Prerequisites

• Docker and cocker-compose is required.

Defining our Kibana Services

Write our docker-compose file for kibana 6.2.3

...

input {
 tcp {
    port => 5400
    codec => json
 }
 http {
    id => "http"
    port => 3000
 }
}
output {
  stdout {
    codec => rubydebug
  }
  elasticsearch {
    hosts => "elasticsearch:9200"
    user => elastic
    password => changeme
  }
}

Starting and Stoping Kibana

See the status of the containers by issuing the following command:

...

Stop our containers

docker-compose stop

Connect to our Kibana Instance

Browse to http://localhost:5601/

Loading Sample Data

Pushing directly to Elasticsearch

You can push to elasticsearch directly using curl as follows:

...

#!/usr/bin/env bash

SOURCE_URL=http://spa.jmehan.com/info/
ELASTIC_URL=localhost:9200/spa/1
TMP_FILE=spa.tmp


HEADER1="Content-Type: application/json"
HEADER2="Cache-Control: no-cache"


curl -L $SOURCE_URL -o $TMP_FILE
curl -s -XPOST -H "$HEADER1" -H "$HEADER2" $ELASTIC_URL --data-binary @$TMP_FILE


rm $TMP_FILE

Manipulating ElasticSearch data

Besides adding data to ElasticSearch, you can search it and delete entries

Examples

GET myindex/_search
{
    "query": {
        "range" : {
            "temperature" : {
                "lte" : -10
            }
        }
    }
}

POST myindex/_delete_by_query
{
  "query": { 
    "range" : {
            "temperature" : {
                "lte" : -10
            }
    }
  }
}

Using the TCP Input Plugin

We will use the logstash TCP plugin to push JSON data into elasticsearch. 

...

nc -c localhost 5400 < test.json

Using the HTTP Input Plugin

curl -H "content-type: application/json" -XPUT 'http://127.0.0.1:3000/twitter/tweet/1' -d '{

    "user" : "kimchy",

    "post_date" : "2009-11-15T14:12:12",

    "message" : "trying out Elasticsearch"

}'

...

curl -XPUT 'http://127.0.0.1:3000/twitter/tweet/1' -d 'hello'

References

...