The Logstash Book by Turnbull, James -- Read -- Imperial Library of Trantor

Index

The Logstash Book The Logstash Book

Who is this book for? Credits and Acknowledgments Technical Reviewers

Jan-Piet Mens Paul Stack

Technical Illustrator Author Conventions in the book Code and Examples Colophon Errata Trademarks Version Copyright

Introduction or Why Should I Bother?

Introducing Logstash Logstash design and architecture What's in the book? Logstash resources Getting help with Logstash A mild warning

Getting Started with Logstash

Installing Java

On the Red Hat family On Debian & Ubuntu Testing Java is installed

Getting Logstash Starting Logstash

Our sample configuration file Running the Logstash agent Testing the Logstash agent

Summary

Shipping Events

Our Event Lifecycle Installing Logstash on our central server

Install Logstash Installing the contributed plugins Installing a broker Elasticsearch for search Creating a basic central configuration Running Logstash as a service

Installing Logstash on our first agent

Our agent configuration Installing Logstash as a service

Sending our first events

Checking Elasticsearch has received our events The Logstash Kibana Console

Summary

Shipping Events without the Logstash agent

Using Syslog

A quick introduction to Syslog Configuring Logstash for Syslog Configuring Syslog on remote agents

Using the Logstash Forwarder

Configure the Logstash Forwarder on our central server Installing the Logstash Forwarder on the remote host

Other log shippers

Beaver Woodchuck Others

Summary

Filtering Events with Logstash

Apache Logs

Configuring Apache for Custom Logging Sending Apache events to Logstash

Postfix Logs

Our first filter Adding our own filters Extracting from different events Setting the timestamp

Filtering Java application logs

Handling blank lines with drop Handling multi-line log events Grokking our Java events

Parsing an in-house custom log format Summary

Outputting Events from Logstash

Send email alerts

Updating our multiline filter Configuring the email output Email output

Send instant messages

Identifying the event to send Sending the instant message

Send alerts to Nagios

Nagios check types Identifying the trigger event The nagios output The Nagios external command The Nagios service

Outputting metrics

Collecting metrics StatsD Setting the date correctly The StatsD output Sending to a different StatsD server

Summary

Scaling Logstash

Scaling Redis

Installing new Redis instances Test Redis is running Configuring Redis output to send to multiple Redis servers Configuring Logstash to receive from multiple Redis servers Testing our Redis failover Shutting down our existing Redis instance

Scaling Elasticsearch

Installing additional Elasticsearch hosts Monitoring our Elasticsearch cluster Managing Elasticsearch data retention More Information

Scaling Logstash

Creating a second indexer

Summary

Extending Logstash

Anatomy of a plugin Creating our own input plugin Adding new plugins Writing a filter Writing an output Summary

← Prev
Back
Next →

← Prev
Back
Next →