How to set elastic alert on amazon elasticsearch - elasticsearch

I've been looking for a tutorial that I can get alerts from amazon elasticsearch.
I'm using metricbeat in my server instance to collect logs everything is fine but now I have to find a way to send alert for my memory and cpu, I read something about elastic alert to send alert to e-mail or slack but I don't know how to use it on amazon elasticsearch.
If anybody has a tutorial that help me.
Thanks in advance.

You need x-pack to be able to configure watchers to send email or Slack alerts. But, AWS Elasticsearch does not offer x-pack features. For this exact reason we moved away from AWS Elasticsearch to Elastic Cloud and we couldn’t be happier.

Related

Cloudfoundry logs to Elastic SAAS

In the documentation of Cloudfoundry, the Elastic SAAS service is not mentioned
https://docs.cloudfoundry.org/devguide/services/log-management-thirdparty-svc.html
So was wondering if anyone has done it and how?
I know one way is to use a logstash instance in cf, feed the syslog to it and then ship it to Elastic. But just wondering if there is a direct possibility to skip the logstash deployment on cf?
PS. We also log using the ECS format.

Elasticsearch as a service for GCP

As far as I'm aware, there are no managed elasticsearch solutions provided by Google Cloud Platform, such as there is Amazon Elasticsearch Service on AWS.
I've opened a feature request ticket for this on the issue-tracker here, but I was wondering if there is a service somewhere on GCP that I'm missing? If not, are there plans to build an ES service on top of GCP? And if so, is there a general timeline on when that will be GA?
When configuring your cluster on ES Cloud (the cloud operated by Elastic Inc), you have the choice between hosting it on AWS or on GCP. If you pick GCP, the cluster is fully managed by Elastic on GCP.
This is a commercial feature (but AWS Elasticsearch is too), but you have a 14 days free trial to see how it looks like.
Also worth reading:
https://www.elastic.co/blog/hosted-elasticsearch-services-roundup-elastic-cloud-and-amazon-elasticsearch-service
https://www.elastic.co/aws-elasticsearch-service
Thank you for creating a feature request!
Regarding Elasticsearch on GCP, I am not 100% sure if it will apply for your case but there is a solution on Google Marketplace. It is Elasticsearch Service on Elastic Cloud offered by Google on GCP. Check it out and see if you can use it.

Kibana, how can I ignore query strings?

I have configured a Kibana using AWS infrastructure. I'm using AWS CloudWatch Logs and AWS ElasticSearch which contains Kibana software. As you can imagine, I'm uploading all my logs to Kibana.
I'm trying to obtain a list of the most traffic URL's omitting query strings... but I don't know if this is possible.
Can you help me? I've search it on Google and on Elastic documentation, but I didn't found anything.
Here is an example:
Suppose that I have the following URL's:
abc.com/helloWorld.html?param=1
abc.com/helloWorld.html?param=2
abc.com/helloWorld.html?param=3
abc.com/bye.html?anotherParam=1
I want to see the following URL's in order to compute the sum of requests per file. Is it possible?
abc.com/helloWorld.html
abc.com/helloWorld.html
abc.com/helloWorld.html
abc.com/bye.html
Thanks,

ServiceNow integration with Elasticsearch

We are using ELK to monitor the system performance and our application logs. If there is an error in the logs, we want to create an issue in ServiceNow from ELK. Is there a way to do this? Any pointers would help.
I don't know about ELK specifically, but perhaps you could make a SOAP/REST call to do it?
Just make sure your ELK service account has sufficient permissions, and get the WSDL by going to http://yourinstance.service-now.com/tablename.do?WSDL

Read Zabbix events to Elastic Search

I am trying to integrate Zabbix with Elastic Search through logstash and further generate dashboard on Kibana. Now there are many links which suggest it is possible to monitor elasticsearch through Zabbix but not the other way around.
http://logstash.net/docs/1.4.2/outputs/zabbix
Now I got one link which suggests zabbix servers can be monitored. I followed the same but not success
http://philippe.lewin.me/2014/10/06/send-zabbix-events-to-logstash/
I need some help to understand the possibilities and probable some workarounds.
OP, are you still having the same problem? I also am looking for a way to send my zabbix snmp event data to Elastic Search.
True, the plugins out there are helping the other way around though
I will try phillipe's way later, if all else fail, probably i will try to migrate specific table(s) with another tools directly like Logstash for example

Resources