Hot answers tagged

4

One best practice would be to log everything to the same location. Your "Current idea" suggests that you'd be running the Elastic stack locally, which is great for a local development environment, but for anything outside that you want to be shipping the logs from all your microservices to the same location. This enables you to do correlation between logs, ...


1

https://github.com/elastic/stack-docker/blob/master/docker-compose.yml This is an official docker-compose for running Elasticsearch, and will make a good starting point for whatever you're trying to achieve. This would be the key part: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:${TAG} environment: ['http.host=0.0.0.0', '...


1

This error occurs because you used a variable ($) and wildcard name (*.war). Elastic Beanstalk plugin does not support Variable or wildcard name in the Value. I suggest a use full path of Jenkins job instead of ${WORKSPACE} and full war name like ROOT.war instead of *.war


1

When resolving a service in Kubernetes, Assume a Service named foo in the Kubernetes namespace bar. A Pod running in namespace bar can look up this service by simply doing a DNS query for foo. A Pod running in namespace quux can look up this service by doing a DNS query for foo.bar. Since Jaeger is in the same namespace, then yes, it can resolve the ...


1

ElasticSearch can backup itself when told to do so via an API call. You just need to configure a destination, and optionally credentials, for example you make ElasticSearch create snapshots of its database in AWS S3. https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-snapshots.html You can also automate these calls using a schedule ...


1

Load can mean a lot with an ELK stack. For ingestion load, the logstash parsing side, you're looking at a combination of one or two things: CPU load on the ingestion boxes. If used, back-pressure in your ingestion-queue (such as Redis, AMQP, or others) This can be simple stuff like queue-size, or a fancy number like age of the oldest member of the queue. ...


1

I suggest making a cronjob container that does the SQL dump and elastic index using docker exec commands toward the corresponding containers.


1

There are two ways to accomplish this, though one of them was only available recently. The old-school version, the one you can do as far back as Logstash 1.5, is to pay attention to tags and use conditionals to separate your inputs. Roughly... input { tcp { port => 1525 codec => json_lines tags => [ 'tcp' ] } } input { file { ...


1

ELK is pretty ineffective as a monitoring tool in a default configuration as it doesn't do monitoring - only reporting. ELK can only provide monitoring and alerting abilities if you configure additional add-ons such as ElastAlert. Then, you are impacted by your ability to log errors via syslog. If messages come in via, say, SNMP traps, you will be unable to ...


1

Ansible is an automation tool, so it can automate things you can do by hands. But as far as I know no existing cron-like services support sending logs to elasticsearch (Kibana is just a viewer, btw) out of the box. So at first, you should create some wrapper script that will execute your actual job and send it's result to elasticsearch. An then schedule ...


1

I haven't tried it myself, but in Alarms management with Elasticsearch and Kibana someone recommended Elastalert


1

You can do this a couple of ways, but I have never seen anyone do this with a CNAME. One option, if you have control over your IP addressing is to use BGP to fail-over (or load balance) an IP to your cloud hosting providers. A second option is to invest in a DNS-based geographic load balancing solution, such as the GTM from F5, the GSLB solution from A10, ...


1

Being unfamiliar with Kibana, I was not aware of the time constraint on data on the default search/display of just 15 minutes. The data coming in was timestamped (@timestamp key) via the 'date' plugin with the original open date, NOT the time of the, via TCP port to elastic, insertion event; thus, no data was showing and I had no idea that by default only ...


Only top voted, non community-wiki answers of a minimum length are eligible