Elastic Stack - De l'installation à la découverte de l'alpha 2

yum -y install java-1.8.0-openjdk

cd /usr/src/
wget https://download.elasticsearch.org/elasticsearch/release/org/elasticsearch/distribution/rpm/elasticsearch/5.0.0-alpha2/elasticsearch-5.0.0-alpha2.rpm

yum localinstall elasticsearch-5.0.0-alpha2.rpm

wget https://download.elastic.co/logstash/logstash/packages/centos/logstash-5.0.0-alpha2.noarch.rpm

yum localinstall logstash-5.0.0-alpha2.noarch.rpm

wget https://download.elastic.co/kibana/kibana/kibana-5.0.0_alpha2-1.x86_64.rpm

yum localinstall kibana-5.0.0_alpha2-1.x86_64.rpm

#limiter l'accès local 
network.host: localhost

#Nom du node
node.name: ${HOSTNAME}

chkconfig --add elasticsearch
service elasticsearch start

curl http://127.0.0.1:9200
{
  "name" : "es5",
  "cluster_name" : "elasticsearch",
  "version" : {
    "number" : "5.0.0-alpha2",
    "build_hash" : "e3126df",
    "build_date" : "2016-04-26T12:08:58.960Z",
    "build_snapshot" : false,
    "lucene_version" : "6.0.0"
  },
  "tagline" : "You Know, for Search"
}

input {
  #Ouverture en entrée d'un port d'écoute utilisant le protocol syslog
  tcp {
 port => 5544
 type => syslog
  }
  udp {
 port => 5544
 type => syslog
  }
}
filter {
  # Traitement type syslog, le type étant marqué sur les données entrant par nos ports de type syslog
  if [type] == "syslog" {
 grok {
   # Si on ne veut pas garder le message non traité
   overwrite => "message"
   match => {
     # rsyslong envoi des messages de type : <Numero>Ligne Syslog avec le message
     #"message" => "^(?:<%{NONNEGINT:syslog_pri}>)?%{SYSLOGBASE2} %{GREEDYDATA:message}"
     "message" => "%{SYSLOG5424PRI}%{SYSLOGBASE2} %{DATA:message}"
   }
   # on ajoute des tags perso, pratique pour filtrer dans l'interface kibana
   add_tag => [ "syslog", "grokked" ]
 }
    }
}
# on stock dans elasticsearch
output {
  elasticsearch {
    hosts => "localhost" 
      template_overwrite => true
  }
}

chkconfig --add logstash
service logstash start

service logstash status
logstash is running

#Logstash sera fonctionnel quand les ports d'écoute seront ouvert :
lsof -i :5544
COMMAND  PID     USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
java    4041 logstash   15u  IPv6  53611      0t0  TCP *:5544 (LISTEN)
java    4041 logstash   40u  IPv6  53615      0t0  UDP *:5544

*.* @@127.0.0.1:5544

service rsyslog restart

logger ${USER} test $(date)
logger ${USER} test $(date)
logger ${USER} test $(date)

service kibana start
kibana started

chkconfig --add kibana

lsof -i :5601                                                                     
COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
node    4173 kibana   10u  IPv4  54297      0t0  TCP *:esmagent (LISTEN)