wip

config/filebeat.yml

@@ -0,0 +1,10 @@
+filebeat.inputs:
+- type: docker
+  containers.ids:
+    - "*"
+
+processors:
+- add_docker_metadata: ~
+
+output.logstash:
+  hosts: ["http://logstash01:5044"]

config/kibana.yml

@@ -0,0 +1,54 @@
+# Kibana's Elasticsearch URL
+elasticsearch.hosts: ["https://es01:9200"]
+
+# The name of the Kibana instance
+server.name: "kibana"
+
+# The base path for Kibana
+#server.basePath: ""
+
+# Serve the Kibana instance at the root path
+#server.rewriteBasePath: false
+
+# Enable or disable the Kibana server
+server.enabled: true
+
+# The port Kibana will listen on
+server.port: 5601
+
+# Enable or disable the xpack features
+xpack.enabled: true
+
+# Set the encryption key for encrypted saved objects
+#xpack.encryptedSavedObjects.encryptionKey: ""
+
+# Set the key for the kibana security features
+#xpack.security.encryptionKey: ""
+
+# Enable or disable the monitoring feature
+xpack.monitoring.enabled: true
+
+# Set the URL of the Elasticsearch instance to which Kibana should connect
+#xpack.reporting.enabled: true
+
+  #xpack.reporting.roles.enabled: false
+
+# Enable the Kibana alerting feature
+#xpack.alerting.enabled: false
+
+# Enable or disable the usage collection
+#xpack.usageCollection.enabled: true
+
+# Configure the log level for Kibana
+#logging.level: info
+
+# Configure the directory where logs will be stored
+logging.dest: /var/log/kibana/kibana.log
+
+# Configure security and authentication settings
+elasticsearch.username: test
+elasticsearch.password: test 
+
+# Disable or enable the Kibana plugin
+#xpack.license.management.enabled: false
+

config/logstash.conf

@@ -0,0 +1,30 @@
+input {
+	file {
+		path => "/var/lib/docker/containers/*/*.log"
+		start_position => "beginning"
+		sincedb_path => "/dev/null"
+		type => "docker"
+		codec => "json"
+	}
+}
+
+filter {
+	if [log_message] =~ /GET/ {
+		grok {
+			match => { "log_message" => "%{IP:client_ip} - - \[%{HTTPDATE:timestamp}\] \"%{WORD:method} %{URIPATH:request_path} HTTP/%{NUMBER:http_version}\" %{NUMBER:response_code} %{NUMBER:response_size}" }
+		}
+		date {
+			match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
+				target => "@timestamp"
+		}
+	}
+}
+
+output {
+	elasticsearch {
+		hosts => ["http://es01:9200"]
+		index => "docker-logs-%{+YYYY.MM.dd}"
+		user=> "${ELASTIC_USER}"
+		password=> "${ELASTIC_PASSWORD}"
+	}
+}