PART-6 – Logstash Logstash is nice for analyzing the events. Prepare Logstash We will create two different Logstash deployments, so we can scale them up or down individually. One deployment will be for the incoming events, which will simple be forwarded into the RabbitMQ without much groking or so. The second deployment will be mainly... » weiterlesen
PART-5 – Elasticsearch Templates And Policies I have to update this page – as the templating stuff is not working as intended for none-legacy indices! Because we use Logstash for analysing Logs, we have to prepare templates and ILM policies. Setting Up ILM-Policies And Index-Templates For this setup I created an index-template listening for index-pattern... » weiterlesen
PART-4 – Prepare RabbitMQ For Buffering Events You may have a look at Elasticsearch As Log-Buffer The first thought maybe like: What? Why the hell RabbitMQ and not use the persistent queue featuere of Logstash? Because: Input plugins that do not use a request-response protocol cannot be protected from data loss. For example: tcp, udp,... » weiterlesen
PART-3 – Monitoring As we want to know how our ECK is performing, we also want to monitor it with the built in and supplied "Stack Monitoring" Prepare Filebeat For Monitoring The Cluster For this setup you can orient at the https://github.com/elastic/cloud-on-k8s/tree/master/config/recipes/beats – As we have our "ELK" in its own namespace and also a... » weiterlesen
PART-2 – ECK setup ECK is only available with basic and enterprise/trial license! Deploy ECK Just run following command to install the custom resource definitions – or download the yaml and apply it kubectl apply -f https://download.elastic.co/downloads/eck/1.3.0/all-in-one.yaml Setting Up The Elasticsearch-Cluster Create a folder where you save your yaml-files. In this example we will assume... » weiterlesen
There are wrong spaces later in some of the config-snippets – I have to adjust the pages. Be aware if you just copy and paste stuff from here – some markdown-conversion is not handled well 😐 Setting Up A Home-Lab Elastic ECK I used again Fedora Server (33) to setup a two node Kubernetes cluster... » weiterlesen
This HowTo is mainly meant as documentation if I have to resetup my lab 🙂 Hardware Ryzen 7 4750G 64GB RAM Network Interface card with 4 ports 1TB NVME M2 disk Prerequisites Internet Connection (in this case via my pfSense VM running on old lab) Backup of pfSense config Setup After doing a minimal Fedora... » weiterlesen
We are using for example Graphite, Prometheus and Elasticsearch for monitoring the systems and saving metrics in the company where I’m currently working at and unfortunately for example the data in the different sources is saved with different formatted hostnames etc., also there is currently no real nice way to tag or group different hosts... » weiterlesen
A few days before this article I decided to buy a new PC respectively assemble a new one and I planned to create a Windows 10 Storage Spaces Volume for my "important" data. As data-HDDs I use now four Seagate BarraCuda Compute 2TB (ST2000DM008) in a mirrored 2-column volume with decent benchmarks (reaching up to... » weiterlesen
This is for CheckMK v1 No guarantee that I understood everything correctly. This site is not finished at all ;o) In general you set some default values in your check that should be used if no configuration via WATO was created for a service. For example there could be something like the following line nearly... » weiterlesen