ELK start guide

Elasticsearch_Logstash_Kibana:

Elastic Stack and Product Documentation

component of elk:

• elasticsearch
• logstash
• kibana

data stream:

[Data source] -> [Logstash]->[Elasticsearch]->[Kibana]

[Data source] is anything that contains data like files,log4net,rabbitmq...and so on.

---

Elasticsearch Engine

1. the structure of elasticsearch engine
2. basic config of elasticsearch
3. basic get _cat put function to modify data

Kibana

1. what kibana is and whats kibana can provide
2. basic conifg of kibana to connect to a elasticsearch
3. Dev tools in kibana
4. set index pattern to modify data
5. use filters

logstash

1. three concepts of logstash
2. basic config of logstash
3. input plugin examples
   • elastic search input plugin
   • Log4j input plugin
   • File input plugin
   • rabbitmq input plugin
4. filters examples
   • date
   • grok
   • drop
5. output plugin examples
   • elastic serch output plugin
   • File output plugin
   • Email output plugin
   • Http output plugin
   • stdout

---

data

timestamp	type	index	name	remark
2017-11-14	book	w1	fkbook	\
2017-11-15	table	w1	fktable	\
2017-11-16	pen	w2	fkpen	\

1. save type directly
2. save type in header
3. use [timestamp] if type is book
   else use current time as [timestamp]
4. [@metadata][tag] set to filter data
5. make image in kibana