:9200"]

Step 4: Type:
```
    service filebeat start
```
Step 5: Start kibana on server, using https://localhost:5600 on server instance and then change the index on kibana to filebeat-* Goto discover and you can see the logs coming from different clients.

VESIT-CMPN / CC-Project-ELK

CC-Project-ELK

About