initial commit

files/kibana/kibana.conf.j2

@@ -0,0 +1,28 @@
+server {
+  listen 80;
+  server_name logs.notprod.pl;
+  root /var/www/kibana;
+
+  # Set image format types to expire in a very long time
+  location ~* ^.+\.(jpg|jpeg|gif|png|ico)$ {
+      access_log off;
+      expires max;
+  }
+
+  # Set css and js to expire in a very long time
+  location ~* ^.+\.(css|js)$ {
+      access_log off;
+      expires max;
+  }
+
+  # Catchall for everything else
+  location / {
+    root /var/www/kibana;
+    index index.html;
+    expires 1d;
+    try_files $uri/ $uri;
+    if (-f $request_filename) {
+      break;
+    }
+  }
+}

files/logstash/logstash-init

@@ -0,0 +1,25 @@
+# logstash-indexer.conf# logstash - indexer instance
+#
+
+description     "logstash indexer instance"
+
+start on virtual-filesystems
+stop on runlevel [06]
+
+respawn
+respawn limit 5 30
+limit nofile 65550 65550
+
+env HOME=/opt/logstash
+env JAVA_OPTS='-Xms512m -Xmx512m'
+
+chdir /opt/logstash
+setuid root
+console log
+
+# for versions 1.1.1 - 1.1.4 the internal web service crashes when touched
+# and the current workaround is to just not run it and run Kibana instead
+
+script
+        exec java -jar /opt/logstash/share/logstash.jar agent -f /opt/logstash/etc/logstash.conf --log /var/log/logstash/logstash-indexer.out
+end script

files/logstash/logstash.conf

@@ -0,0 +1,26 @@
+# logstash configuration
+
+# Define inputs
+input {
+    syslog {
+        debug => false
+        host => "0.0.0.0"
+        port => 5514
+        type => "linux-syslog"
+    }
+}
+filter {
+    grok {
+        type => "linux-syslog"
+        pattern => "%{SYSLOGLINE}"
+    }
+}
+# Define outputs
+output {
+    # send events to stdout for easy debugging
+    # stdout { debug => true debug_format => "json" }
+
+    elasticsearch {
+        host => "127.0.0.1"
+    }
+}