Well, We are going to make a series of documents where I am going to show you the necessary steps to have a fully skilled and functional real-time monitoring solution. We will base ourselves on the multiple options that the mythical Elastic Stack will give us, made up of Elasticsearch-type tools, Logshtash, Kibana and of course Beats packs. There will be a few posts, I hope you enjoy them, Let's freak out 😉

What I said, The series of posts will be based on:

• Elasticsearch: It is the database, is a data manager and distributed warehouse.
• Logstash: It is the log manager, process the information you collect for us and store it in Elasticsearch.
• Kibana: It will help us visualize and interpret Elasticsearch data in a graphical way.
• Grafana: Like Kibana, Grafana is a data visualizer. It will be this one, which I personally chose when showing you the posts.
• Beats: They are a set of utilities that we will see that serve as information collectors and will send it to Elasticsearch or Logstash:
  • Winlogbeat: We will use it to monitor the Event Viewer of Windows computers.
  • Metricbeat: To get metrics and statistics of any kind on any computer.
  • Filebeat: Mainly to process logs or data based on text files.
  • Packetbeat: Real-time network packet analyzer.
• Watcher: It's an Elasticsearch plugin that will enable us if we're interested in the whole topic of notifications.

¿What are we going to do? GOOD, As I tell you, in a series of posts, we'll look at the installation of Elasticsearch, Installing Logstash, Kibana installation all in one machine, that we can choose to separate resources; all this will depend on each environment, or segregate a posteriori. Grafana We already have a post How to install, so those who need it can rely on it.

Well, after having the core installed, We will see examples of how to monitor different elements, Using different options you will get ideas for your environment, Let's see a little bit of all kinds of services and equipment, all of them will be visualized with Grafana, We will see how in a fairly simple way we can have maps in real time and with refreshes every 1 second of network traffic, events on Windows computers, CPU metrics, RAM, Disks, Loads, Apache Server Logs, IIS… World maps geolocating accesses…