weijh imweijh

Send docker logs to ELK through gelf log driver

There's so many way to send logs to an elk... logspout, filebeat, journalbeat, etc.

But docker has a gelf log driver and logstash a gelf input. So here we are.

Here is a docker-compose to test a full elk with a container sending logs via gelf.

IPAM and CMDB software

IPAM

HaCi http://haci.larsux.de/ - 2015-03
- IPAM only, v4/v6, multiple POPs, uses templates, space visualization
GestioIP https://www.gestioip.net/ - 2016-02

Generate ssl certificates with Subject Alt Names on OSX

Open ssl.conf in a text editor.

Edit the domain(s) listed under the [alt_names] section so that they match the local domain name you want to use for your project, e.g.

DNS.1   = my-project.dev

Additional FQDNs can be added if required:

Latency numbers every programmer should know

L1 cache reference ......................... 0.5 ns
Branch mispredict ............................ 5 ns
L2 cache reference ........................... 7 ns
Mutex lock/unlock ........................... 25 ns
Main memory reference ...................... 100 ns             
Compress 1K bytes with Zippy ............. 3,000 ns  =   3 µs
Send 2K bytes over 1 Gbps network ....... 20,000 ns  =  20 µs
SSD random read ........................ 150,000 ns  = 150 µs

Read 1 MB sequentially from memory ..... 250,000 ns = 250 µs

	#!/bin/bash

	if [ $# -lt 2 ]; then
	echo "usage:$0 dev output_dir [iodepth]"
	echo "example 1: Testing the whole block device. Attention: That will destory the filesystem on the target block device"
	echo "./run_fio.sh /dev/sdb fio_test"
	echo ""
	echo "example 2: Testing a file, but not destory filesystem. Suppose the target device mount on /data"
	echo "fallocate -l 1G /data/test.dat"
	echo "./run_fio.sh /data/test.dat fio_test"

	#
	# INPUT - Logstash listens on port 8514 for these logs.
	#

	input {
	udp {
	port => "8514"
	type => "syslog-cisco"
	}

	This page updated : 2016-12-10 21:40

	Google Chrome Portable

	reference:
	Download Google Chrome Portable
	http://portableapps.com/apps/internet/google_chrome_portable

	Google Chrome (for Windows)

	Enhanced NGINX logstash parser:

	NGINX log format:

	log_format enhanced '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent $request_length "$http_referer" "$http_user_agent" $request_time $upstream_response_time';
	access_log /var/log/nginx/access.log enhanced;
	error_log /var/log/nginx/error.log;

	logstash pattern (/opt/logstash/pattern/nginx):

	# ___ ___ __ __
	# / \| __ ______/ (_) /_____/ /
	# / /\| \|/ / / / __ / / __/ __ /
	# / ___ / /_/ / /_/ / / /_/ /_/ /
	# /_/ \|_\__,_/\__,_/_/\__/\__,_/
	#
	# Linux Audit Daemon - Best Practice Configuration
	# /etc/audit/audit.rules
	#
	# Compiled by Florian Roth

	wordlist created from original 41G stash via:

	grep -rohP '(?<=:).*$' \| uniq > breachcompilation.txt

	Then, compressed with:

	7z a breachcompilation.txt.7z breachcompilation.txt

	Size: