(Optional) Connecting the ELK Server to eSight

Prerequisites

• The ELK server has been deployed by the ELK integrator.
• The ELK integrator has deployed the ELK client Logstash on the active and standby eSight servers. The installation path, IP address, and used port number of Logstash do not conflict with those of eSight. For the Logstash, the disk space usage does not exceed 600 MB and the memory space usage does not exceed 500 MB.

  For details about ports used by eSight, see the eSight Communication Matrix.

  Perform the following steps to obtain eSight VxxxRxxxCxx Communication Matrix:

  1. Log in to the Huawei technical support website.
     • For enterprise users, visit https://support.huawei.com/enterprise.
     • For carrier users, visit https://support.huawei.com/carrier.
  2. Enter the keyword eSight VxxxRxxxCxx Communication Matrix, and click Search.

     Replace VxxxRxxxCxx with the actual version number.

  3. Download eSight VxxxRxxxCxx Communication Matrix in the search result.

Procedure

1. Log in to the active eSight server as the root user.
2. Configure the patch for the Logstash to receive run logs of eSight. The Logstash-2.4.0 is used as an example.
   1. Open the elk_input.conf file.

      cd /opt/logstash/logstash-2.4.0/config/logstash-shipper

      In the command, /opt/logstash/logstash-2.4.0 is the installation directory of the Logstash. Change it based on the site requirements.

      vi elk_input.conf

   2. Press I to enter the editing mode.
   3. Set path to the run log path of eSight.

      input {
          file {
              type => "messages"
              path => [
                  "/opt/eSight/AppBase/var/iemp/log/root.log"
              ]
              sincedb_write_interval => 15
          }
          heartbeat{
              interval => 10
              type => "heartbeat"
          }
      }

      In the information, /opt/eSight/ indicates the eSight installation directory. Change it based on the site requirements.

      At least the key log file root.log is collected. Other log files can also be collected.

   4. Press Esc to exit the editing mode, and run the :wq command to save and exit the file.
   5. Run the following command to restart the ELK agent.

      sh /opt/logstash/logstash-2.4.0/bin/stop_shipper.sh

      sh /opt/logstash/logstash-2.4.0/bin/start_shipper.sh

      In the command, /opt/logstash/logstash-2.4.0 is the installation directory of the Logstash. Change it based on the site requirements.

3. Log in to the standby eSight server as the root user and perform 2.
4. Log in to the ELK server and check whether the ELK receives run logs of eSight.