Debian 9 64 Bits – Stack ELK

apt-get install openjdk-8-jdk

wget -qO – https://artifacts.elastic.co/GPG-KEY-elasticsearch | apt-key add –
apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" | tee -a /etc/apt/sources.list.d/elastic-6.x.list
apt-get update
apt-get install elasticsearch

nano /etc/elasticsearch/elasticsearch.yml

#Modifier
network.host: localhost

systemctl restart elasticsearch
systemctl daemon-reload
systemctl enable elasticsearch

apt-get install kibana

nano /etc/kibana/kibana.yml

server.port: 5601
server.host: "localhost"
elasticsearch.hosts: ["http://localhost:9200"]
kibana.index: ".kibana"

systemctl restart kibana
systemctl daemon-reload
systemctl enable kibana

apt-get -y install nginx apache2-utils
echo “kibanaadmin:`openssl passwd -apr1`” | sudo tee -a /etc/nginx/htpasswd.users

nano /etc/nginx/sites-available/default

server {
listen 80;
server_name example.com;
auth_basic "Restricted Access";
auth_basic_user_file /etc/nginx/htpasswd.users;
location / {
proxy_pass http://localhost:5601;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
}

nginx -t
systemctl restart nginx

apt-get install logstash
systemctl start logstash.service
systemctl enable logstash.service

nano /etc/logstash/conf.d/01-logstash-apache.conf

input {
beats {
port => "5044"
type => "apache_access"
}
}

filter {
grok {
match => { "message" => ["%{IPORHOST:[apache2][access][remote_ip]} - %{DATA:[apache2][access][user_name]} \[%{HTTPDATE:[apache2][access][time]}\] \"%$
remove_field => "message"
}
mutate {
add_field => { "read_timestamp" => "%{@timestamp}" }
}
date {
match => [ "[apache2][access][time]", "dd/MMM/YYYY:H:m:s Z" ]
remove_field => "[apache2][access][time]"
}
useragent {
source => "[apache2][access][agent]"
target => "[apache2][access][user_agent]"
remove_field => "[apache2][access][agent]"
}
geoip {
source => "[apache2][access][remote_ip]"
target => "[apache2][access][geoip]"
}
}

output {
elasticsearch {
hosts => [ "localhost:9200" ]
index => "logstash-test-loina-%{+YYYY.MM.dd}"
}
# stdout { codec => rubydebug }
}

nano /etc/logstash/conf.d/01-logstash-rsyslog.conf

input {
  udp {
    port => 10514
    codec => "json"
    type => "syslog"
  }
}

filter {
  # This replaces the host field (UDP source) with the host that generated the message (sysloghost)
  if [sysloghost] {
    mutate {
      replace => [ "host", "%{sysloghost}" ]
      remove_field => "sysloghost" # prune the field after successfully replacing "host"
    }
  }
}

output {
  elasticsearch { host => localhost }
}

/usr/share/logstash/bin/logstash --debug –configtest -f /etc/logstash/conf.d/01-logstash-log-apache.conf

/usr/share/logstash/bin/logstash --debug –configtest -f /etc/logstash/conf.d/01-logstash-log-apache.conf -t

wget -qO – https://artifacts.elastic.co/GPG-KEY-elasticsearch | apt-key add –
apt-get install apt-transport-https
echo “deb https://artifacts.elastic.co/packages/5.x/apt stable main” | tee -a  /etc/apt/sources.list.d/elastic-5.x.list
apt-get install install filebeat
chkconfig –add filebeat

nano /etc/filebeat/filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/syslog
#Pas de sortie direct vers elasticsearch
#output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["localhost:9200"]

output.logstash:
  # The Logstash hosts
  hosts: ["elk.loina.wf:5044"]

systemctl start filebeat
systemctl enable filebeat

apt-get install rsyslog

nano /etc/rsyslog.d/logstash-json.conf

template(name="ls_json"
         type="list"
         option.json="on") { constant(value="{") constant(value="\"@timestamp\":\"") property(name="timereported" dateFormat="rfc3339") constant(value="\",\"@version\":\"1") constant(value="\",\"message\":\"") property(name="msg") constant(value="\",\"host\":\"") property(name="hostname") constant(value="\",\"severity\":\"") property(name="syslogseverity-text") constant(value="\",\"facility\":\"") property(name="syslogfacility-text") constant(value="\",\"programname\":\"") property(name="programname") constant(value="\",\"procid\":\"") property(name="procid") constant(value="\"}\n") 
}

nano /etc/rsyslog.conf

*.* @IP_Serveur_Logstash:10514;ls_json

systemctl logstash restart
systemctl elacticsearch restart
systemctl kibana restart

ou 

reboot