{"id":1010,"date":"2021-09-19T18:28:39","date_gmt":"2021-09-20T02:28:39","guid":{"rendered":"https:\/\/angrysysadmins.tech\/?p=1010"},"modified":"2021-09-21T08:56:34","modified_gmt":"2021-09-21T16:56:34","slug":"how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail","status":"publish","type":"post","link":"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/","title":{"rendered":"How to install ElasticSearch and Logstash (and Kibana for ELK) in a TrueNAS Core Jail"},"content":{"rendered":"<p>Before we begin, lets see what a ELK stack is made of. ELK stacks are comprised of ElasticSearch, Logstash, and Kabina with each of these services preforming different jobs. <a href=\"https:\/\/logz.io\/learn\/complete-guide-elk-stack\/#installing-elk\">This diagram from Logz.io explains its the best<\/a><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1015\" src=\"https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/Group-1360.jpg\" alt=\"\" width=\"727\" height=\"149\" srcset=\"https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/Group-1360.jpg 727w, https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/Group-1360-300x61.jpg 300w\" sizes=\"auto, (max-width: 727px) 100vw, 727px\" \/><\/p>\n<p><strong>Beats<\/strong> are installed to each host to collect the various metrics used by these services.<\/p>\n<p><strong>Logstash<\/strong> is responsible for the processing of the incoming logs and Aggregation into something in a common format.<\/p>\n<p><strong>ElasticSearch<\/strong> is the storage and index for the processed logs and metrics.<\/p>\n<p><strong>Kibana<\/strong> is the analysis and visualization for the data.<\/p>\n<p>My setup is as follows:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1018\" src=\"https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/RyanELKSetup.png\" alt=\"\" width=\"729\" height=\"443\" \/><\/p>\n<p>I have a multi server setup, with 1 hypervisor, ESXi and one SAN, TrueNAS. I could just have an ELK stack running in a vm and target NFS or iscsi on the storage server, or even just use a datastore where other vms are stored. The reason is not done that was is I want the logs to be revived by the storage directly so ZFS can handle the compression and long term storage of the logs. There also is am advantage of having better uptime since the SAN reboots much less often than my hypervisor host. I have a full ELK stack deployed, but kibana is running on an ESXi VM, not on TrueNAS. This is so the brunt of the analyzing will be done on the Hypervisor CPU not the storage CPU.<\/p>\n<p><span style=\"text-decoration: underline;\"><strong>Beware the RAM and CPU requirements of my setup<\/strong><\/span>. My TrueNAS host in this setup is somewhat powerful (10 core, 20 thread CPU, 48GB RAM, with LOG and L2ARC SSD&#8217;s). Logstash and Elasticsearch can consume a lot of RAM. I have 8GB free for just this jail (just in case the usage gets high). This can be lowered by editing <a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/advanced-configuration.html#set-jvm-options\">Java settings<\/a> for each applications. The other thing to worry about is the CPU cycles. If you are using heavy compression like gzip or zstd this can heavily effect other process. I used <a href=\"https:\/\/indico.fnal.gov\/event\/16264\/contributions\/36466\/attachments\/22610\/28037\/Zstd__LZ4.pdf\">this report<\/a> , <a href=\"https:\/\/www.google.com\/url?sa=t&amp;rct=j&amp;q=&amp;esrc=s&amp;source=web&amp;cd=&amp;ved=2ahUKEwjHmZb1wozzAhXUVDUKHVN-DG0QFnoECAMQAQ&amp;url=https%3A%2F%2Findico.cern.ch%2Fevent%2F695984%2Fcontributions%2F2872933%2Fattachments%2F1590457%2F2516802%2FZSTD_and_ZLIB_Updates_-_January_20186.pdf&amp;usg=AOvVaw2qR-d8ZazSTpq1siF-b88F\">also this report<\/a>, and a few others to base my decision on the compression levels. The applications themselfs can also use a lot of CPU depending on the log size and the filters applied. I would strongly recommend setting up grafana, telegraf, and influxDB or some similar long term monitoring setup to make sure your jail is not making your TrueNAS overloaded.<\/p>\n<h2>[Optional] Dataset Creation<\/h2>\n<p>For my setup, I am having Logstash and ElasticSearch store their files on separate datasets on my TrueNAS box. This is so I can easily migrate things in the future if it breaks, and so I can set custom compression and record sizes for the datasets to decrease storage consumed and speed of everything. I set my datasets up with the following settings:<\/p>\n<pre>Record size: 32KiB\r\nCompression: ZSTD-6\r\nEncryption: Inherit<\/pre>\n<h2>Jail creation<\/h2>\n<p>To start with, Fetch the latest FreeBSD release for your system in the command line(in my case 12.2 because that is what TrueNas Core 12.0-U4.1 is biased on)<\/p>\n<pre># iocage fetch<\/pre>\n<p>Once that is done, go and create a advanced jail. Name it what you want, Mine is Log1<\/p>\n<p>In jail properties, allow <code class=\"language-plaintext highlighter-rouge\">allow_set_hostname<\/code>, <code class=\"language-plaintext highlighter-rouge\">allow_mlock<\/code>, and <code class=\"language-plaintext highlighter-rouge\">allow_mount<\/code>. In the dropdown for allow mount, Give it<\/p>\n<pre>allow_mount_devs\r\nallow_mount_nullfs\r\nallow_mount_procfs\r\nallow_mount_fusefs\r\nallow_mount_tmpfs<\/pre>\n<p>Next, on networking, uncheck <code class=\"language-plaintext highlighter-rouge\">NAT<\/code>, check <code class=\"language-plaintext highlighter-rouge\">VNET<\/code>, check<code class=\"language-plaintext highlighter-rouge\">Berkeley Packet Filter<\/code>and give the jail an IP address, netmask, and gateway.<\/p>\n<p>Finally the jail is created! Now we need to drop to command line and run the following<\/p>\n<pre># iocage set mount_fdescfs=1 your-jail\r\n# iocage set mount_procfs=1 your-jail\r\n# iocage set enforce_statfs=1 your-jail<\/pre>\n<p>This will allow java8 to run because fdescfs and proc are needed by java to run correctly. The old way involved modifying <code class=\"language-plaintext highlighter-rouge\">enforce statfs<\/code> for the system and setting it to 1. This is not recommended! The issue is that it changes how all jails operate and lead to some system instability. With this method, it changes just this jails statfs settings.<\/p>\n<p><strong>If you have datasets to mount,<\/strong> this is where you would do it. Mine are setup like this:<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-1012\" src=\"https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/Screenshot_20210919_171642.png\" alt=\"\" width=\"1438\" height=\"227\" srcset=\"https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/Screenshot_20210919_171642.png 1438w, https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/Screenshot_20210919_171642-300x47.png 300w, https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/Screenshot_20210919_171642-1024x162.png 1024w, https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/Screenshot_20210919_171642-768x121.png 768w\" sizes=\"auto, (max-width: 1438px) 100vw, 1438px\" \/><\/p>\n<p>Now we can finally start the jail. If the jail is not starting, go to command line and run the following to debug. Berkley Packet Filter sometimes likes to enable. Disable it in the networking config for the jail.<\/p>\n<pre># iocage start your-jail<\/pre>\n<h2>Entering the jail<\/h2>\n<p>To get into the jail, run<\/p>\n<pre># iocage console your-jail<\/pre>\n<p><strong>All commands from this point on are in the jail, not TrueNAS<br \/>\n<\/strong><\/p>\n<h2>[Optional] Changing pkg to use the latest packages<\/h2>\n<p>If you want to run the latest of all of the software and not wait on quarterly updates, you can change the freebsd repo to use the latest. <strong>I use quarterly for stability above all else<\/strong>. If you want to run the latest, change the following:<\/p>\n<pre># vim \/etc\/pkg\/FreeBSD.conf<\/pre>\n<p>Change<\/p>\n<pre>FreeBSD: {\r\nurl: \"pkg+http:\/\/pkg.FreeBSD.org\/${ABI}\/quarterly\",<\/pre>\n<p>to:<\/p>\n<pre>FreeBSD: {\r\nurl: \"pkg+http:\/\/pkg.FreeBSD.org\/${ABI}\/latest\",<\/pre>\n<p>&nbsp;<\/p>\n<h2>Installation<\/h2>\n<p>Install elasticsearch<\/p>\n<pre># pkg install -y elasticsearch7<\/pre>\n<p>&nbsp;<\/p>\n<p>Install logstash<\/p>\n<pre># pkg install -y logstash7<\/pre>\n<p>If you wanted the full ELK stack, Run <code class=\"language-plaintext highlighter-rouge\"># pkg install -y kibana7<\/code><\/p>\n<h2>Configuration<\/h2>\n<p>All of the configurations are store in \/usr\/local\/etc\/ under the respective application name. I am using<code class=\"language-plaintext highlighter-rouge\">vim<\/code> to edit my config files (install with <code class=\"language-plaintext highlighter-rouge\"># pkg install -y vim<\/code>) If you want a simpler editor, use nano (install with <code class=\"language-plaintext highlighter-rouge\"># pkg install -y nano<\/code>) Just replace use <code class=\"language-plaintext highlighter-rouge\">nano<\/code> instead of <code class=\"language-plaintext highlighter-rouge\">vim<\/code>in the commands below.<\/p>\n<p>&nbsp;<\/p>\n<p>For elasticsearch, you need to find and configure the following lines in the config file to what you want it to be. Here is what I <strong>changed<\/strong> on mine.<\/p>\n<pre class=\"enlighter-clipboard\"># vim \/usr\/local\/etc\/elasticsearch\/elasticsearch.yml<\/pre>\n<pre class=\"enlighter-clipboard\">cluster.name: Logs\r\nnode.name: Log1\r\npath.data: \/mnt\/elasticsearch # only change if you are mounting different datasets. Else set it to \/var\/db\/elasticsearch\r\npath.logs: \/var\/log\/ElasticSearch\r\nhttp.port: 9200<\/pre>\n<p>Once done with that, start and make the service start at boot<\/p>\n<pre><span class=\"enlighter-text\"># sysrc elasticsearch_enable=YES\r\n# service elasticsearch start\r\n<\/span><\/pre>\n<p>Any errors encountered should dump a log to the console or ssh session.<\/p>\n<p>&nbsp;<\/p>\n<p>For Logstash, you dont have to change anything, but I changed some of the values. Here is what I <strong>changed<\/strong> on mine.<\/p>\n<pre># vim \/usr\/local\/etc\/logstash\/logstash.yml\r\n\r\nnode.name: Logs  \r\npath.data: \/mnt\/Logstash \r\npipeline.ordered: auto \r\npath.config: \/usr\/local\/etc\/logstash\/logstash.conf \r\nhttp.host: 192.168.42.84 \r\nhttp.port: 9600-9700<\/pre>\n<p>Finally, start the and enable the services<\/p>\n<pre><span class=\"enlighter-text\"># sysrc logstash_enable=YES\r\n# service logstash start<\/span><\/pre>\n<p>Any errors encountered should dump a log to the console or ssh session.<\/p>\n<p>If you want to configure kibana, <a href=\"https:\/\/framkant.org\/2020\/04\/running-elk-stack-on-freebsd\/\">follow this guide<\/a><\/p>\n<h2>Conclusion<\/h2>\n<p>Now you should have a ready to go ElasticSearch and Logstash Jail! If you have any issue please post about them here. Im not an expert by any means, but I may be able to help.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Before we begin, lets see what a ELK stack is made of. ELK stacks are comprised of ElasticSearch, Logstash, and Kabina with each of these services preforming different jobs. This diagram from Logz.io explains its the best Beats are installed to each host to collect the various metrics used by these services. Logstash is responsible <br \/><a class=\"read-more-button\" href=\"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/\">Read More &raquo;<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[196,120,172,173,198],"tags":[],"coauthors":[39],"class_list":["post-1010","post","type-post","status-publish","format-standard","hentry","category-bsd","category-elk","category-freebsd","category-freenas","category-truenas"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to install ElasticSearch and Logstash (and Kibana for ELK) in a TrueNAS Core Jail - Angry Sysadmins<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to install ElasticSearch and Logstash (and Kibana for ELK) in a TrueNAS Core Jail - Angry Sysadmins\" \/>\n<meta property=\"og:description\" content=\"Before we begin, lets see what a ELK stack is made of. ELK stacks are comprised of ElasticSearch, Logstash, and Kabina with each of these services preforming different jobs. This diagram from Logz.io explains its the best Beats are installed to each host to collect the various metrics used by these services. Logstash is responsible Read More &raquo;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/\" \/>\n<meta property=\"og:site_name\" content=\"Angry Sysadmins\" \/>\n<meta property=\"article:published_time\" content=\"2021-09-20T02:28:39+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-09-21T16:56:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/Group-1360.jpg\" \/>\n<meta name=\"author\" content=\"Ryan Parker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ryan Parker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2021\\\/09\\\/grassyloki\\\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2021\\\/09\\\/grassyloki\\\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\\\/\"},\"author\":{\"name\":\"Ryan Parker\",\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/#\\\/schema\\\/person\\\/651321cd35645fb6a4d8a75b7bc7c199\"},\"headline\":\"How to install ElasticSearch and Logstash (and Kibana for ELK) in a TrueNAS Core Jail\",\"datePublished\":\"2021-09-20T02:28:39+00:00\",\"dateModified\":\"2021-09-21T16:56:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2021\\\/09\\\/grassyloki\\\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\\\/\"},\"wordCount\":958,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2021\\\/09\\\/grassyloki\\\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/angrysysadmins.tech\\\/wp-content\\\/uploads\\\/2021\\\/09\\\/Group-1360.jpg\",\"articleSection\":[\"BSD\",\"ELK\",\"FreeBSD\",\"FreeNAS\",\"TrueNAS\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2021\\\/09\\\/grassyloki\\\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2021\\\/09\\\/grassyloki\\\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\\\/\",\"url\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2021\\\/09\\\/grassyloki\\\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\\\/\",\"name\":\"How to install ElasticSearch and Logstash (and Kibana for ELK) in a TrueNAS Core Jail - Angry Sysadmins\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2021\\\/09\\\/grassyloki\\\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2021\\\/09\\\/grassyloki\\\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/angrysysadmins.tech\\\/wp-content\\\/uploads\\\/2021\\\/09\\\/Group-1360.jpg\",\"datePublished\":\"2021-09-20T02:28:39+00:00\",\"dateModified\":\"2021-09-21T16:56:34+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/#\\\/schema\\\/person\\\/651321cd35645fb6a4d8a75b7bc7c199\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2021\\\/09\\\/grassyloki\\\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2021\\\/09\\\/grassyloki\\\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2021\\\/09\\\/grassyloki\\\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\\\/#primaryimage\",\"url\":\"https:\\\/\\\/angrysysadmins.tech\\\/wp-content\\\/uploads\\\/2021\\\/09\\\/Group-1360.jpg\",\"contentUrl\":\"https:\\\/\\\/angrysysadmins.tech\\\/wp-content\\\/uploads\\\/2021\\\/09\\\/Group-1360.jpg\",\"width\":727,\"height\":149},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/2021\\\/09\\\/grassyloki\\\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/angrysysadmins.tech\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to install ElasticSearch and Logstash (and Kibana for ELK) in a TrueNAS Core Jail\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/#website\",\"url\":\"https:\\\/\\\/angrysysadmins.tech\\\/\",\"name\":\"Angry Sysadmins\",\"description\":\"A site full of angry sysadmins here to vent and help\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/angrysysadmins.tech\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/angrysysadmins.tech\\\/#\\\/schema\\\/person\\\/651321cd35645fb6a4d8a75b7bc7c199\",\"name\":\"Ryan Parker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fc12b1a02765c8017062ee6f41eb34a7b14575bcd8acd7da40e176fe8f12b10f?s=96&d=mm&r=g664d0e05248e51cb1d71b3f66c6f929d\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fc12b1a02765c8017062ee6f41eb34a7b14575bcd8acd7da40e176fe8f12b10f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fc12b1a02765c8017062ee6f41eb34a7b14575bcd8acd7da40e176fe8f12b10f?s=96&d=mm&r=g\",\"caption\":\"Ryan Parker\"},\"description\":\"Professionally im a Infrastructure Security Specialist. I current maintain a homelab with about 3TB of RAM, 240+ TB of storage, tons of CPU cores, and 100gbit networking backbone in the garage running up my electricity bill.\",\"url\":\"https:\\\/\\\/angrysysadmins.tech\\\/index.php\\\/author\\\/grassyloki\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to install ElasticSearch and Logstash (and Kibana for ELK) in a TrueNAS Core Jail - Angry Sysadmins","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/","og_locale":"en_US","og_type":"article","og_title":"How to install ElasticSearch and Logstash (and Kibana for ELK) in a TrueNAS Core Jail - Angry Sysadmins","og_description":"Before we begin, lets see what a ELK stack is made of. ELK stacks are comprised of ElasticSearch, Logstash, and Kabina with each of these services preforming different jobs. This diagram from Logz.io explains its the best Beats are installed to each host to collect the various metrics used by these services. Logstash is responsible Read More &raquo;","og_url":"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/","og_site_name":"Angry Sysadmins","article_published_time":"2021-09-20T02:28:39+00:00","article_modified_time":"2021-09-21T16:56:34+00:00","og_image":[{"url":"https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/Group-1360.jpg","type":"","width":"","height":""}],"author":"Ryan Parker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Ryan Parker","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/#article","isPartOf":{"@id":"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/"},"author":{"name":"Ryan Parker","@id":"https:\/\/angrysysadmins.tech\/#\/schema\/person\/651321cd35645fb6a4d8a75b7bc7c199"},"headline":"How to install ElasticSearch and Logstash (and Kibana for ELK) in a TrueNAS Core Jail","datePublished":"2021-09-20T02:28:39+00:00","dateModified":"2021-09-21T16:56:34+00:00","mainEntityOfPage":{"@id":"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/"},"wordCount":958,"commentCount":0,"image":{"@id":"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/#primaryimage"},"thumbnailUrl":"https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/Group-1360.jpg","articleSection":["BSD","ELK","FreeBSD","FreeNAS","TrueNAS"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/","url":"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/","name":"How to install ElasticSearch and Logstash (and Kibana for ELK) in a TrueNAS Core Jail - Angry Sysadmins","isPartOf":{"@id":"https:\/\/angrysysadmins.tech\/#website"},"primaryImageOfPage":{"@id":"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/#primaryimage"},"image":{"@id":"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/#primaryimage"},"thumbnailUrl":"https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/Group-1360.jpg","datePublished":"2021-09-20T02:28:39+00:00","dateModified":"2021-09-21T16:56:34+00:00","author":{"@id":"https:\/\/angrysysadmins.tech\/#\/schema\/person\/651321cd35645fb6a4d8a75b7bc7c199"},"breadcrumb":{"@id":"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/#primaryimage","url":"https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/Group-1360.jpg","contentUrl":"https:\/\/angrysysadmins.tech\/wp-content\/uploads\/2021\/09\/Group-1360.jpg","width":727,"height":149},{"@type":"BreadcrumbList","@id":"https:\/\/angrysysadmins.tech\/index.php\/2021\/09\/grassyloki\/how-to-install-elasticsearch-and-logstash-and-kibana-for-elk-in-a-truenas-core-jail\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/angrysysadmins.tech\/"},{"@type":"ListItem","position":2,"name":"How to install ElasticSearch and Logstash (and Kibana for ELK) in a TrueNAS Core Jail"}]},{"@type":"WebSite","@id":"https:\/\/angrysysadmins.tech\/#website","url":"https:\/\/angrysysadmins.tech\/","name":"Angry Sysadmins","description":"A site full of angry sysadmins here to vent and help","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/angrysysadmins.tech\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/angrysysadmins.tech\/#\/schema\/person\/651321cd35645fb6a4d8a75b7bc7c199","name":"Ryan Parker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/fc12b1a02765c8017062ee6f41eb34a7b14575bcd8acd7da40e176fe8f12b10f?s=96&d=mm&r=g664d0e05248e51cb1d71b3f66c6f929d","url":"https:\/\/secure.gravatar.com\/avatar\/fc12b1a02765c8017062ee6f41eb34a7b14575bcd8acd7da40e176fe8f12b10f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/fc12b1a02765c8017062ee6f41eb34a7b14575bcd8acd7da40e176fe8f12b10f?s=96&d=mm&r=g","caption":"Ryan Parker"},"description":"Professionally im a Infrastructure Security Specialist. I current maintain a homelab with about 3TB of RAM, 240+ TB of storage, tons of CPU cores, and 100gbit networking backbone in the garage running up my electricity bill.","url":"https:\/\/angrysysadmins.tech\/index.php\/author\/grassyloki\/"}]}},"_links":{"self":[{"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/posts\/1010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/comments?post=1010"}],"version-history":[{"count":25,"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/posts\/1010\/revisions"}],"predecessor-version":[{"id":1041,"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/posts\/1010\/revisions\/1041"}],"wp:attachment":[{"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/media?parent=1010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/categories?post=1010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/tags?post=1010"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/angrysysadmins.tech\/index.php\/wp-json\/wp\/v2\/coauthors?post=1010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}