forksand-it-manual/source/resources/apps/elasticsearch

Clone Debian Stretch template, set up IPs, hostname, ssh keys

apt update apt -y dist-upgrade

##############################################################################

Install Java dependency

apt install openjdk-8-jre-headless

Install Elasticsearch version 6 (latest)

Get key

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

Install deps (should be installed already):

apt-get -y install apt-transport-https

Set up repo for release 6.x

echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-6.x.list

Disable apt-cache in /etc/apt/apt.conf, it doesn't work with https

apt update

It doesn't appear the open source version is in the repo, needs manual install. XXX

#apt install elasticsearch-oss wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-oss-6.3.2.deb dpkg -i elasticsearch-oss-6.3.2.deb

Configure a cluster name and answer on IP.

Open firewall

Allow elasticsearch

-A INPUT -p tcp --dport 9200 -j ACCEPT -A INPUT -p tcp --dport 9300 -j ACCEPT

Set up configuration:

vim /etc/elasticsearch/elasticsearch.yml

Set:

cluster.name: elasticsearch network.host: 10.22.22.124

Start:

systemctl start elasticsearch.service

Start on boot:

systemctl enable elasticsearch.service

XXX Backups

XXX Prometheus :)

##############################################################################

Setting up logging from rsyslog to Elasticsearch

On client machine:

apt install rsyslog-elasticsearch

cat > /etc/rsyslog.d/elasticsearch.conf <<EOF module(load="omelasticsearch") template(name="rsyslog" type="list" option.json="on") { constant(value="{") constant(value=""timestamp":"") property(name="timereported" dateFormat="rfc3339") constant(value="","message":"") property(name="msg") constant(value="","host":"") property(name="hostname") constant(value="","severity":"") property(name="syslogseverity-text") constant(value="","facility":"") property(name="syslogfacility-text") constant(value="","syslogtag":"") property(name="syslogtag") constant(value=""}") } action(type="omelasticsearch" server="10.22.22.124" serverport="9200" template="rsyslog" searchIndex="rsyslog-index" searchType="rsyslog-type" bulkmode="on" maxbytes="100m" queue.type="linkedlist" queue.size="5000" queue.dequeuebatchsize="300" action.resumeretrycount="-1") EOF

systemctl restart rsyslog

##############################################################################

Enable plugins for syslog:

/usr/share/elasticsearch/bin/elasticsearch-plugin install ingest-geoip ##############################################################################