This topic provides systematic instructions to start Elastic Search.

1. Navigate to Elasticsearch root folder.
2. Use nohup to start the Elasticsearch process.

   > nohup ./bin/elasticsearch

This topic provides the systematic instructions to setup and start Logstash.

1. Create a new logstash.conf file that provides the required file parsing and integration for Elasticsearch.
   logstatsh.conf:

   #Point to the application logs
   input {
    file {
     type => "java"
     path => "/scratch/app/work_area/app_logs/*.log"
     codec => multiline {
      pattern => "^%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}.*"
      negate => "true"
      what => "previous"
     }
    }
   }
   #Provide the parsing logic to transform logs into JSON
   filter {
    #If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
    if [message] =~ "\tat" {
     grok {
      match => ["message", "^(\tat)"]
      add_tag => ["stacktrace"]
     }
    }
   
    #Grokking Spring Boot's default log format
    grok {
     match => [ "message",
                "(?<timestamp>%{YEAR}-%{MONTHNUM}-%{MONTHDAY}
   %{TIME}) %{LOGLEVEL:level} %{NUMBER:pid} --- \[(?<thread>[A-Za-z0-9-]+)\] [A-Za-z0-9.]*\.(?<class>[A-Za-z0-9#_]+)\s*:\s+(?<logmessage>.*)",
                "message",
                "(?<timestamp>%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{LOGLEVEL:level} %{NUMBER:pid} --- .+? :\s+(?<logmessage>.*)"
               ]
    }
     # pattern matching logback pattern
     grok {
            match =>
    { "message" => "%{TIMESTAMP_ISO8601:timestamp}\s+%{LOGLEVEL:severity}\s+\[%{DATA:service},%{DATA:trace},%{DATA:span},%{DATA:exportable}\]\s+\[%{DATA:environment}\]\s+\[%{DATA:tenant}\]\s+\[%{DATA:user}\]\s+\[%{DATA:branch}\]\s+%{DATA:pid}\s+---\s+\[%{DATA:thread}\]\s+%{DATA:class}\s+:\s+%{GREEDYDATA:rest}"
    }
      }
      #Parsing out timestamps which are in timestamp field thanks to previous grok section
      date {
       match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss.SSS" ]
      }
     }
     #Ingest logs to Elasticsearch
     output {
      elasticsearch { hosts => ["localhost:9200"] }
      stdout { codec => rubydebug }
     }

2. Start the Logstash process using below command.

   >nohup ./bin/logstash -f logstash.conf

This topic provides the systematic instructions to setup and start Kibana.

1. Navigate to the kibana.yml available under <kibana_setup_folder>/config.
2. Modify the file to include the below:

   #Uncomment the below line and update the IP address to your host machine IP.
   server.host: "xx.xxx.xxx.xx"
   #Provide the elasticsearch url. If this is running on the same machine then you can use the below config as is
   elasticsearch.url: "http://localhost:9200"

3. Start the Kibana process using the below command.

   >nohup ./bin/kibana

   Figure 2-4 Kibana Dashboard

   
   

   
   Description of "Figure 2-4 Kibana Dashboard"