# Elasticsearch monitoring

# Introduction

Plugin for ELK server monitoring, last revision 17/04/2019.  
  
ELK is a set of tools composed by Elasticsearch (Lucene based search server), Logstash (log management tool) and Kibana (tool to visualize and explore data).

A powerful text search engine, a log management tool and another to visualize and explore data.

# Compatibility matrix

Developed for Kibana 6.2.4.

# Prerequisites

It requires

- Connection with the Tentacle service associated to your Pandora FMS server (for the remote execution of the plugin) in order to send the data (XML files) generated by the plugin.

Deployment of this plugin by binaries does not require any special requirements.

It requires PandoraFMS library::PluginTools.pm

This library is available with the installation of Pandora FMS OpenSource package.

You can download the latest version from:

[https://github.com/pandorafms/pandorafms/blob/develop/pandora\_server/lib/PandoraFMS/PluginTools.pm](https://github.com/pandorafms/pandorafms/blob/develop/pandora_server/lib/PandoraFMS/PluginTools.pm)

# Configuration

##### **Conection:**

```bash
# ELK Plugin conf file 
# Defines ip server and port of ELK server.
elastic_server=127.0.0.1
elastic_port=9200
```

  
**elastic\_server**  
 IP address or FQDN of the ELK server.  
**elastic\_port**  
 Port where the ELK server listens (9200 by default).

The configuration file of Pandora FMS plugin for ELK allows to execute it in two ways:

##### **Agent:**  


```bash
# ELK Plugin conf file 
# Defines if should be executed as agent or as server plugin, set 0 to execute as server plugin or set 1 to execute as agent plugin. 
as_agent_plugin=1
```

#####   
**Remote:**  


```bash
# ELK Plugin conf file 
# Defines if should be executed as agent or as server plugin, set 0 to execute as server plugin or set 1 to execute as agent plugin. 
as_agent_plugin=0
```

  
**as\_agent\_plugin**  
 1 to execute as agent plugin.  
 0 to execute as remote plugin.

If the plugin is to be executed remotely, it is necessary to configure the following parameters:

```bash
# If as_agent_plugin is 0, please set the agent configuration: 
agent_name=adama
agent_interval=300
agent_group=Servers
# And the transf. options 
## Pandora Server configuration 
mode=tentacle
tentacle_ip=127.0.0.1
tentacle_port=41121
tentacle_opts
tentacle_client="tentacle_client"
local_folder=/var/spool/pandora/data_in
temporal=/tmp
```

  
**agent\_name**  
 Name of the agent where the information will be delivered.

**agent\_interval**  
 Interval in seconds between agent executions.

**agent\_group**  
 Group to which the agent will belong in Pandora FMS.  
**mode**  
 XML file transfer mode, can be:  
 local: copies the files to local\_folder.  
 tentacle: transfers the files to tentacle\_ip for tentacle\_port.

**tentacle\_ip**  
 IP address or FQDN where Pandora FMS is running.

**tentacle\_port**  
 Port where the Tentacle service associated with your Pandora FMS server is listening.

**tentacle\_opts**  
 Extra options for Tentacle customers.

**tentacle\_client**  
 Path where the tentacle client binary can be found.

**local\_folder**  
 Location where files are moved in local mode.

**temp**  
 Temporary location where files are stored before being sent.

##### **Modules:**   


```bash
## Set 1 if you want to monitor number of index.
total_index=1
red_index=1
yellow_index=1
## Set 1 if you want to monitor index size.
total_index_size=1
red_index_size=1
yellow_index_size=1
## Set 1 if you want to monitor snapshots. 
snapshots=1
## Set 1 if you want to monitor Port connections. 
elastic_conections=1
kibana_conections=1
## Set 1 if you want to monitor memory usage of ELK. 
memory_usage=1
## Set 1 if you want to monitor cpu usage of ELK. 
cpu_usage=1
## Set 1 if you want to monitor disk metrics of ELK. 
disk_indices=1
disk_used=1
## Set 1 if you want to monitor documents count of ELK. 
document_count=1
## Check ELK services, 1 enabled 0 disabled. 
nginx_status=1
elastic_status=1
logstash_status=1
kibana_status=1
```

0 → Disables monitoring.  
1 → Enables monitoring.

  
**total\_index**  
 Number of generated indexes.

**red\_index**  
 Number of indexes in red status.

**yellow\_index**  
 Number of indexes in yellow status.

**total\_index\_size**  
 Total index size in mb.

**red\_index\_size**  
 Size of indexes in red status in mb.

**yellow\_index\_size**  
 Size of indexes in red status in mb.

**snapshots**  
 Total generated snapshots.

**elastic\_connections**  
 Number of connections to the port where elastic listens (port 9200).   
 This module IS AVAILABLE ONLY in the execution as agent plugin.

**kibana\_connections**  
 Number of connections to the port where kibana listens (puerto 5601).   
 This module IS AVAILABLE ONLY in the execution as agent plugin.

**memory\_usage**  
 Memory usage of the ELK server.  
 This module IS AVAILABLE ONLY in the execution as agent plugin.

**cpu\_usage**  
 CPU usage of the ELK server.   
 This module IS AVAILABLE ONLY in the execution as agent plugin.

**disk\_used**  
 Disk usage percentage of the ELK server.

**disk\_indices**  
 Disk size used by ELK server indexes.

**document\_count**  
 Counts the number of documents used by the ELK server.

**nginx\_status**  
 Status of the nginx service, 0 down, 1 up.  
 This module IS AVAILABLE ONLY in the execution as agent plugin.

**elastic\_status**  
 Estado del servicio elastic, 0 down, 1 up.  
 This module IS AVAILABLE ONLY in the execution as agent plugin.

**logstash\_status**  
 Estado del servicio logstash, 0 down, 1 up.  
 This module IS AVAILABLE ONLY in the execution as agent plugin.

**kibana\_status**  
 Estado del servicio kibana, 0 down, 1 up.  
 This module IS AVAILABLE ONLY in the execution as agent plugin.

# Manual execution

To run the plugin, configure the configuration file according to the instructions above.  
  
Running the plugin:  
  
Binary version:

```
./pandora_elk.64 pandora_elk.conf
```

  
Code version without deployed libraries:

```
perl -I ./lib pandora_elk.pl pandora_elk.conf
```

  
Where, lib is a directory that contains the PandoraFMS folder, wherethe PluginTools.pm library is stored.  
  
\*\*Binary execution is recommended\*\*

# Modules generated by the plugin

The standard execution of this plugin will return the following default modules (with all optional blocks enabled):

- **Disk\_indices.**
- **Disk\_used.**
- **Document\_count.**
- **Elasticsearch\_status** (only running as an agent plugin).
- **Elastic\_port\_Connections** (only running as an agent plugin).
- **ELK\_Cpu\_use** (only running as an agent plugin).
- **ELK\_Memory\_use** (only running as an agent plugin).
- **Index\_size.**
- **Kibana\_Port\_Connections** (only running as an agent plugin).
- **Kibana\_status** (only running as an agent plugin).
- **Logstash\_status** (only running as an agent plugin).
- **Nginx\_status** (only running as an agent plugin).
- **Red\_Index.**
- **Red\_Index\_size.**
- **Snapshots.**
- **Total\_index.**
- **Yellow\_index.**
- **Yellow\_inex\_size.**