Integration with Icinga2 with ELK

sabil05 commented 2 years ago

HI @bobapple,

Hope you are doing good.

I am not sure this is the right platform to ask for help. Please excuse me for that.

@bobapple I need your suggestion/assistance here.

I want to integrate the ELK with Icinga2 monitoring.

About my ELK setup. I have docker-compose.yml file running on a host which has ELK stack. I am using Filebeat container running on other server to ship the logs to ELK stack. We have used Docker Container for ELK stack and filebeat.

Now I wanted to integrate the ELK with Icinga2. I have performed following steps on the host where our ELK stack is running using docker.

I have enable the "elasticsearch" module.
When I am trying to configure the Elasticsearch using Icingaweb2, I am not getting the configure option in icingaweb2. Here is the doc I am referring https://github.com/Icinga/icingaweb2-module-elasticsearch/blob/master/doc/03-Configuration.md
Icingabeat is also required to integrate the ELK with Icinga?
Prerequisites to do integration with ELK

Requesting to you to kindly provide me your inputs/suggestion on this how to achieve the integration with ELK

Thank you in advance!

Regards, Sabil.

bobapple commented 2 years ago

HI @sabil05,

there are different ways how you could connect Icinga to ELK. Here's a brief overview over currently available options:

Icingabeat

https://github.com/icinga/icingabeat Icingabeat connects to Icinga 2 and collects the Eventstream. This can include data about state changes, notifications, downtimes and many more. Icingabeat behaves the same way like other beats: It can store the collected data in Elasticsearch or forward it to Logstash etc.

Icinga Module for Elasticsearch

https://github.com/icinga/icingaweb2-module-elasticsearch This module is an extension for the Icinga Web interface. It connects to an existing Elasticsearch server and displays the data within Icinga Web. You can create filters and so on. To be honest, I'm not sure if the module is compatible with current Elasticsearch versions. If you figure out it does not I would recommend to open an issue on the project: https://github.com/Icinga/icingaweb2-module-elasticsearch/issues

Icinga 2 Elasticsearch Writer

https://icinga.com/docs/icinga-2/latest/doc/14-features/#elasticsearch-writer Enabling the Elasticsearch feature in Icinga 2 will store metrics and other data collected by Icinga 2 into Elasticsearch.

Logstash Output Plugin for Icinga

https://github.com/logstash-plugins/logstash-output-icinga With this Logstash plugin, Logstash can set host and service states in Icinga 2 (also Downtimes, Acknowledgements, Notifications, ...). Additionally, Logstash could dynamically create hosts and services in Icinga 2.

sabil05 commented 2 years ago

Hi @bobapple,

Thank you so much for the explanation. I will go thorough the document and see which one is feasible to go with.

Thank you once again.

Regards, Sabil.

Icinga / icingabeat