3
3
4
4
Looking for an {stack} ("ELK" tutorial) that shows how to set up the {stack}? In
5
5
this tutorial, you learn how to get up and running quickly. First you install
6
- the core open source products:
6
+ the core products:
7
7
8
8
* <<install-elasticsearch,{es}>>
9
9
* <<install-kibana,{kib}>>
10
10
* <<install-beats,{beats}>>
11
- * <<install-logstash,{ls}>>
11
+ * <<install-logstash,{ls} (optional) >>
12
12
13
13
Then you learn how to implement a system monitoring solution that uses
14
14
{metricbeat} to collect server metrics and ship the data to {es}, where you can
@@ -56,7 +56,8 @@ Elasticsearch Service for free].
56
56
57
57
To download and install {es}, open a terminal window and use the commands that
58
58
work with your system (<<deb, deb>> for Debian/Ubuntu, <<rpm, rpm>> for
59
- Redhat/Centos/Fedora, <<mac, mac>> for OS X, and <<win, win>> for Windows):
59
+ Redhat/Centos/Fedora, <<mac, mac>> or <<brew, brew>> for OS X, <<linux, linux>>
60
+ for Linux, and <<win, win>> for Windows):
60
61
61
62
62
63
[[deb]]*deb:*
@@ -117,6 +118,24 @@ cd elasticsearch-{elasticsearch_version}
117
118
118
119
endif::[]
119
120
121
+ [[brew]]*brew:*
122
+
123
+ ifeval::["{release-state}"=="unreleased"]
124
+
125
+ Version {version} of {es} has not yet been released.
126
+
127
+ endif::[]
128
+
129
+ ifeval::["{release-state}"!="unreleased"]
130
+
131
+ ["source","sh",subs="attributes,callouts"]
132
+ ----------------------------------------------------------------------
133
+ brew tap elastic/tap
134
+ brew install elastic/tap/elasticsearch-full
135
+ elasticsearch
136
+ ----------------------------------------------------------------------
137
+
138
+ endif::[]
120
139
121
140
[[linux]]*linux:*
122
141
@@ -246,7 +265,7 @@ file, `kibana.yml`, before starting {kib}.
246
265
To download and install {kib}, open a terminal window and use the commands that
247
266
work with your system:
248
267
249
- *deb or rpm :*
268
+ *deb, rpm, or linux :*
250
269
251
270
ifeval::["{release-state}"=="unreleased"]
252
271
@@ -286,6 +305,25 @@ cd kibana-{kibana_version}-darwin-x86_64/
286
305
287
306
endif::[]
288
307
308
+ *brew:*
309
+
310
+ ifeval::["{release-state}"=="unreleased"]
311
+
312
+ Version {version} of {kib} has not yet been released.
313
+
314
+ endif::[]
315
+
316
+ ifeval::["{release-state}"!="unreleased"]
317
+
318
+ ["source","sh",subs="attributes"]
319
+ ----------------------------------------------------------------------
320
+ brew tap elastic/tap
321
+ brew install elastic/tap/kibana-full
322
+ kibana
323
+ ----------------------------------------------------------------------
324
+
325
+ endif::[]
326
+
289
327
*win:*
290
328
291
329
ifeval::["{release-state}"=="unreleased"]
@@ -421,6 +459,42 @@ tar xzvf metricbeat-{version}-darwin-x86_64.tar.gz
421
459
422
460
endif::[]
423
461
462
+ *brew:*
463
+
464
+ ifeval::["{release-state}"=="unreleased"]
465
+
466
+ Version {version} of {metricbeat} has not yet been released.
467
+
468
+ endif::[]
469
+
470
+ ifeval::["{release-state}"!="unreleased"]
471
+
472
+ ["source","sh",subs="attributes"]
473
+ ----------------------------------------------------------------------
474
+ brew tap elastic/tap
475
+ brew install elastic/tap/metricbeat-full
476
+ ----------------------------------------------------------------------
477
+
478
+ endif::[]
479
+
480
+ *linux:*
481
+
482
+ ifeval::["{release-state}"=="unreleased"]
483
+
484
+ Version {version} of {metricbeat} has not yet been released.
485
+
486
+ endif::[]
487
+
488
+ ifeval::["{release-state}"!="unreleased"]
489
+
490
+ ["source","sh",subs="attributes,callouts"]
491
+ ------------------------------------------------
492
+ curl -L -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-{version}-linux-x86_64.tar.gz
493
+ tar xzvf metricbeat-{version}-linux-x86_64.tar.gz
494
+ ------------------------------------------------
495
+
496
+ endif::[]
497
+
424
498
*win:*
425
499
426
500
ifeval::["{release-state}"=="unreleased"]
@@ -487,13 +561,20 @@ To set up the `system` module and start collecting system metrics:
487
561
sudo metricbeat modules enable system
488
562
----
489
563
+
490
- *mac:*
564
+ *mac and linux :*
491
565
+
492
566
[source,yaml]
493
567
----
494
568
./metricbeat modules enable system
495
569
----
496
570
+
571
+ *brew:*
572
+ +
573
+ [source,yaml]
574
+ ----
575
+ metricbeat modules enable system
576
+ ----
577
+ +
497
578
*win:*
498
579
+
499
580
[source,yaml]
@@ -510,13 +591,20 @@ PS C:\Program Files\Metricbeat> .\metricbeat.exe modules enable system
510
591
sudo metricbeat setup -e
511
592
----
512
593
+
513
- *mac:*
594
+ *mac and linux :*
514
595
+
515
596
[source,yaml]
516
597
----
517
598
./metricbeat setup -e
518
599
----
519
600
+
601
+ *brew:*
602
+ +
603
+ [source,yaml]
604
+ ----
605
+ metricbeat setup -e
606
+ ----
607
+ +
520
608
*win:*
521
609
+
522
610
[source,yaml]
@@ -537,13 +625,20 @@ standard error instead of syslog.
537
625
sudo service metricbeat start
538
626
----
539
627
+
540
- *mac:*
628
+ *mac and linux :*
541
629
+
542
630
[source,yaml]
543
631
----
544
632
./metricbeat -e
545
633
----
546
634
+
635
+ *brew:*
636
+ +
637
+ [source,yaml]
638
+ ----
639
+ metricbeat -e
640
+ ----
641
+ +
547
642
*win:*
548
643
+
549
644
[source,yaml]
@@ -559,7 +654,7 @@ PS C:\Program Files\Metricbeat> Start-Service metricbeat
559
654
==== Visualize system metrics in {kib}
560
655
561
656
To visualize system metrics, open your browser and navigate to the {metricbeat}
562
- system overview dashboard: http://localhost:5601/app/kibana#/dashboard/Metricbeat-system-overview
657
+ system overview dashboard: http://localhost:5601/app/kibana#/dashboard/Metricbeat-system-overview-ecs
563
658
564
659
TIP: If you don’t see data in {kib}, try changing the date range to a larger
565
660
range. By default, {kib} shows the last 15 minutes. If you see errors, make
@@ -580,12 +675,13 @@ same server--let's add {ls}.
580
675
[float]
581
676
[[install-logstash]]
582
677
583
- === Install {ls}
678
+ === Install {ls} (optional)
584
679
585
680
https://www.elastic.co/products/logstash[{ls}] is a powerful tool that
586
681
integrates with a wide variety of deployments. It offers a large selection of
587
682
plugins to help you parse, enrich, transform, and buffer data from a variety of
588
- sources.
683
+ sources. If your data requires additional processing that is not available in
684
+ {beats}, then you need to add {ls} to your deployment.
589
685
590
686
To download and install {ls}, open a terminal window and use the commands that
591
687
work with your system:
@@ -626,7 +722,7 @@ sudo rpm -i logstash-{logstash_version}.rpm
626
722
627
723
endif::[]
628
724
629
- *mac:*
725
+ *mac and linux :*
630
726
631
727
ifeval::["{release-state}"=="unreleased"]
632
728
@@ -644,6 +740,24 @@ tar -xzvf logstash-{logstash_version}.tar.gz
644
740
645
741
endif::[]
646
742
743
+ *brew:*
744
+
745
+ ifeval::["{release-state}"=="unreleased"]
746
+
747
+ Version {version} of {ls} has not yet been released.
748
+
749
+ endif::[]
750
+
751
+ ifeval::["{release-state}"!="unreleased"]
752
+
753
+ ["source","sh",subs="attributes"]
754
+ ----------------------------------------------------------------------
755
+ brew tap elastic/tap
756
+ brew install elastic/tap/logstash-full
757
+ ----------------------------------------------------------------------
758
+
759
+ endif::[]
760
+
647
761
*win:*
648
762
649
763
ifeval::["{release-state}"=="unreleased"]
@@ -725,7 +839,8 @@ enriching, and transforming data.
725
839
726
840
Use the command that works with your system. If you installed {ls} as a deb or
727
841
rpm package, make sure the config file is in the `config` directory.
728
- On mac, that step isn't required but it is a best practice for reasons of consistency.
842
+ For other platforms, a `config` directory isn't required, but it's a best
843
+ practice to be consistent.
729
844
730
845
*deb:*
731
846
@@ -741,19 +856,26 @@ sudo /etc/init.d/logstash start
741
856
sudo service logstash start
742
857
----------------------------------------------------------------------
743
858
744
- *mac:*
859
+ *mac and linux :*
745
860
746
861
["source","sh",subs="attributes,callouts"]
747
862
----------------------------------------------------------------------
748
863
cd logstash-{logstash_version}
749
- ./bin/logstash -f config/demo-metrics-pipeline.conf
864
+ ./bin/logstash -f path/to/config/demo-metrics-pipeline.conf
865
+ ----------------------------------------------------------------------
866
+
867
+ *brew:*
868
+
869
+ ["source","sh",subs="attributes,callouts"]
870
+ ----------------------------------------------------------------------
871
+ logstash -f path/to/config/demo-metrics-pipeline.conf
750
872
----------------------------------------------------------------------
751
873
752
874
*win:*
753
875
754
876
["source","sh",subs="attributes,callouts"]
755
877
----------------------------------------------------------------------
756
- bin\logstash.bat -f demo-metrics-pipeline.conf
878
+ bin\logstash.bat -f path\to\config\ demo-metrics-pipeline.conf
757
879
----------------------------------------------------------------------
758
880
759
881
TIP: If you receive JVM error messages, check your Java version as shown in
@@ -767,7 +889,8 @@ configure {metricbeat} to send events to {ls}.
767
889
768
890
{metricbeat} sends events to {es} by default. To send events to {ls}, modify the
769
891
{metricbeat} configuration file, `metricbeat.yml`. You'll find this file under
770
- the {metricbeat} install directory, or `/etc/metricbeat` for rpm and deb.
892
+ the {metricbeat} install directory, `/etc/metricbeat` for rpm and deb, or
893
+ `/usr/local/etc/metricbeat` for brew.
771
894
772
895
Disable the `output.elasticsearch` section by commenting it out, then enable
773
896
the `output.logstash` section by uncommenting it:
@@ -900,6 +1023,13 @@ how, read:
900
1023
* {stack-ov}/elasticsearch-security.html[Securing the {stack}]
901
1024
* {stack-ov}/license-management.html[License Management]
902
1025
1026
+ Want to get up and running quickly with infrastructure metrics monitoring and
1027
+ centralized log analytics? Try out the
1028
+ {infra-guide}/infrastructure-ui-overview.html[Infrastructure] and
1029
+ {infra-guide}/logs-ui-overview.html[Logs] UIs
1030
+ in {kib}. For setup details, see the {infra-guide}/index.html[Infrastructure
1031
+ Monitoring Guide].
1032
+
903
1033
Later, when you're ready to set up a production environment, also see the
904
1034
{stack-ref}/installing-elastic-stack.html[{stack} Installation and Upgrade
905
1035
Guide].
0 commit comments