Setup & Configuration

The Elasticsearch module is included with the Atatus Infra agent by default, please follow the below steps to enable.

  1. Add the following lines in the file /etc/atatus-infra-agent/atatus.yml.

    copy
    icon/buttons/copy
    logs_enabled: true
    
  2. Copy the Elasticsearch example configuration file.

    copy
    icon/buttons/copy
    cd /etc/atatus-infra-agent/conf.d/elasticsearch.d/
    sudo cp elasticsearch.yml.template elasticsearch.yml
    
  3. Update the file /etc/atatus-infra-agent/conf.d/elasticsearch.d/elasticsearch.yml with below configurations.

    copy
    icon/buttons/copy
    #Log section
    logs:
    
      # - type : (mandatory) type of log input source (audit / deprecation / gc / server / slowlog)
    
      - type: audit
      - type: deprecation
      - type: gc
      - type: server
      - type: slowlog
    
    copy
    icon/buttons/copy
    # If you have custom elasticsearch log path, you can use below syntax
    
      # - type: (mandatory) type of log input source (audit / deprecation / gc / server / slowlog)
      #   paths: (mandatory) Set paths if type is file
      #   service: (mandatory) name of the service owning the log
      #   source: (mandatory) attribute that defines which integration is sending the log
    
    #Log section
    logs:
       - type: audit
         paths:
            - /path/to/audit/*.log
         source: elasticsearch
         service: elasticsearch
       - type: deprecation
         paths:
            - /path/to/deprecation/*.log
         source: elasticsearch
         service: elasticsearch
       - type: gc
         paths:
            - /path/to/gc/*.log
         source: elasticsearch
         service: elasticsearch
       - type: server
         paths:
            - /path/to/server/*.log
         source: elasticsearch
         service: elasticsearch
       - type: slowlog
         paths:
            - /path/to/slowlog/*.log
         source: elasticsearch
         service: elasticsearch
    
  4. Restart the atatus infrastructure agent.

    copy
    icon/buttons/copy
    sudo service atatus-infra-agent restart