Additional Setup for master node Install mongodb on master node Install instructions from https://docs.mongodb.com/manual/administration/install-on-linux/ Create repo file for mongodb vi /etc/yum.repos.d/MongoDB-3.4.repo Insert this text [mongodb-org-3.4] name=MongoDB Repository baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/3.4/x86_64/ gpgcheck=1 enabled=1 gpgkey=https://www.mongodb.org/static/pgp/server-3.4.asc</pre> Install mongodb yum install mongodb-org Set mongod to start on boot systemctl enable mongod .service Allow mongodb to use port 27017 for communication semanage port -a -t mongod_port_t -p tcp 27017 Start mongodb systemctl start mongod Setup Note: By default, mongodb does not enforce any kind of user authentication.

Setup Elasticsearch cluster nodes Install Elasticsearch In this example we are building out a three node cluster but this can scale up to fit whatever cluster size you choose. View Elasticsearch setup and configuration docs https://www.elastic.co/guide/en/elasticsearch/reference/2.4/index.html Install Java yum install java-1.8.0-openjdk-headless.x86_64 Import signing key from elastic.co rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch Create repo file vi /etc/yum.repos.d/Elasticsearch.repo Insert this text [elasticsearch-2.x] name=Elasticsearch repository for 2.x packages baseurl=http://packages.elastic.co/elasticsearch/2.x/centos gpgcheck=1 gpgkey=http://packages.elastic.co/GPG-KEY-elasticsearch enabled=1 Install elasticsearch yum install elasticsearch

Partitioning layout Setup Note: The partition layout for elasticsearch nodes may vary depending on how much data storage is needed. It makes sense to create mount points with the idea they may grow in the future. Worksheet for estimating proper sizing that can be helpful https://community.graylog.org/t/sizing-estimator/644 For ES data nodes, ES master node, and rsyslog storage node /dev/sda1 mount on /boot 500MB vg_local-lv_swap swap partition 1024MB (up to twice size of installed RAM) vg_local-lv_root mount on / minimum 10240MB (10GB) vg_local-lv_home mount on /home minimum 15360MB (15GB), expandable vg_local-lv_tmp mount on /tmp minimum 1024MB (1GB) vg_local-lv_usr mount on /usr minimum 4096MB (4GB) vg_local-lv_var mount on /var minimum 8000MB (8GB), expandable For rsyslog aggregator nodes (Optional) /dev/sda1 mount on /boot 500MB vg_local-lv_swap 1024MB up to twice size of installed RAM vg_local-lv_root mount on / minimum of 8192MB vg_local-lv_home mount on /home minimum of 10240MB up to whatever size vg_local-lv_tmp mount on /tmp minimum of 1024MB vg_local-lv_usr mount on /usr minimum of 4096MB vg_local-lv_var mount on /var minimum of 8000MB up to whatever size For OSSEC node (Optional) /dev/sda1 mount on /boot 500MB vg_local-lv_swap 1024MB up to twice size of installed RAM vg_local-lv_root mount on / minimum of 8192MB vg_local-lv_home mount on /home minimum of 10240MB up to whatever size vg_local-lv_tmp mount on /tmp minimum of 1024MB vg_local-lv_usr mount on /usr minimum of 4096MB vg_local-lv_var mount on /var minimum of 8000MB up to whatever size Install prerequisite apps Setup Note: Some services should be available on the network such as a timeserver and DNS services otherwise, some assumptions made throughout this document will not be correct.

System Build Overview The next steps are to build the environment; starting with the elasticsearch (ES) nodes and the log parser/search frontend because they require certain components to be identical. The process assumes the use of a minimal OS install using CENTOS 7 but any major NIX based OS can be used (just remember the commands might be different). Start by building three servers; two will be ES data nodes and one will be used as the ES master node.

Logging Infrastructure Overview Setting up a multi-tiered logging infrastructure can be a little more complicated than just spinning up an rsyslog server and shipping logs to it (although that is an option). A few products come up repeatedly when looking for logging stack solutions—these include elasticsearch, logstash, kibana, and graylog, along with rsyslog, nxlog, syslog-ng, and OSSEC. The ELK stack uses Elasticsearch, Logstash, and Kibana. The Graylog and Elasticsearch stack (or GELP – Graylog Enhanced Logging Platform, for lack of a better acronym) utilizes Graylog to perform the same functions as Logstash and Kibana.