forksand-it-manual/source/resources/apps/elasticsearch

# Clone Debian Stretch template, set up IPs, hostname, ssh keys

apt update

apt -y dist-upgrade



##############################################################################

# Install Java dependency

apt install openjdk-8-jre-headless





# Install Elasticsearch version 6 (latest)

# Get key

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

# Install deps (should be installed already):

apt-get -y install apt-transport-https

# Set up repo for release 6.x

echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-6.x.list



# Disable apt-cache in /etc/apt/apt.conf, it doesn't work with https

apt update



# It doesn't appear the open source version is in the repo, needs manual install. XXX

#apt install elasticsearch-oss

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-oss-6.3.2.deb

dpkg -i elasticsearch-oss-6.3.2.deb



# Configure a cluster name and answer on IP.

# Open firewall

# Allow elasticsearch

-A INPUT -p tcp --dport 9200 -j ACCEPT

-A INPUT -p tcp --dport 9300 -j ACCEPT



# Set up configuration:

vim /etc/elasticsearch/elasticsearch.yml

# Set:

cluster.name: elasticsearch

network.host: 10.22.22.124



# Start:

systemctl start elasticsearch.service



# Start on boot:

systemctl enable elasticsearch.service



### XXX Backups

### XXX Prometheus :)



##############################################################################

# Setting up logging from rsyslog to Elasticsearch



# On client machine:

apt install rsyslog-elasticsearch



cat >  /etc/rsyslog.d/elasticsearch.conf <<EOF

module(load="omelasticsearch")

template(name="rsyslog"

         type="list"

         option.json="on") {

           constant(value="{")

             constant(value="\"timestamp\":\"")      property(name="timereported" dateFormat="rfc3339")

             constant(value="\",\"message\":\"")     property(name="msg")

             constant(value="\",\"host\":\"")        property(name="hostname")

             constant(value="\",\"severity\":\"")    property(name="syslogseverity-text")

             constant(value="\",\"facility\":\"")    property(name="syslogfacility-text")

             constant(value="\",\"syslogtag\":\"")   property(name="syslogtag")

           constant(value="\"}")

         }

action(type="omelasticsearch"

       server="10.22.22.124"

       serverport="9200"

       template="rsyslog"

       searchIndex="rsyslog-index"

       searchType="rsyslog-type"

       bulkmode="on"

       maxbytes="100m"

       queue.type="linkedlist"

       queue.size="5000"

       queue.dequeuebatchsize="300"

       action.resumeretrycount="-1")

EOF



systemctl restart rsyslog



##############################################################################

# Enable plugins for syslog:

/usr/share/elasticsearch/bin/elasticsearch-plugin install ingest-geoip

##############################################################################