pschiffe/rsyslog-elasticsearch-kibana repository overview

⁠rsyslog-elasticsearch-kibana

Docker⁠ image for centralized logging based on CentOS 7⁠ with rsyslog⁠, elasticsearch⁠ and kibana⁠.

Contains several pre-configured dashboards for freeIPA⁠ server - User Logins⁠, IPA Server Administration⁠, IPA Server Health⁠, IPA Server Utilization⁠ and SSSD⁠. Screencast is available on youtube⁠. For more information about this effort and how to configure FreeIPA servers and clients to send proper logs to this container, visit this page⁠.

To get this image, pull it from docker hub⁠:

$ docker pull pschiffe/rsyslog-elasticsearch-kibana

Or, if you want to build this image yourself, clone the github repo⁠ and in directory with Dockerfile run:

$ docker build -t <username>/rsyslog-elasticsearch-kibana .

To run the image use:

$ docker run -d -p 514:514 -p 514:514/udp -p 5601:5601 -v /etc/localtime:/etc/localtime:ro pschiffe/rsyslog-elasticsearch-kibana

Rsyslog listens on standard port 514 (both TCP and UDP) and kibana on TCP port 5601. To forward log messages from your system, configure rsyslog according to this recipe⁠ with appropriate address of running container. To test the running container from the host system you can use:

$ logger -n localhost 'log message from host'

Kibana is available via regular web browser on http://localhost:5601⁠ address from the host system. Please note, that it can take up to 10 seconds for container to be ready after start.

Elasticsearch is storing data in docker data volume⁠ /var/lib/elasticsearch.