search

freedomofpress / ansible-role-elk

Installs a turnkey ELK stack for log aggregation and analysis, with optional Riemann support for alerting
18 stars 13 forks source link

Use kibana apt repo #39

Closed conorsch closed 8 years ago

conorsch commented 8 years ago

Elasticsearch maintains an apt repo for kibana: https://www.elastic.co/guide/en/kibana/4.5/setup.html#setup-repositories, just as it does for the other components in the ELK stack. The role currently uses a tedious tarball extraction process with symlinks to keep things stable. Upgrades require manually bumping the target version number for kibana.

The apt repo would allow use of unattended-upgrades to manage kibana, same as we're doing for elasticsearch and logstash. Will require significant testing, but at the cost of less maintenance going forward.

ageis commented 8 years ago

I'll document stuff as I go.

Kibana deb packages also use /opt/kibana. It looks like this installs cleanly on top of what we already have, since the layout of the source tree is all the same, but it's also okay to just blow it away, since the only thing we care about is kibana.yml Before installing the symlink should be destroyed and converted to a dir i.e.

cd opt && rm kibana + mv kibana-4.4.1-linux-x64 kibana

There's one minor commented diff in /config/kibana.yml besides these settings:

-# elasticsearch.requestTimeout: 300000
+# elasticsearch.requestTimeout: 30000

The path to node is the same so no updates to paxctld.conf are necessary.

The systemd service definition was not changed, but it's compatible with the new setup. Instead, there's a new file at /etc/init.d/kibana. The logging to /var/log/kibana.log is the same.

I'm using the Kibana installed via apt on a test logserver. It just works. All the data is there. No issues that I can see at all!

Now I'll start working on a new branch in this repository.

conorsch commented 8 years ago

Closed via #45.