You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -62,42 +62,8 @@ The Elasticsearch app is a unified logs and metrics app that helps you monitor t
62
62
63
63
Configuring log and metric collection for the Elasticsearch app includes the following tasks.
64
64
65
-
### Step 1: Configure Fields in Sumo Logic
66
65
67
-
Create the following Fields in Sumo Logic before configuring the collection. This ensures that your logs and metrics are tagged with relevant metadata required by the app dashboards. For information on setting up fields, see [Sumo Logic Fields](/docs/manage/fields).
If you're using Elasticsearch in a Kubernetes environment, create the fields:
80
-
81
-
*`pod_labels_component`
82
-
*`pod_labels_environment`
83
-
*`pod_labels_db_system`
84
-
*`pod_labels_db_cluster`
85
-
86
-
</TabItem>
87
-
<TabItemvalue="non-k8s">
88
-
89
-
If you're using Elasticsearch in a non-Kubernetes environment, create the fields:
90
-
91
-
*`component`
92
-
*`environment`
93
-
*`db_system`
94
-
*`db_cluster`
95
-
*`pod`
96
-
97
-
</TabItem>
98
-
</Tabs>
99
-
100
-
### Step 2: Configure Collection for Elasticsearch
66
+
### Configure Collection for Elasticsearch
101
67
102
68
<Tabs
103
69
groupId="k8s-nonk8s"
@@ -368,92 +334,37 @@ At this point, Elasticsearch logs should start flowing into Sumo Logic.
368
334
</TabItem>
369
335
</Tabs>
370
336
371
-
## Installing Elasticsearch Monitors
372
-
373
-
Sumo Logic has provided pre-packaged alerts available through [Sumo Logic monitors](/docs/alerts/monitors) to help you proactively determine if an Elasticsearch cluster is available and performing as expected. These monitors are based on metric and log data and include pre-set thresholds that reflect industry best practices and recommendations. For more information about individual alerts, see [Elasticsearch Alerts](#elasticsearch-alerts).
374
-
375
-
To install these monitors, you must have the **Manage Monitors** role capability. You can install monitors by importing a JSON file or using a Terraform script. There are limits to how many alerts can be enabled. For more information, see [Monitors](/docs/alerts/monitors/create-monitor) for details.
376
-
377
-
### Method 1: Importing a JSON file
378
-
379
-
1. Download the [JSON file](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/Elasticsearch/Elasticsearch.json) that describes the monitors.
380
-
2. The [JSON](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/blob/main/monitor_packages/Elasticsearch/Elasticsearch.json) contains the alerts that are based on Sumo Logic searches that do not have any scope filters, and therefore will be applicable to all Elasticsearch clusters, the data forwhich has been collected via the instructionsin the previous sections. However, if you would like to restrict these alerts to specific clusters or environments, update the JSON file by replacing the text `db_cluster=*` with `<Your Custom Filter>`. Custom filter examples:
381
-
* For alerts applicable only to a specific cluster, your custom filter would be: `db_cluster=dev-elasticsearch-01`
382
-
* For alerts applicable to all clusters that start with `elasticsearch-prod`, your custom filter would be: `db_cluster=elasticsearch-prod*`
383
-
* For alerts applicable to a specific clusters, within a production environment, your custom filter would be: `db_cluster=dev-elasticsearch-01` AND `environment=prod`. This assumes you have set the optional environment tag while configuring collection.
384
-
3. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select**Manage Data > Monitoring > Monitors**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the main Sumo Logic menu, select**Alerts> Monitors**. You can also click the **Go To...** menu at the top of the screen and select**Monitors**.
385
-
4. Click **Add**.
386
-
5. Click **Import**.
387
-
6. On the **Import Content popup**, enter **Elasticsearch**in the Name field, paste in the JSON into the popup, and click **Import**.
388
-
7. The monitors are created in a **Elasticsearch** folder. The monitors are disabled by default. See the [Monitors](/docs/alerts/monitors) topic for information about enabling monitors and configuring notifications or connections.
389
337
390
-
### Method 2: Using a Terraform script
338
+
## Installing the Elasticsearch app
391
339
392
-
1. Generate a Sumo Logic access key and ID for a user that has the **Manage Monitors** role capability. For instructions, see [Access Keys](/docs/manage/security/access-keys).
393
-
2. Download [Terraform 0.13](https://www.terraform.io/downloads.html) or later, and install it.
394
-
3. Download the Sumo Logic Terraform package forElasticsearch monitors. The alerts package is availablein the Sumo Logic GitHub [repository](https://github.com/SumoLogic/terraform-sumologic-sumo-logic-monitor/tree/main/monitor_packages/Elasticsearch). You can either download it using the git clone command or as a zip file.
395
-
4. Alert Configuration. After extracting the package, navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/Elasticsearch/` directory.
396
-
* Edit the `Elasticsearch.auto.tfvars` file and add the Sumo Logic Access Key and Access ID from Step 1 and your Sumo Logic deployment. If you're not sure of your deployment, see [Sumo Logic Endpoints and Firewall Security](/docs/api/getting-started#sumo-logic-endpoints-by-deployment-and-firewall-security).
397
-
```bash
398
-
access_id = "<SUMOLOGIC ACCESS ID>"
399
-
access_key = "<SUMOLOGIC ACCESS KEY>"
400
-
environment = "<SUMOLOGIC DEPLOYMENT>"
401
-
```
402
-
* The Terraform script installs the alerts without any scope filters. If you would like to restrict the alerts to specific clusters or environments, update the `elasticsearch_data_source` variable. For example:
403
-
* To configure alerts for a specific cluster, set `elasticsearch_data_source` to something like `db_cluster=elasticsearch.prod.01`
404
-
* To configure alerts for all clusters in an environment, set `elasticsearch_data_source` to something like `environment=prod`
405
-
* To configure alerts for multiple clusters using a wildcard, set `elasticsearch_data_source` to something like `db_cluster=elasticsearch-prod*`
406
-
* To configure alerts for a specific clusters within a specific environment, set `elasticsearch_data_source` to something like `db_cluster=elasticsearch-1` and `environment=prod`. This assumes you have configured and applied Fields as described in [Configure Sumo Logic Fields](#step-1-configure-fields-in-sumo-logic).
407
-
408
-
All monitors are disabled by default on installation. To enable all of the monitors, set the `monitors_disabled` parameter to `false`. By default, the monitors will be located in a "Elasticsearch" folder on the **Monitors** page. To change the name of the folder, update the monitor folder name in the folder variable in the `Elasticsearch.auto.tfvars` file.
409
-
5. If you want your alerts to send email or connection notifications, edit the `Elasticsearch_notifications.auto.tfvars` file to populate the `connection_notifications` and `email_notifications` sections. Examples are provided below. In the variable definition below, replace `<CONNECTION_ID>` with the connection ID of the Webhook connection. You can obtain the Webhook connection ID by calling the [Monitors API](https://api.sumologic.com/docs/#operation/listConnections).
import AppInstall2 from '../../reuse/apps/app-install-only-k8s.md';
426
341
427
-
For information about overriding the payload for different connection types, see [Set Up Webhook Connections](/docs/alerts/webhook-connections/set-up-webhook-connections).
1. Navigate to the `terraform-sumologic-sumo-logic-monitor/monitor_packages/Elasticsearch/` directory and run terraform init. This will initialize Terraform and download the required components.
443
-
2. Run `terraform plan` to view the monitors that Terraform will create or modify.
444
-
3. Run `terraform apply`.
342
+
<AppInstall2 />
445
343
446
-
## Installing the Elasticsearch app
344
+
As part of the app installation process, the following fields will be created by default:
345
+
*`component`
346
+
*`environment`
347
+
*`db_system`
348
+
*`db_cluster`
349
+
*`pod`
350
+
*`db_cluster_address`
351
+
*`db_cluster_port`
447
352
448
-
import AppInstall from '../../reuse/apps/app-install.md';
353
+
Additionally, if you're using Elasticsearch in the Kubernetes environment, the following additional fields will be created by default during the app installation process:
354
+
* `pod_labels_component`
355
+
* `pod_labels_environment`
356
+
* `pod_labels_db_system`
357
+
* `pod_labels_db_cluster`
358
+
* `pod_labels_db_cluster_address`
359
+
* `pod_labels_db_cluster_port`
449
360
450
-
<AppInstall/>
361
+
For information on setting up fields, see [Fields](/docs/manage/fields).
451
362
452
363
## Viewing Elasticsearch dashboards
453
364
454
-
:::tip Filter with template variables
455
-
Template variables provide dynamic dashboards that can rescope data on the fly. As you apply variables to troubleshoot through your dashboard, you view dynamic changes to the data for a quicker resolution to the root cause. You can use template variables to drill down and examine the data on a granular level. For more information, see [Filter with template variables](/docs/dashboards/filter-template-variables.md).
456
-
:::
365
+
import ViewDashboards from '../../reuse/apps/view-dashboards.md';
import CreateMonitors from '../../reuse/apps/create-monitors.md';
450
+
451
+
<CreateMonitors/>
537
452
538
-
Sumo Logic has provided out-of-the-box alerts available via[ Sumo Logic monitors](/docs/alerts/monitors) to help you quickly determine if the Elasticsearch database cluster is available and performing as expected.
453
+
### Elasticsearch Alerts
539
454
540
455
| Alert Type (Metrics/Logs) | Alert Name | Alert Description | Trigger Type (Critical / Warning) | Alert Condition | Recover Condition |
0 commit comments