After many days of fighting with gem and bundle surrounding logstash plugins, I can officially say I hate Ruby.

On today's episode of Corporate BS

I must please go update logstash on this server. Okay, so I literally just need to ssh in and run "yum update logstash"

No, I need to apply for temp root access and depending who picks up that ticket, I may have to log a change request

So I was setting up ELK (Elasticsearch, Logstash and Kibana) all in one EC2 on AWS today for demo purposes. I had everything prepared. Elastic IP, correct security group rules, etc.

I figured I would just do quick test before writing filters and templates if I can access Kibana. So I started service for it and tried to open it with Chrome.

Timeout.

Checked config file. Compared it to documentation. Seemed good but changed some things just for sake of change. Restarted service.

Timeout.

Reverted changes I've made in config. Restarted service. Curl on localhost. It work... OK. 😐

It took me half an hour but finally I figured it out after I took my phone and opened it from there. It was working from the beginning. Stupid company network was for some reason blocking this connection. Fuck! 😡And I was restarting that poor service like crazy trying to fix something that wasn't broken.

So I've been given a task to monitor a whole lot of logs of some servers (whole university ~ 10+ departments). The technologies are diverse so I'm cramming everything into elasticsearch via logstash (and filebeat), viewing it into kibana. Any recommendations for what should be the 'useful' stuff to be viewed into dashboard? I guess:
- Overall traffic wtih respect to previous days/weeks
- Most viewed domains
- 200
- 404
- 503
- Failed logins?
- Dropped connections?
- Critical-load of systems? 90%+

I want to understand Linux services better. Most of the time if I want to run a process in the background, I just use nohup and &

And put the commands in either init.d or crontab.

But lately I've seen some more complex scripts where it's called like logstash start/stop which does a free things including recording the PID somewhere?

In Linux terms it seems to be called starting a daemon. But what's the difference, benefit to all this complexity?

Fuck Cyberark

and fuck Logstash

That is all

The jruby jit compiler is trash. 25 minutes for logstash to show signs of life.

After nearly four days of fighting with Ruby, Gem, Bundle and a dash of JRuby just to make a plugin for logstash install, I can officially say I feel like Ken Mattingly.

It is all about the sequence, and a metric ton of RAM and CPU cycles and patience.

Logstash can't find configuration files
:/

++ for everyone who see this bug, sometimes I really wish that we will have types someday...