So that we have something more interesting to query through the elastic data source, the next two videos
or so fall bait and metric bait collector.
Those are the most common connectors that you'll find for ElasticSearch, so I'll quickly show you how
to set those up.
Also, this is not a course in ElasticSearch, but I'm just showing you enough to get started so we
can install bait on any server.
We like Linux, Windows or Mac.
I'm going to install on one of the existing servers.
I'll put it on my my SQL server and we'll collect stats about the module server involved.
But it's good for reading log files, so consider the ElasticSearch file bait.
The equivalent of Prob Tile is for Loki, so we'll set that up to rate the system date logs.
I'm a mosque.
Your server, OK, so I'm going to need to install fall bait.
I'm going to install seven point sixteen, so I'm going to go to my mosque.
Your server, among my mosques, your server, router, mosque, you're down there.
You can get the download information for your operating system from this link here.
Barberry prepared those commands.
So first one kill.
Downloading the Debian package, I'm now going to use the package manager to install it.
OK, so that's the story.
It shouldn't be running sudo service for its status.
OK, so it's not running.
Doesn't matter.
We'll make some changes to it.
Okay, so see into the file system 8C file, but that's where it was installed.
OK, so Ellis LRH, so we can see what's there.
OK, so now we need to enable a module for fall break to run.
We can get a list of modules that it knows about so far eight modules list and it's got a whole bunch
of configurations that we can enable such a system which will use that moment Radius Rabbit, MQ, Postgres
many, many things.
But if you scroll up, you'll see that they're all under the disabled heading there.
We're going to enable system so far based modules enable system into.
OK, enabled system, if we look at that again.
Fobbit modules list, if I scroll up, it shows under enabled system we can enable several modules,
but I'm only going to use the system one if we could list like again there and we go into that module
state folder there.
So CD modules D and then do lists that we can see a whole bunch of files or configuration files y.
They will have the word disabled after them system.
My email doesn't.
We can inspect all of those different configuration files and see what they do if you want.
For example, I can look at the system, one system, my email, and that's what it says.
So if you want to know more about the details of ElasticSearch file beat, there's something to look
at there.
So I'm going backwards city dot dot lists again to see what we have.
OK, I'm now going to change some settings and folbigg voicemail to tell it to send data to ElasticSearch
server, so we don't need no file bait.
Why eml OK for scroll down.
You see, there's going to be searching the VAR log log folder there.
OK.
For bait.
OK, this is a fall beats module S. You can see that it's searching the Modules Deep folder for everything
startup y amount to find out what's enabled.
I'm not going to be using Cabana Cabana is like a user interface with Agraféna, but for ElasticSearch.
OK, I put plastic surgery, this is where we tell it the address of our ElasticSearch server.
I'm using the VPC IP, so my ElasticSearch servers IP is 10 one three three zero six.
So this fallback wearing my mask, your server will be sending to that address, calling nine 200.
Now I have a firewall on my ElasticSearch server, so I won't be able to send those messages, but I'll
enable that in a moment.
OK.
Right now, I don't need that that or that either, but you could leave those if you wanted to see what
I do, they add a whole lot of extra items into the result set, which are unnecessary unless you're
actually using them.
So going further down right to the end, OK, good control x save.
Yes.
And so now let's start Fobbit sudo service Volbeat start status.
Very, very good.
OK, so now it's running.
It's trying to send data to the ElasticSearch server.
ElasticSearch server has the firewall blocked?
I can verify that by trying to do a kill request to it from the command line.
So it's just going to timeout, eventually control.
See that?
OK, so now I'm going to go into my firewall settings from ElasticSearch server and allow my mosque
email server to make requests on Port nine to 100.
So my master your server's IP is 10 one three three zero four.
So copying that firewall ElasticSearch firewall, OK, I'm going to also allow you to edit that rule,
going to allow that IP address as well so that zero three, that's mega-fauna server making queries
to port ninety one and this zero four is my mosque.
Your server sending data to not to save?
Excellent going back on here and store that kill request again.
OK.
Got a response!
OK, so that's a default response from my ElasticSearch server named Node one with a cluster name.
My application.
Now, Volbeat has created its own index.
So in the video before I credited an index called Index one manually and added some data to fall is
doing essentially the same thing, but it's creating its own index and adding its own data.
We can find out what the index name is using on the school indices there, and that new index is called
Volbeat 7:16, plus today's date.
So I'm going to set up a new data source in Gravano looking at that index.
OK, go to data sources now.
I could edit my existing ElasticSearch data source because I don't need the index one, really, but
instead I'm going to create a data source ElasticSearch and I'm going to call this ElasticSearch.
I'll be the address.
I'm using my BBC IP address column.
Nine 9200 server.
OK, very good.
My index name.
If I look here when I queried indices, it says Volbeat and all those numbers, actually, we can use
Volbeat and a wildcard.
So I'm the fallback 7:16 and Dot star.
I could cite seven star or fall star power to say that Dot star now, if I could set up followed by
another service, they'll all have a very similar index name.
So this data source I'm setting up here names that will actually read all of the indexes starting with
that.
OK, so that's good.
I'm also using seven 10 plus.
That's important.
OK, save and test index.
OK, excellent.
Let's go to the Explore tab or select ElasticSearch Volbeat and we can see some data.
So there's a lot of information coming through already.
If we look at the logs row there and I'll just make that query smaller.
Five minutes, we can see lots of data coming through.
We can expand each of these rows and see a whole lot of information.
OK, so a hostname that's coming through is Moscow.
If I had lots of fall bits running or pushing to the ElasticSearch server and using a index prefixed
with 716, I would say all of those as well, and I'll be able to filter by hostname.
So, for example, hosts not name.
My ask will shift into and not only get the results for my school, but I only store on my school,
so I'm getting the same results anyway.
But anyway, that's just a quick introduction to fall bait.
We could start crying dashboards from that, but I'm not going to do that yet.
I'm just demonstrating how to get some useful ElasticSearch data into a farm case.
This is what we have for.
I've installed that on my MySchool server.
I could install that in all my servers if I wanted to.
You can do the same.
I'm not going to do that just yet.
In the next video, I'm going to install metric based on another server and demonstrate carrying that
through ElasticSearch data source as well.
Excellent.