Image for post
Image for post
ELK stack, powered by Vorteil, running on AWS

NOTE: I’m using the Vorteil Open Source Toolkit and the following GitHub vorteil-elk repo

  • The ability to destroy an replace machines / applications in place.
  • Upgrades — a big NO!

The ask

So a challenge set to us by a prospective customer was to create a “stateless machine” for the ELK stack:

  • It needed to be small, as they would be deploying a LOT of small instances
  • It had to be fast and resource efficient
  • No upgrades on running machines — destroy and replace

Getting the ELK stack on Vorteil

If you’ve been following all the articles you would know that I tend to choose the easy way out ... this was the exception.

This time though — I built the machine from scratch.

How did I start?

  1. Download LogStash Linux generic, unzip to same directory
  2. Download Kibana Linux generic, unzip to same directory
$ vorteil projects import-shared-objects

Making it “stateless”

Since we’re also going to be building a “stateless” machine (we will test this by destroying the machine and rebuilding it), I’m using NFS to store ElasticSearch data, Logstash data and Kibana configurations:

  • $ES_HOME/data for data storage
  • $ES_HOME/logs for log files
  • $LOGSTASH_HOME/data for data storage
  • $LOGSTASH_HOME/logs for log files
  • $KIBANA_HOME/data for data storage
Image for post
Image for post
NFS file mapping for ELK stack

A simple Logstash pipeline

Next I created a simple TCP listener (port 10100) with the following logstash configuration:

The NFS share

This was pretty simple — I just created an NFS share on AWS Elastic File Services:

Image for post
Image for post
AWS EFS file share created
Image for post
Image for post

The VCFG file

Finally, my Vorteil configuration file has all the NFS shares and components mapped and ready to go!

Provision to AWS

Create the AMI

Let’s configure the Vorteil open source toolkit AWS provisioner:

./vorteil provisioners new amazon-ec2 aws.conf -k <KEY> -s <SECRET> -b <BUCKET>
./vorteil images provision . ../aws --name elk-stack
Image for post
Image for post
AMI provisioned for use in AWS

Create a AWS machine:

  • t2-medium sized machine (2 CPUs, 4GB memory)
  • 3 GB storage
Image for post
Image for post
AWS instance created, NFS mounted and ELK running
Image for post
Image for post

Inject some data

So for the next step, all we did was inject some data into the running ELK stack by starting up a couple of Vorteil machines on my local Mac with the following configuration:

[[logging]]
config = ["Name=tcp" , "Host=ec2-13-54-93-76.ap-southeast-2.compute.amazonaws.com", "Port=10100", "Format=json", "tls=Off"]
type = "system"

[[logging]]
config = ["Name=tcp" , "Host=ec2-13-54-93-76.ap-southeast-2.compute.amazonaws.com", "Port=10100", "Format=json", "tls=Off"]
type = "kernel"
[[logging]]
config = ["Name=tcp" , "Host=ec2-13-54-93-76.ap-southeast-2.compute.amazonaws.com", "Port=10100", "Format=json", "tls=Off"]
type = "programs"
Image for post
Image for post
containerd.log file in the ELK stack

DESTROY and REBUILD!

Moment of truth:

  1. Create a new machine from the AMI
  2. See if logging and configurations persist!?
Image for post
Image for post
ELK stack didn’t skip a beat

What I have is the following …

Something simple to deploy ELK:

  • All of my configuration files, data and log files stored on an NFS server (this could also have been a separate mount point — doesn’t need to be NFS)
  • Upgrades to ALL components are as simple as downloading the latest version and extracting it
Image for post
Image for post
Easy

Written by

I came from LinkedIn … after writing and publishing SO many articles which never got indexed by the search engines … here is the Vorteil.io vault of knowledge!

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store