Starting centralised logfile analysing with ELK stack (elasticsearch, logstash, kibana)

[binderth (Thomas Binder)]

I’m starting to look into centralised logfile analysing with the ELK stack (elasticsearch, logstash, kibana).
There’s a Tutorial post here:

Logging to Filebeat + Elasticsearch + Kibana

This tutorial walks you through setting up OpenHab, Filebeat and Elasticsearch to enable viewing OpenHab logs in Kibana. The purpose is purely viewing application logs rather than analyzing the event logs . There already are a couple of great guides on how to set this up using a combination of Logstash and a Log4j2 socket appender (here and here) however I decided on using Filebeat instead for two reasons: Logstash is quite heavy on resource usage (being a JRuby JVM both CPU and memory) In my…

But I think, logging changed since OH2. Is there anyone willing to share how it can be done with OH4 and ELK? Thanks!

[rlkoshak (Rich Koshak)]

The only thing that has changed is it uses the XML format for the config instead of the .properties file. But all the same parameters are the same.

You can probably figure it out just by looking at your existing log4j2.xml file. But if not see Log4j – Configuring Log4j 2.

Note, other options for centralized logging with openHAB:

• Logging to graylog
• Fluentd (I don’t see any tutorials for using OH with this one yet)
• Using loki+promtail+grafana for Openhab system and log monitoring

There are of course others.

ELKI stack is pretty heavy weight and Elasticsearch just by itself is going to consume a lot of resources. I don’t know about these other approaches.

[binderth (Thomas Binder)]

@rlkoshak

ELKI stack is pretty heavy weight and Elasticsearch just by itself is going to consume a lot of resources. I don’t know about these other approaches.

ok, I just found a docker compose for the whole ELK in one go. The others seem also nice, what I need is just a dashboard showing ERRORs and perhaps WARNings - and based on that perhaps an email, if errors are showing up all the time. let’s see. Thanks for pointing that out.