3 node EKL set up

MACPRO181:~ shaik.mohammed$ ssh root@172.16.189.129

[root@localhost ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:df:fc:37 brd ff:ff:ff:ff:ff:ff
inet 172.16.189.129/24 brd 172.16.189.255 scope global noprefixroute dynamic ens33

Set hostname and local dns on all 3 nodes as per your requirement

root@localhost ~]# hostnamectl set-hostname es.example.com
[root@localhost ~]# bash
[root@es ~]# vim /etc/hosts
es.example.com 172.16.189.129
logstash.example.com 172.16.189.130
filebeat.example.com 172.16.189.131

[root@es ~]# yum search jdk

[root@es ~]# yum install java-1.8.0-openjdk-headless.x86_64

https://www.elastic.co/downloads/elasticsearch

[root@es ~]# yum install https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.5.1.rpm

[root@es ~]# getenforce
Enforcing
[root@es ~]# setenforce 0
[root@es ~]# sed -i ‘s/SELINUX=enforcing/SELINUX=disabled/’ /etc/selinux/config

MACPRO181:~ shaik.mohammed$ ssh root@172.16.189.129
root@172.16.189.129’s password:
Last login: Mon Nov 26 09:37:45 2018 from 172.16.189.1
[root@es ~]#

[root@es ~]# systemctl status elasticsearch
● elasticsearch.service – Elasticsearch
Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled; vendor preset: disabled)
Active: inactive (dead)
Docs: http://www.elastic.co

[root@es ~]# systemctl start elasticsearch

[root@es ~]# netstat -tulpn |grep 9*00
tcp6 0 0 127.0.0.1:9200 :::* LISTEN 1437/java
tcp6 0 0 ::1:9200 :::* LISTEN 1437/java
tcp6 0 0 127.0.0.1:9300 :::* LISTEN 1437/java

[root@es ~]# curl localhost:9200
{
“name” : “j5N1jHo”,
“cluster_name” : “elasticsearch”,
“cluster_uuid” : “dyKjKE3pRHigOt7ke8JZNA”,
“version” : {
“number” : “6.5.1”,
“build_flavor” : “default”,
“build_type” : “rpm”,
“build_hash” : “8c58350”,
“build_date” : “2018-11-16T02:22:42.182257Z”,
“build_snapshot” : false,
“lucene_version” : “7.5.0”,
“minimum_wire_compatibility_version” : “5.6.0”,
“minimum_index_compatibility_version” : “5.0.0”
},
“tagline” : “You Know, for Search”
}

[root@es ~]# curl localhost:9200/_cat?
=^.^=
/_cat/allocation
/_cat/shards
/_cat/shards/{index}
/_cat/master
/_cat/nodes
/_cat/tasks
/_cat/indices
/_cat/indices/{index}
/_cat/segments
/_cat/segments/{index}
/_cat/count
/_cat/count/{index}
/_cat/recovery
/_cat/recovery/{index}
/_cat/health
/_cat/pending_tasks
/_cat/aliases
/_cat/aliases/{alias}
/_cat/thread_pool
/_cat/thread_pool/{thread_pools}
/_cat/plugins
/_cat/fielddata
/_cat/fielddata/{fields}
/_cat/nodeattrs
/_cat/repositories
/_cat/snapshots/{repository}
/_cat/templates

[root@es ~]# vim /etc/elasticsearch/elasticsearch.yml

network.host: 172.16.189.129

[root@es ~]# systemctl restart elasticsearch

[root@es ~]# netstat -tulpn |grep 9*00
tcp6 0 0 172.16.189.129:9200 :::* LISTEN 1587/java
tcp6 0 0 172.16.189.129:9300 :::* LISTEN 1587/java

[root@es ~]# systemctl status firewalld
● firewalld.service – firewalld – dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2018-11-26 10:02:18 IST; 58min ago
Docs: man:firewalld(1)
Main PID: 654 (firewalld)
CGroup: /system.slice/firewalld.service
└─654 /usr/bin/python -Es /usr/sbin/firewalld –nofork –nopid

Nov 26 10:02:18 es.example.com systemd[1]: Starting firewalld – dynamic firewall daemon…
Nov 26 10:02:18 es.example.com systemd[1]: Started firewalld – dynamic firewall daemon.

[root@es ~]# systemctl stop firewalld;systemctl disable firewalld
Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.

[root@es ~]# yum install https://artifacts.elastic.co/downloads/kibana/kibana-6.5.1-x86_64.rpm -y

[root@es ~]# vim /etc/kibana/kibana.yml
server.host: “172.16.189.129”
elasticsearch.url: “http://172.16.189.129:9200”

[root@es ~]# systemctl start kibana
[root@es ~]# systemctl status kibana
[root@es ~]# systemctl enable kibana

[root@es ~]# netstat -tlpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1132/master
tcp 0 0 172.16.189.129:5601 0.0.0.0:* LISTEN 635/node
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 868/sshd
tcp6 0 0 ::1:25 :::* LISTEN 1132/master
tcp6 0 0 172.16.189.129:9200 :::* LISTEN 1345/java
tcp6 0 0 172.16.189.129:9300 :::* LISTEN 1345/java
tcp6 0 0 :::22 :::* LISTEN 868/sshd

On log stash node

[root@logstash ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:eb:8c:02 brd ff:ff:ff:ff:ff:ff
inet 172.16.189.130/24

[root@logstash ~]# yum install java-1.8.0-openjdk-headless.x86_64
[root@logstash ~]# yum install https://artifacts.elastic.co/downloads/logstash/logstash-6.5.1.rpm

[root@logstash ~]# systemctl status logstash

[root@logstash ~]# systemctl start logstash

[root@logstash ~]# systemctl stop firewalld;systemctl disable firewalld

[root@logstash ~]# vi /etc/pki/tls/openssl.cnf
[ v3_ca ]
subjectAltName = IP: 172.16.189.130

[root@logstash ~]# cd /etc/pki/tls/

[root@logstash ~]# openssl req -config /etc/pki/tls/openssl.cnf -x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout private/logstash-forwarder.key -out certs/logstash-forwarder.crt

[root@logstash ~]# vi /etc/logstash/conf.d/02-beats-input.conf
input {
beats {
port => 5044
ssl => true
ssl_certificate => “/etc/pki/tls/certs/logstash-forwarder.crt”
ssl_key => “/etc/pki/tls/private/logstash-forwarder.key”
}
}

[root@logstash ~]# vi /etc/logstash/conf.d/10-syslog-filter.conf
filter {
if [type] == “syslog” {
grok {
match => { “message” => “%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}” }
add_field => [ “received_at”, “%{@timestamp}” ]
add_field => [ “received_from”, “%{host}” ]
}
syslog_pri { }
date {
match => [ “syslog_timestamp”, “MMM d HH:mm:ss”, “MMM dd HH:mm:ss” ]
}
}
}

[root@logstash ~]# vi /etc/logstash/conf.d/30-elasticsearch-output.conf
output {
elasticsearch {
hosts => [“172.16.189.129:9200”]
sniffing => true
manage_template => false
index => “%{[@metadata][beat]}-%{+YYYY.MM.dd}”
document_type => “%{[@metadata][type]}”
}
}

[root@logstash ~]# systemctl restart logstash

[root@logstash ~]# netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1103/master
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 858/sshd
tcp6 0 0 ::1:25 :::* LISTEN 1103/master
tcp6 0 0 127.0.0.1:9600 :::* LISTEN 2464/java
tcp6 0 0 :::5044 :::* LISTEN 2464/java
tcp6 0 0 :::22 :::* LISTEN 858/sshd
udp 0 0 0.0.0.0:68 0.0.0.0:* 678/dhclient

Copy the certs on agent nodes
[root@logstash ~]# scp certs/logstash-forwarder.crt root@172.16.189.131:.
[root@logstash ~]# scp private/logstash-forwarder.key root@172.16.189.131:.

On Agent node install filebeat

[root@filebeat ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:24:0c:b0 brd ff:ff:ff:ff:ff:ff
inet 172.16.189.131/24

[root@filebeat ~]# yum install https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.5.1-x86_64.rpm

[root@filebeat ~]# vim /etc/filebeat/filebeat.yml

filebeat.inputs:
– type: log

# Change to true to enable this input configuration.
enabled: true

# Paths that should be crawled and fetched. Glob based paths.
paths:
– /var/log/*.log
– /var/log/messages
– /var/log/*

output.logstash:
# The Logstash hosts
hosts: [“172.16.189.130:5044”]

# Optional SSL. By default is off.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: [“/etc/pki/root/ca.pem”]
ssl.certificate_authorities: [“/root/logstash-forwarder.crt”]

# Certificate for SSL client authentication
#ssl.certificate: “/etc/pki/client/cert.pem”
ssl.certificate: “/root/logstash-forwarder.crt”

# Client Certificate Key
#ssl.key: “/etc/pki/client/cert.key”
ssl.key: “/root/logstash-forwarder.key”

ssl.enabled: true

[root@filebeat ~]# systemctl status filebeat

[root@filebeat ~]# systemctl start filebeat

[root@filebeat ~]# systemctl enable filebeat

[root@filebeat ~]# tail -f /var/log/filebeat/filebeat
2018-11-27T01:46:50.016+0530 INFO log/harvester.go:279 File is inactive: /var/log/lastlog. Closing because close_inactive of 5m0s reached.
2018-11-27T01:46:50.016+0530 INFO log/harvester.go:279 File is inactive: /var/log/btmp. Closing because close_inactive of 5m0s reached.
2018-11-27T01:46:50.016+0530 INFO log/harvester.go:279 File is inactive: /var/log/wtmp. Closing because close_inactive of 5m0s reached.
2018-11-27T01:46:55.036+0530 INFO log/harvester.go:254 Harvester started for file: /var/log/lastlog
2018-11-27T01:46:55.038+0530 INFO log/harvester.go:254 Harvester started for file: /var/log/wtmp
2018-11-27T01:46:55.039+0530 INFO log/harvester.go:254 Harvester started for file: /var/log/btmp
.
.
.
.

On es Node

[root@es ~]# curl 172.16.189.129:9200/_cat/indices
yellow open filebeat-2018.11.27 C3HLzKr4QzaEAxRlByPr4w 5 1 15221 0 4.6mb 4.6mb
yellow open filebeat-2018.11.26 I-JP_ripSm6le6cwSbp5Vg 5 1 4676 0 1.8mb 1.8mb
green open .kibana_1 KTXwbns8TRm3vq-KeOJCKQ 1 0 6 0 31.1kb 31.1kb

[root@es ~]# curl -XPUT 172.16.189.129:9200/peaktest

linuxmadeeasy

3 node EKL set up

Published by mshaik

Leave a comment Cancel reply

Share this:

Published by mshaik

Leave a comment Cancel reply