lancachenet / logstash Goto Github PK

The current Readme doesn't specify how to setup a Filebeat for pushing the logs from i.e. monolithic to logstash.

My current setup with lancachenet/docker-compose looks like this:

• edit docker-compose.yml of lancachenet/docker-compose to include

  filebeat:
    image: docker.elastic.co/beats/filebeat:7.9.1
    volumes:
      - ${CACHE_ROOT}/logs:/data/logs
      - ./config/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml

where ./config/filebeat/filebeat.yml is

name: "lancache"
filebeat.inputs:
- type: log
  paths:
  - '/data/logs/*.log'
  encoding: utf-8
output.logstash:
  hosts: ["logstash_IP:5044"]
  bulk_max_size: 1024

This sends the logs from the volume mounted into monolithic via filebeat to logstash where they get processed by the v7 pipeline from #10.

When attempting to view the Errors Dashboard the request_errors visualisation appears to be missing, I suspect this wasn't included in the everything.json export.
The following error is thrown: Could not locate that visualization (id: 4550fe80-053d-11e8-a29f-a322dcdc3c6e).

Also it appears that the requests_proxied_but_not_cached does not pick up any data, is this an incomplete visualisation? When looking at zeropingheroes/lancache-elk it appears that the /server-status URL should be shown here, but it's not being picked up.

I tried upgrading my ELK stack to 7.x over the weekend without success.

I'm wondering if anybody has managed to get the configuration working with ELK 7.x?
It looked to me like that my_index field for the indexes was not being created properly.

If anybody has had success deploying this on 7.x could you please share the appropriate logstash and filebeat config and an object export from Kibana?

Please could you provide more comprehensive installation instructions. I have spent hours trying to get this to work with no luck