As a DevOps team member, I want to install Elastic Stack (v7.9.1 by default) so that all application and system logs are collected centrally for searching, visualizing, analyzing and reporting purpose
- Infrastructre is setup in Docker swarm mode
- All containerized custom applications are designed to start with GELF log driver in order to send logs to Elastic Stack
- NOTE: for cases where filebeat is to be run in "Docker for AWS": you will need to turn off auditd module in the filebeat config. Otherwise, filebeat service will fail to run
The architecture used is shown in the table below
High level design | In scope | Not in scope |
---|---|---|