Kibana Connects to Elasticsearch
● Logstash parses and structures data into
Elasticsearch
● Kibana makes that data available
● Apache Lucene Query Syntax (from elasticsearch)
● Field statistics
● Range searches
How do we put it together?
It Was Simple to Start
input { stdin { type => "stdin-type" } }
output {
stdout { debug => true debug_format => "json" }
elasticsearch { embedded => true }
}
java -jar logstash-1.1.9-monolithic.jar agent -f
logstash-search.conf
But Let's Get Real
Thoughts....
● Easy to try out, but for anything real, you'll want a much
more complicated configuration
● The variety of inputs is great
● Easy to build up a nice stack of filters
More Thoughts....
● Slow to boot monolithic jar file can be frustrating
○ Flatjar?
● Hard to track down why logs aren't flowing
● Elasticsearch node discovery can be difficult
○ If your cluster doesn't have a node added to it when
your client starts, your client isn't connected