Support #414
Updated by Daniel Curtis over 9 years ago
h1. Prepare the system
* Update the system
<pre>
pkg update && pkg upgrade
portsnap fetch extract
</pre>
* Install portmaster:
<pre>
cd /usr/ports/ports-mgmt/portmaster
make install clean
pkg2ng
</pre>
---
h1. Installing ElasticSearch
* Install elasticsearch:
<pre>
portmaster textproc/elasticsearch
</pre>
* Start and enable ElasticSearch at boot
<pre>
echo 'elasticsearch_enable="YES"' >> /etc/rc.conf
service elasticsearch start
</pre>
h2. Securing Elasticsearch
* Up to version 1.2, Elasticsearch's dynamic scripting capability was enabled by default. Since this tutorial sets up the Kibana dashboard to be accessed from the public Internet, let's disable dynamic scripting by appending the following line at the end of the ElasticSearch configuration file:
<pre>
echo "script.disable_dynamic: true" >> /usr/local/etc/elasticsearch/elasticsearch.yml
</pre>
* Also enable cross origin access:
<pre>
echo 'http.cors.allow-origin: "/.*/"' >> /usr/local/etc/elasticsearch/elasticsearch.yml
echo 'http.cors.enabled: true' >> /usr/local/etc/elasticsearch/elasticsearch.yml
</pre>
* Restart Elasticsearch:
<pre>
service elasticsearch restart
</pre>
---
h1. Install Logstash
* Install logstash:
<pre>
portmaster sysutils/logstash
</pre>
* Create a basic configuration:
<pre>
vi /usr/local/etc/logstash/logstash.conf
</pre>
#* Then modify the following:
<pre>
output {
# Emit events to stdout for easy debugging of what is going through
# logstash.
#stdout { debug => "true" }
# This will use elasticsearch to store your logs.
# The 'embedded' option will cause logstash to run the elasticsearch
# server in the same process, so you don't have to worry about
# how to download, configure, or run elasticsearch!
elasticsearch {
embedded => false
#embedded_http_port => 9200
cluster => elasticsearch
host => log.example.com
port => 9200
}
</pre>
* Start and enable logstash at boot:
<pre>
echo 'logstash_enable="YES"' >> /etc/rc.conf
service logstash start
</pre>
h1. Install Kibana
* Install kibana:
<pre>
portmaster textproc/kibana
</pre>
h2. Configuring Kibana
Kibana will use the default port 9200 to talk to Elasticsearch, Kibana's config.js will not need to be updated.
h1. Installing Nginx
We will use Nginx as a proxy server to allow access to the dashboard from the Public Internet (with basic authentication).
* Install Nginx:
<pre>
portmaster www/nginx
</pre>
* Start and enable nginx at boot
<pre>
echo 'nginx_enable="YES"' >> /etc/rc.conf
service nginx start
</pre>
* Edit the nginx configuration file and change the primary server block as follows:
<pre>
vi /usr/local/etc/nginx/nginx.conf
</pre>
#* And add the following:
<pre>
#
# Nginx proxy for Elasticsearch + Kibana
#
# In this setup, we are password protecting the saving of dashboards. You may
# wish to extend the password protection to all paths.
#
# Even though these paths are being called as the result of an ajax request, the
# browser will prompt for a username/password on the first request
#
# If you use this, you'll want to point config.js at http://FQDN:80/ instead of
# http://FQDN:9200
#
server {
listen 80;
server_name localhost;
access_log /var/log/nginx-logstash.log;
location / {
root /usr/local/www/kibana;
index index.html index.htm;
}
</pre>
* Finally, restart nginx as follows:
<pre>
service nginx restart
</pre>