Centralized Logging with Logstash, Elasticsearch & Kibana

In this post, we will set up the collection and visualization of system logs with the use of Logstash and Kibana.

Sometimes we need to look through the logs, searching for the required lines on several servers; to do this, we log in and look for the logs repeating the same commands on the servers.

Suppose we have 3 MX servers, and some customer files a complaint on a missing message; which he sent abroad to his wife at a particular time. 

Using the ELK stack (E-elasticsearch L-logstash K-kibana), we can find that message in the logs in a couple of clicks. 

What you have to replace is marked in italic.

– Centos 7: The most recent version of the operation system

– Logstash: Server-based part for processing incoming logs

– Elasticsearch: For storing logs

– Kibana: Web interface for searching through and visualizing the logs

– Logstash Forwarder: It is installed on the servers as an agent for sending logs to a logstash server.

We will install the first three components on our collection server, and Logstash Forwarder on the servers we want to collect logs from.

Java is needed for Logstash and Elasticsearch. We are going to install OpenJDK 8.

Unpack

Grant the necessary rights:

Create simlinks with the use of alternatives:

Delete the downloaded archive

Import Elasticsearch public GPG key:

Create and edit the repository file for Elasticsearch:

Install Elasticsearch

Modify the configuration file:

Close access to elascticsearch from the outside:

Run Elasticsearch:

And add it to the autorun:

Download and unpack Kibana 4:

Edit the configuration file:

In the Kibana configuration file, find the line that determines the host and replace the IP (0.0.0.0 by default) with the IP from the localhost:

This parameter indicates that Kibana will be accessible only locally. This is good, as we will use the reverse proxy server Nginx to grant access from the outside.

And relocate the unpacked files there:

Kibana is run as /opt/kibana/bin/kibana, but we will run it as a service. Create Kibana Systemd:

Now, run it and add it to the autorun

Set epel repository

Install Nginx

Using htpasswd, create a user and a password

Now, edit the main configuration nginx.com:

Find and delete the whole section server{}. Two lines should remain at the end

Now, create the configuration file nginx for kibana4

Run Nginx:

Now, Kibana is accessible at https://FQDN/

Create the repository file for Logstash: