Logstash 1.4.0 install script for Centos/OEL/RHEL 6.5

logstash-bootstrap.sh

#!/bin/bash
# Created Fri Mar 22 2014
# This is an indirect fork of https://gist.github.com/SeonghoonKim/4378896
# Most of it was reworked from http://blog.basefarm.com/blog/how-to-install-logstash-with-kibana-interface-on-rhel/
# This script will download, install and start 
# the following items on CentOS 6.5:
# OpenJDK 1.7.0
# cURL
# ElasticSearch 1.0.1
# Logstash server 1.4.0
# Logstash web 1.4.0
# 
# This script should be safe to run more than one time.  YMMV

APP_ROOT="/opt"
EPEL_REPO="/etc/yum.repos.d/epel.repo"
ORIG_WKDIR=$(pwd)

[ -f "$APP_ROOT" ] || mkdir -p $APP_ROOT

echo "Creating yum repo file..."
if [ -f ${EPEL_REPO} ]; then
echo "$EPEL_REPO found"
else
echo "Creating $EPEL_REPO"
cat << 'EOF' > ${EPEL_REPO}
[epel]
name=Extra Packages f or Enterprise Linux 6 - $basearch
#baseurl=http://download.fedoraproject.org/pub/epel/6/$basearch
mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-6&arch=$basearch
failovermethod=priority
enabled=1
gpgcheck=0
EOF
fi

echo "Stopping any running services..."
service logstash-web stop
service logstash stop
service elasticsearch stop

echo "Installing openjdk 1.7.0 curl and which..."
yum -y install curl java-1.7.0-openjdk which

MYRANDOM=$RANDOM
echo "Moving old files to $APP_ROOT/OLD_$MYRANDOM..."
mkdir $APP_ROOT/OLD_$MYRANDOM
mv $APP_ROOT/logstash* $APP_ROOT/elasticsearch* $APP_ROOT/OLD_$MYRANDOM
rmdir $APP_ROOT/OLD_$MYRANDOM >/dev/null 2>&1

echo "Checking and/or getting files..."
if [ ! -d "$APP_ROOT/sources" ]; then mkdir "$APP_ROOT/sources"; fi
if [ ! -f "$APP_ROOT/sources/elasticsearch-1.0.1.noarch.rpm" ]; then
curl -o "$APP_ROOT/sources/elasticsearch-1.0.1.noarch.rpm" -L https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-1.0.1.noarch.rpm
fi
if [ ! -f "$APP_ROOT/sources/logstash-1.4.0.tar.gz" ]; then
curl -o "$APP_ROOT/sources/logstash-1.4.0.tar.gz" -L https://download.elasticsearch.org/logstash/logstash/logstash-1.4.0.tar.gz
fi

echo "Installing and starting elasticsearch RPM..."
rpm -Uvh "$APP_ROOT/sources/elasticsearch-1.0.1.noarch.rpm"
chkconfig --add elasticsearch
chkconfig  elasticsearch on
service elasticsearch start

echo "Extracting logstash..."
cd "$APP_ROOT"
tar xf sources/logstash-1.4.0.tar.gz
ln -s "$APP_ROOT/logstash-1.4.0" "$APP_ROOT/logstash"

echo "Setting logstash up to use..."
sed -i -e 's|/dashboard/file/default.json|/dashboard/file/logstash.json|' "$APP_ROOT/logstash/vendor/kibana/config.js"

mkdir "$APP_ROOT/logstash/conf"

cat << 'EOF' > "$APP_ROOT/logstash/conf/logstash.conf"
input {
syslog {
type => syslog
port => 514
codec => plain { charset => "ISO-8859-1" }
}

#To genereate some logging.  Remove the next section if desired.  Delete from here...
file {
type => "syslog"
path => [ "/var/log/elasticsearch/*.log" ]
}
#...to here.
}


filter {
mutate {
add_field => [ "hostip", "%{host}" ]
}
dns {
reverse => [ "host" ]
action => "replace"
}
}

output {
elasticsearch {
host => "localhost"
cluster => "elasticsearch"
}
}
EOF

echo "Creating service files and starting services..."
cat << 'EOF' > /etc/init.d/logstash
#!/bin/sh
### BEGIN INIT INFO
# Provides: Logstash 1.4 init.d script
# Required-Start: $network
# Required-Stop: $network
# Default-Start: 2 3 4 5
# Description: Starts the Logstash 1.4
### END INIT INFO
export HOME=/opt/logstash
case "$1" in
'start')
/opt/logstash/bin/logstash -f /opt/logstash/conf/logstash.conf > /var/log/logstash.log 2>&1 & 
;;
'stop')
/usr/bin/kill -9 `ps auxww |grep logstash |grep logstash.conf | awk '{print $2}'`
;;
'restart')
/etc/init.d/logstash stop
/etc/init.d/logstash start
;;
*)
echo "Usage: $0 { start | stop |restart }"
;;
esac
exit 0
EOF

chmod +x /etc/init.d/logstash
chkconfig --add logstash
chkconfig logstash on
service logstash start


cat << 'EOF' > /etc/init.d/logstash-web
#!/bin/sh
### BEGIN INIT INFO
# Provides: Logstash Web 1.4 init.d script
# Required-Start: $network
# Required-Stop: $network
# Default-Start: 2 3 4 5
# Description: Starts the Logstash 1.4 Web
### END INIT INFO
export HOME=/opt/logstash
case "$1" in
'start')
/opt/logstash/bin/logstash web > /var/log/logstash-web.log 2>&1 & 
;;
'stop')
/usr/bin/kill -9 `ps auxww |grep logstash |grep -E 'web$' | awk '{print $2}'`
;;
'restart')
/etc/init.d/logstash-web stop
/etc/init.d/logstash-web start
;;
*)
echo "Usage: $0 { start | stop |restart }"
;;
esac
exit 0
EOF

chmod +x /etc/init.d/logstash-web
chkconfig --add logstash-web
chkconfig logstash-web on
service logstash-web start

IP_ADDR=$(ip a |grep inet\  |grep -v 127.0.0.1 |awk '{ print $2 }'| cut -d/ -f1)
echo
echo "Now, browse to http://$IP_ADDR:9292/"
echo "If there were any, your old files should be in $APP_ROOT/OLD_$MYRANDOM"
echo
echo "You can now use the service command on:"
echo "elasticsearch, logstash and logstash-web"
echo "e.g. service logstash-web restart"
echo
cd $ORIG_WKDIR

Thanks for sharing.