Visualizing data using Logstash and Elasticsearch.
Automating Nagios Configurations
Using Consul and Consul-Template.
Double Blind Passwords
If you use a password manager, and you should, use double-blind passwords for, at least, your most critical logins such as crypto exchanges, banks shopping and payment systems such as Paypal. Double-blind passwords add an extra layer of protecton in
Logstash Filter OTD : NGiNX Access Log
In today’s Logstash Filter Of The Day, we look at encoding NGiNX access logs into JSON. To save the default NGiNX log format into Elasticsearch requires transcoding it to JSON. Read this post to learn how to format your logs
NGiNX JSON Access Log
As of Nginx 1.11.8 you can use the parameter escape=json in your log_format definition to handle JSON encoding and escaping. Here’s a sample log format you can use. Configure server to use json-log definition. Example log line. Passed through jq.
Which Elasticsearch Analyzer for the job?
Elasticsearch provides a few built-in analyzers. Here’s a breakdown of each and where best to use it. No Analyzer Disabling the Analyzer will store your data with no tokens and can only be searched by exact matches of the full
Elasticsearch _source field
The _source field contains the original JSON document body of an Elaticsearch document. It is not indexed nor searchable, but it can be returned when executing fetch requests. Keeping the _source field saved with the document comes with substantial storage
Elasticsearch Index Templates
Index templates allow you to specify index settings and mappings that will automatically be applied when an index is first created. It uses a simple pattern match to control when a template is applied. An index can have multiple patterns
Elasticsearch Document Deduplication With Logstash
Removing duplicate documents from Elasticsearch saves disk space and will speed-up searches. This saves you time and makes you more productive. I setup and manage ELK (Elasticsearch, Logstash and Kibana) clusters that process hundreds of millions log lines per day.
Remove Elasticsearch Node
Example assumes the node IP Address is 172.21.1.21 and that you have jq installed. If you do not have jq remove | jq . from the commands. Expand the number of shards that can be reallocated Choose settings appropriate for