ansible-collection-elk VS docker-elk

git clone https://github.com/garutilorenzo/ansible-collection-elk.git cd nsible-collection-elk/ vagrant up Bringing machine 'elk-ubuntu-0' up with 'virtualbox' provider... Bringing machine 'elk-ubuntu-1' up with 'virtualbox' provider... Bringing machine 'elk-ubuntu-2' up with 'virtualbox' provider... Bringing machine 'elk-ubuntu-3' up with 'virtualbox' provider... Bringing machine 'elk-ubuntu-4' up with 'virtualbox' provider... Bringing machine 'elk-ubuntu-5' up with 'virtualbox' provider... [...] [...] elk-ubuntu-5: Inserting generated public key within guest... ==> elk-ubuntu-5: Machine booted and ready! ==> elk-ubuntu-5: Checking for guest additions in VM... elk-ubuntu-5: The guest additions on this VM do not match the installed version of elk-ubuntu-5: VirtualBox! In most cases this is fine, but in rare cases it can elk-ubuntu-5: prevent things such as shared folders from working properly. If you see elk-ubuntu-5: shared folder errors, please make sure the guest additions within the elk-ubuntu-5: virtual machine match the version of VirtualBox you have installed on elk-ubuntu-5: your host and reload your VM. elk-ubuntu-5: elk-ubuntu-5: Guest Additions Version: 6.0.0 r127566 elk-ubuntu-5: VirtualBox Version: 6.1 ==> elk-ubuntu-5: Setting hostname... ==> elk-ubuntu-5: Configuring and enabling network interfaces... ==> elk-ubuntu-5: Mounting shared folders... elk-ubuntu-5: /vagrant => C:/Users/Lorenzo Garuti/workspaces/simple-ubuntu ==> elk-ubuntu-5: Running provisioner: shell... elk-ubuntu-5: Running: inline script ==> elk-ubuntu-5: Running provisioner: shell... elk-ubuntu-5: Running: inline script elk-ubuntu-5: hello from node 5

This ansible collection will install and configure a high available a high available Elasticsearch cluster.

Hello everyone! I am trying to get started with ELK and I am facing a very frustrating situation. I am trying to use the stack with Docker Compose. I have tried 2 versions: https://github.com/deviantony/docker-elk and also https://www.elastic.co/blog/getting-started-with-the-elastic-stack-and-docker-compose but they both have the same problem. I inspected the Docker container logs and I get some weird errors:

The waters are further muddied since I started out trying to spin up a docker instance https://github.com/deviantony/docker-elk but I found the config for docker is setup with a different layout, for example with logstash there is no conf.d directory, and pipelines are layed out differently, making it more challenging to use web examples. Overall I've tried many config examples and all have failed.

This is the github project conainer I'm trying to create a stack with: https://github.com/deviantony/docker-elk

Here's a quick way to get your hands into an elasticstack using docker-compose: https://github.com/deviantony/docker-elk

Essentially I've got 2 sets of standard JSON files that I'm trying to ingest into a dockerized ELK stack. The first set was downloaded cloudflare logs, standard line separated JSON data, tried to use Filebeat to ingest and it kept prefixing the JSON data with some dumb ECS event data, basically exactly what this post describes if its easier to see in pics. All of the cloudflare data was nested within the event.original field and would not get mapped. But once I tried to use just logstash directly, it was fine and mapped correctly and no more event data.

i use the elk into the docker,using the docker-elk compose , the logstash logs shows that it is reciving the logs:

It depends on what you want to get out of visualizing your logs. I use the combination of Elastic + Logstash + Kibana (ELK Stack) on docker to visualize things like

I did end up kinda Frankensteining this project and docker-elk. Basically took out the entire etc/pfelk directory from pfelk project and added the pipelines/dashboard/groks etc to docker-elk. This works really will for me since I have several other devices that aren’t OPNSense that I wanted ingested to ELK.