Install mongodb, elasticsearch, graylog2, logstash on Ubuntu 12.04

install_graylog.sh

#!/bin/bash

# WARNING: Don't use this in production since all passwords are kept at their default.

# mongodb
apt-key adv --keyserver keyserver.ubuntu.com --recv 7F0CEB10
echo -e "deb http://downloads-distro.mongodb.org/repo/ubuntu-upstart dist 10gen\n" > /etc/apt/sources.list.d/mongodb-10gen.list
apt-get update
apt-get install -y mongodb-10gen

# elastic search
curl -LO https://github.com/downloads/elasticsearch/elasticsearch/elasticsearch-0.19.8.deb
dpkg -i elasticsearch-0.19.8.deb

# graylog2
apt-get install -y openjdk-6-jre
mkdir -p /opt/graylog2

curl -OL https://github.com/downloads/Graylog2/graylog2-server/graylog2-server-0.9.6p1.tar.gz
tar -xvf graylog2-server-0.9.6p1.tar.gz
cp -r graylog2-server-0.9.6p1 /opt/graylog2

pushd /opt/graylog2
    ln -sf graylog2-server-0.9.6p1 graylog2-server
    cp graylog2-server/graylog2.conf.example /etc/graylog2.conf
popd

cat <<EOF | mongo
use graylog2
db.addUser("grayloguser", "123")
exit
EOF

# graylog2 upstart script
curl -OL https://raw.github.com/Graylog2/graylog2-server/master/misc/upstart/graylog2-server.conf
sed 's#/opt/graylog2-server#/opt/graylog2/graylog2-server#' graylog2-server.conf > /etc/init/graylog2-server.conf

# start graylog server
start graylog2-server

# graylog2 web interface
curl -OL https://github.com/downloads/Graylog2/graylog2-web-interface/graylog2-web-interface-0.9.6p1.tar.gz
tar -xvf graylog2-web-interface-0.9.6p1.tar.gz
cp -r graylog2-web-interface-0.9.6p1 /opt/graylog2

pushd /opt/graylog2
    ln -sf graylog2-web-interface-0.9.6p1 graylog2-web-interface
    pushd graylog2-web-interface
        apt-get install -y rubygems
        gem install bundler
        bundle install
    popd
popd


# web-frontend
# MONGOID_HOST=localhost MONGOID_PORT=27017 MONGOID_USERNAME=grayloguser MONGOID_PASSWORD=123  MONGOID_DATABASE=graylog2 /opt/graylog2/graylog2-web-interface/script/rails server -e production
# -> http://33.33.33.11:3000/


# logstash
curl -OL http://semicomplete.com/files/logstash/logstash-1.1.0-monolithic.jar
curl -OL http://logstash.net/docs/1.1.0/tutorials/10-minute-walkthrough/apache-parse.conf
curl -OL http://logstash.net/docs/1.1.0/tutorials/10-minute-walkthrough/apache_log.1
# java -jar logstash-1.1.0-monolithic.jar agent -f apache-parse.conf
# nc localhost 3333 < apache_log.1

On Ubuntu 12.04, when installing bundler (gem install bundler) I get this error message :

root@box# gem install bundler --no-ri --no-rdoc
ERROR: Loading command: install (LoadError)
no such file to load -- zlib
ERROR: While executing gem ... (NameError)
uninitialized constant Gem::Commands::InstallCommand

Did you do something not written here to avoid this?

Try

apt-get install zlib1g-dev

This package was already installed on my development box, maybe they are needed for rubygems? (There's also libssl-dev libreadline-gplv2-dev which got installed automatically when I created the vagrant box to test the setup above.)

I already had this package installed. I guess Ruby has not been compiled with the zlib support.

I solved this issue. Rubygems had been installed using RVM which was not enabled for the root account. Thanks for your help!

Does anything need to be done once the install script has been executed? Thanks.

I've ran the script, then ran MONGOID_HOST=localhost MONGOID_PORT=27017 MONGOID_USERNAME=grayloguser MONGOID_PASSWORD=123 MONGOID_DATABASE=graylog2 /opt/graylog2/graylog2-web-interface/script/rails server -e production.

I can create an account, but then when I log in, I get the message "Could not connect to ElasticSearch", any ideas?

@SteveEdson, it's because the link to elasticsearch DEB is outdated. Use this one instead:

http://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-0.20.5.deb