Skip to content

elk Server setup for BIG-IP logging - Service Provider Modules

License

Notifications You must be signed in to change notification settings

jarrodlucia/bigip_elk_server

Repository files navigation

BIG-IP ELK Server Install

Setup for elk Server setup for BIG-IP logging

Base Install

install completed on LXC Ubuntu 16.04

  • ubuntu_base_install file for base setup

Elasticsearch Install

#Elastic Search Setup

  • ubuntu_elastic_install

Kibana Install

#Kibana Install and Server setup

  • ubuntu_kibana

Logstash Install

#Logstash Install

  • ubuntu_logstash

#Additional Plug-ins

  • sudo /usr/share/logstash/bin/logstash-plugin install logstash-filter-geoip
  • sudo /usr/share/logstash/bin/logstash-plugin install logstash-filter-dns

Prepare Elasticsearch templates

#Install Index Templates into Elastic Search for the required modules

Prepare F5 for Logging

#Configure F5 BIG-IP to Send data

  • Pool = tcp server:5514 - PEM
  • Pool = tcp server:5515 - DNS
  • Pool = tcp server:5516 - AFM/CGNAT

Confirm Data on server and indexes

#Check that Data is arriving in the Index curl 'localhost:9200/_cat/indices?v'

  • health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
  • yellow open pem-2017.01.18 -drykpvETBK0wVN3dKTDxw 5 1 526 0 1.5mb 1.5mb
  • yellow open .kibana da8KKtaLS12mpj9bm7Izig 1 1 1 0 3.1kb 3.1kb

Configure Indexes in Kibana

#Configure Indexes in Kibana

  • index pattern = pem-*

  • select @timestamps

  • index pattern = afm-*

  • select @timestamps

  • index pattern = dns-*

  • select @timestamps

Searches / Visualisation and Dashboards

#Import object data into Kibana

  • Change Index UUID in json
  • Import object json into Kibana

OPTIONAL

Install and Configure NGINX

#Configure nginx for reverse proxy to Kibana

About

elk Server setup for BIG-IP logging - Service Provider Modules

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published