ELK install

elkinstall.sh

yum install -y telnet vim wget
yum install -y java-1.7.0-openjdk
rpm --import http://packages.elasticsearch.org/GPG-KEY-elasticsearch
cat <<EOF > /etc/yum.repos.d/elasticsearch.repo
[elasticsearch-1.4]
name=Elasticsearch repository for 1.4.x packages
baseurl=http://packages.elasticsearch.org/elasticsearch/1.4/centos
gpgcheck=1
gpgkey=http://packages.elasticsearch.org/GPG-KEY-elasticsearch
enabled=1
EOF
cat <<EOF > /etc/yum.repos.d/logstash.repo
[logstash-1.4]
name=logstash repository for 1.4.x packages
baseurl=http://packages.elasticsearch.org/logstash/1.4/centos
gpgcheck=1
gpgkey=http://packages.elasticsearch.org/GPG-KEY-elasticsearch
enabled=1
EOF
cat <<EOF > /etc/yum.repos.d/nginx.repo
[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/rhel/6/x86_64/
gpgcheck=0
enabled=1
EOF
yum clean all
rpm -ivh http://download.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
yum install -y logstash logstash-contrib redis


#Update Redis config
vi /etc/redis.conf

##change bind 127.0.0.1 to 0.0.0.0, on line 31
#bind 0.0.0.0

#restart redis
sudo service redis start

#test redis
redis-cli -h localhost
#send 'PING'
##you should recieve a 'PONG' response


#test redis on telnet
telnet localhost 6379
#send 'PING'
##you should recieve a 'PONG' response


#Install elasticsearch
sudo yum install -y elasticsearch
sudo service elasticsearch start

#edit the elasaticsearch
vi /etc/elasticsearch/elasticsearch.yml
##uncomment and change cluster.name (line 32) and node.name (line 40)
#cluster.name: sbxelk
#node.name: "SBX ELK Central Server"


#Restart elasticsearch
sudo service elasticsearch restart

#Install nginx
sudo yum install nginx -y

#download kibana
cd /tmp
wget https://download.elasticsearch.org/kibana/kibana/kibana-3.1.2.tar.gz
tar zxf kibana-3.1.2.tar.gz
sudo mv kibana-3.1.2 /usr/share/nginx/html/kibana
sudo service nginx start
cat <<EOF > /etc/logstash/conf.d/logstash.conf
input {
  redis {
    host => "127.0.0.1"
    type => "redis-input"
    data_type => "list"
    key => "logstash"
  }
}
output {
  stdout { }
  elasticsearch {
    protocol => "http"
    host => "127.0.0.1"
    cluster => "elklogstash"
 }
}
EOF
echo "" >> /etc/elasticsearch/elasticsearch.yml
echo "http.cors.allow-origin: \"/.*/\"" >> /etc/elasticsearch/elasticsearch.yml
echo "http.cors.enabled: true" >> /etc/elasticsearch/elasticsearch.yml
sudo service elasticsearch restart
sudo service logstash restart