SysLog Forwarding for XenServer

DustinB3403

I'm getting stuck at

  ./load.sh

with

Loading dashboards to http://localhost:9200 in .kibana
Loading search Cache-transactions:
curl: (7) Failed connect to localhost:9200; Connection timed out

DustinB3403

You know if I wasn't tired I would've noticed that @scottalanmiller made that a bash file.......

DustinB3403

Sadly the connection timed out still......

I might have to make a clean installation tomorrow and deal with it then. . . .

DustinB3403

And filebeat is not able to be found...

Ok coming back to this from my house where I can work with a beer..

scottalanmiller

Filebeat not found where?

DustinB3403

@scottalanmiller from this continuation here.

https://mangolassi.it/topic/8308/configuring-logstash-and-filebeat-to-send-to-elk-logging-system

scottalanmiller

But you can't find the download?

DustinB3403

@scottalanmiller Correct, when I attempt to run the bash file, I'm responded with filebeat not found from any yum repository.

DustinB3403

I'm starting a clean installation on my personal lab to test with.

Should I bother with the syslog configuration before setting up Elk and LogStash?

scottalanmiller

No. Get ELK up first.

DustinB3403

@scottalanmiller Ok will follow your guide first, and then work on the Elk info.

scottalanmiller

Yeah. That way you know it is working before you make other changes.

DustinB3403

So for everyone looking to do this,

Start here
Then here

And then (and @scottalanmiller I'm asking for confirmation) perform what I posted in the OP.

Correct?

DustinB3403

So on a brand new installation of Centos7 after completing Elk on Cent and then progressing to https://mangolassi.it/topic/8308/configuring-logstash-and-filebeat-to-send-to-elk-logging-system

I get this...

DustinB3403

Same thing with sudo

DustinB3403

What is missing from the second script is

curl -L -O https://download.elastic.co/beats/filebeat/filebeat-1.2.3-x86_64.rpm

sudo rpm -vi filebeat-1.2.3-x86_64.rpm

DustinB3403

So I'm still stumped here....

DustinB3403

Hrm, so I have a clean installation and when I go to the Elk/Logstash Web url I get a login prompt...

But I haven't the slightest idea of what the username password is.

Trying "kibana" and "changeme" results in the prompt asking for credentials again...

DustinB3403

And I'm in.

Now to setup XenServer to send stuff to Kibana.

DustinB3403

OK So I'm in, and apparently logs are getting sent to this VM.... now how do I see them... lol....

So much to learn...