Deploy ELK bundle and use it cross model

In case you deploy the charm store bundle please note that if the flavor of your destination machine is less than 2GB an error could occur due to java filling the memory and not allowing the elasticsearch process to start.

In this case you need to:

• juju remove-machine –force <elasticsearch machine id>

• juju add-machine –constraints mem=8G

• juju add-unit elasticsearch –to <new machine id>

then keep following the instructions on the bundle page

DRAFT: after deploying you need a few manual steps:

• juju run-action kibana/0 load-dashboard dashboard=beats

• juju expose kibana

DRAFT: deploy the filebeat client on the models you wish to monitor

• juju deploy xenial/filebeat

• juju add-relation filebeat:beats-host kubernetes-worker (for example)

• juju config filebeat logpath

SINGLE MODEL

• juju add-relation filebeat logstash

CROSS MODEL

from the logstash model:

• juju offer logstash:beat

• Application “logstash” endpoints [beat] available at “admin/<modelname>.logstash”

• juju offers

• Offer User Relation id Status Endpoint Interface Role Ingress subnets

• logstash -

• juju set-firewall-rule juju-application-offer –whitelist cidr -m <modelname>

• juju consume admin/<elk model>.logstash elk

• juju status -m <modelname>

• SAAS Status Store URL

• elk active GAAS-garr-ct1 admin/attardi.logstash

cloud O~S

• you need to open the ingress traffic to port 5044 on the VM where logstash is deployed