List of commands run when installing Rancher, Elastic, Kibana, Logging and eventually Metricbeat

commandsForRancher.sh

# This is a list of commands used when installing Rancher plus Elasticsearch, Kibana and Logging

# Start up Rancher
docker run -d --restart=unless-stopped \
  -p 80:80 -p 443:443 -p 5601:5601\
  --privileged \
  rancher/rancher:latest

# get the container ID
export CONTAINER_ID=$(docker ps | grep rancher | awk '{ print $1 }')

# get password to use at http://localhost
export ORIGRANCHERPASS=$(docker logs $CONTAINER_ID 2>&1 | grep "Bootstrap Password" | awk '{ print $6 }')

# copy a couple of files to the Rancher container for use later
docker cp estestdata.sh $CONTAINER_ID:/var/lib/rancher/estestdata.sh
docker cp createDebugContainer.sh $CONTAINER_ID:/var/lib/rancher/createDebugContainer.sh

# log into container and create a directory owned by rancher. Will be used as the HostPath PV later.
docker exec -it $CONTAINER_ID /bin/bash
mkdir /home/ftpv1
chown rancher /home/ftpv1

# go to http://localhost and login with the above password.
# Accept the default admin password that it generates, but copy that somewhere
export RANCHERPASS=<paste password>

echo $RANCHERPASS

# Install Elasticsearch from the UI
# You have to modify the yaml to set two values:
# replicas: 1
# minimumMasterNodes:1

# Viewing progress when installing ES

kubectl describe -n es pod elasticsearch-master-0  # this will tell you that it's pulling an image before actually running

kubectl get pods -n es  # you're looking to see a state of Running before you can view the logs from a pod

kubectl logs -n es elasticsearch-master-0  # view the logs from the primary master pod

# Test connection to ES
# From the rancher container get elastic user password:
export ESPASS=$(kubectl get secret -n es elasticsearch-master-credentials -o=jsonpath='{.data.password}' | base64 --decode)
echo $ESPASS

# Port-forward to elasticsearch
kubectl -n es port-forward  svc/elasticsearch-master 9200 &

# curl to test connection to ES
curl -vvv --insecure -u "elastic:$ESPASS" https://localhost:9200

# Now install Kibana from the UI with the defaults

# Port forward for Kibana
kubectl -n es port-forward  svc/kibana-kibana 5601 --address 0.0.0.0 &

# Go to the Kibana UI and log in as user elastic with the password from $ESPASS env varirable we created above.
# You won't see any data currently, but we will fix that. Put the following commands into a file:
#!/bin/bash
ESPASS=$(kubectl get secrets --namespace=es elasticsearch-master-credentials -ojsonpath='{.data.password}' | base64 -d)
curl --insecure -X POST "https://localhost:9200/mydocuments/_doc/" -u "elastic:$ESPASS" -H 'Content-Type: application/json' -d"
{
    \"test\" : true,
    \"post_date\" : \"$(date -Ins)\"
}"
curl --insecure -X POST "https://localhost:9200/mydocuments/_doc/" -u "elastic:$ESPASS" -H 'Content-Type: application/json' -d"
{
    \"test\" : true,
    \"post_date\" : \"$(date -Ins)\"
}"
curl --insecure -X POST "https://localhost:9200/mydocuments/_doc/" -u "elastic:$ESPASS" -H 'Content-Type: application/json' -d"
{
    \"test\" : true,
    \"post_date\" : \"$(date -Ins)\"
}"
curl --insecure -X POST "https://localhost:9200/mydocuments/_doc/" -u "elastic:$ESPASS" -H 'Content-Type: application/json' -d"
{
    \"test\" : true,
    \"post_date\" : \"$(date -Ins)\"
}"

# Now run that file
# In Kibana, you should now see the index named "mydocuments"
# Create a data view and then in Discover you can view the data.

# Now in the Rancher GUI, install the Logging app with the defaults

# Once that's done, copy elastic secret to the logging namespace
# This is required for what we're doing next.
kubectl get secret elasticsearch-master-credentials --namespace=es -o yaml | sed 's/namespace: .*/namespace: cattle-logging-system/' | kubectl apply -f -

# Create a ClusterOutput and ClusterFlow
#ClusterOutput:

#name: ftes
#target host: elasticsearch-master.es.svc.cluster.local
#Access: 
#user: elastic
#Password from Secret: elasticsearch-master-credentials (copied above)
#De-select "Verify SSL"

#ClusterFlow:
#Pod Label Key: app
#Pod Label Value: *
#Outputs: ftes

# Now you should see a new index, though there's no timestamp field, so it's not useful. Fixing that is for another day
# Elasticsearch hostname:
elasticsearch-master.es.svc.cluster.local