This project is no longer maintained.

If you're interested in taking it over, we'd love to hear from you. Email [email protected], or check out one of its maintained forks.

A complete Logstash stack on AWS OpsWorks

UPDATE: I wrote a blog post that will help you set this up.

This is a bunch of cookbooks that will allow you to run a complete Logstash setup on a scalable AWS OpsWorks stack. At Springest we use it to ship from 250 to about 1k log entries per second, depending on the RPM on our 18 servers.

A screenshot of Kibana3, included in the cookbooks.

The stack's layers

A screenshot of the layers in AWS OpsWorks

A RabbitMQ cluster layer (Ubuntu) – Agents wil ship their logs to this cluster and the Logstash server cluster uses it as an input source.
An ElasticSearch cluster layer (Amazon Linux) – All log messages are stored and indexed here.
A LogStash cluster layer (Ubuntu) – Takes the messages from the RabbitMQ fanout and puts them into ElasticSearch.
A Kibana server (Ubuntu) - An Angular.js interface on top of ElasticSearch to search, graph etc.

Setting up your stack

Set git://github.com/Springest/opsworks-logstash.git as a repository URL for your custom cookbooks.
Use the following Chef custom JSON:

{
    "chef_environment": "production",
    "elasticsearch": {
        "cluster": {
            "name": "logstash"
        },
        "basic_auth": {
            "user": "<es username here>",
            "password": "<es password here>"
        }
    },
    "rabbitmq": {
        "cluster": true,
        "erlang_cookie": "<any random alphanumeric string will do>"
    },
    "rabbitmq_cluster": {
        "user": "<rabbitmq username here>",
        "password": "<rabbitmq password here>"
    },
    "kibana": {
        "webserver": "nginx",
        "webserver_hostname": "<your kibana domain, eg: kibana.example.com>",
        "web_user": "<kibana username here>",
        "web_password": "<kibana password here>",
        "es_port": "9200",
        "es_role": "elasticsearch",
        "es_server": "<es loadbalancer address here>",
        "es_user": "<es username here>",
        "es_password": "<es password here>"
    },
    "logstash": {
        "elasticsearch_cluster": "logstash",
        "server": {
            "install_rabbitmq": false,
            "enable_embedded_es": false,
            "elasticsearch_role": "elasticsearch",
            "inputs": [
                {
                    "rabbitmq": {
                        "exchange": "rawlogs",
                        "user": "<rabbitmq username here>",
                        "password": "<rabbitmq password here>",
                        "host": "<IP or LB address of your rabbitmq server/cluster>",
                        "type": "all"
                    }
                }
            ]
        }
    }
}