es, kibana

elk.md

On Mac

brew install elasticsearch kibana heartbeat metricbeat filebeat

test elasticsearch

the elasticsearch installed by homebrew is oss version (without x-pack)

echo "network.host: 0.0.0.0" >> sudo tee -a /usr/local/etc/elasticsearch/elasticsearch.yml

curl -X GET 'http://localhost:9200'

test kibana

open http://localhost:5601/status

send data to elasticsearch

brew services start heartbeat
brew services start metricbeat
brew services start filebeat

create some index pattern in Kibana on Kibana UI or use api

url="http://localhost:5601"
time_field="@timestamp"
index_pattern="heartbeat-*"
id="heartbeat-*"

curl -f -XPOST -H "Content-Type: application/json" -H "kbn-xsrf: anything" \
  "$url/api/saved_objects/index-pattern/$id?overwrite=true" \
  -d"{\"attributes\":{\"title\":\"$index_pattern\",\"timeFieldName\":\"$time_field\"}}"

url="http://localhost:5601"
time_field="@timestamp"
index_pattern="metricbeat-*"
id="metricbeat-*"

curl -f -XPOST -H "Content-Type: application/json" -H "kbn-xsrf: anything" \
  "$url/api/saved_objects/index-pattern/$id?overwrite=true" \
  -d"{\"attributes\":{\"title\":\"$index_pattern\",\"timeFieldName\":\"$time_field\"}}"

url="http://localhost:5601"
time_field="@timestamp"
index_pattern="filebeat-*"
id="filebeat-*"

# Create index pattern
curl -f -XPOST -H "Content-Type: application/json" -H "kbn-xsrf: anything" \
  "$url/api/saved_objects/index-pattern/$id?overwrite=true" \
  -d"{\"attributes\":{\"title\":\"$index_pattern\",\"timeFieldName\":\"$time_field\"}}"

# Create Index Pattern
# For kibana 6.0+ using curl and jq:

#!/usr/bin/env bash
# From https://github.com/elastic/kibana/issues/3709
# set -euo pipefail

url="http://localhost:5601"
index_pattern="heartbeat-*"
id="heartbeat-*"
time_field="@timestamp"

# Create index pattern
# curl -f to fail on error
curl -f -XPOST -H "Content-Type: application/json" -H "kbn-xsrf: anything" \
  "$url/api/saved_objects/index-pattern/$id?overwrite=true" \
  -d"{\"attributes\":{\"title\":\"$index_pattern\",\"timeFieldName\":\"$time_field\"}}"

# Make it the default index
curl -XPOST -H "Content-Type: application/json" -H "kbn-xsrf: anything" \
  "$url/api/kibana/settings/defaultIndex" \
  -d"{\"value\":\"$id\"}"

List and search kibana index pattern

http://localhost:5601/api/saved_objects/_find?type=index-pattern&search_fields=title&search=*


http://localhost:5601/api/saved_objects/_find?type=index-pattern&search_fields=title&search=metricbeat-&fields=id&fields=title