#!/bin/bash 
bash <(curl -s https://nifty.sh/install/centos7/docker.sh)

yum install -y epel-release
yum install -y git 

mkdir /var/docker
cd /var/docker 
git clone https://github.com/deviantony/docker-elk.git
cd docker-elk

clear

echo "

  When you continue, you will be in vim. 
  Under volumes: for the logstash service add the following (copy indent spaces and it should fit):

      - type: bind
        source: ./logstash/patterns
        target: /usr/share/logstash/patterns
        read_only: true


  Under ports for logstash add:

      - \"5140:5140/udp\"


then save and quit
"
read
vim docker-compose.yml

mkdir logstash/patterns

cat << EOF > logstash/patterns/nginx_access
METHOD (OPTIONS|GET|HEAD|POST|PUT|DELETE|TRACE|CONNECT)
NGINX_ACCESS %{IPORHOST:visitor_ip} - %{USERNAME:remote_user} \[%{HTTPDATE:time_local}\] \"%{DATA:server_name}\" \"%{METHOD:method} %{URIPATHPARAM:path} HTTP/%{NUMBER:http_version}\" %{INT:status} %{INT:body_bytes_sent:int} \"%{DATA:referer}\" %{QS:user_agent} %{NUMBER:request_time:float} (?:-|%{NUMBER:upstream_response_time:float})
EOF


cat <<EOF > logstash/pipeline/logstash.conf
input {
	tcp {
		port => 5000
	}
	syslog {
		port => 5140
	}
}

## Add your filters / logstash plugins configuration here
filter {
	if [program] == "nginx_access" {
		grok {
			patterns_dir => "/usr/share/logstash/patterns"
			match => {
				"message" => "%{NGINX_ACCESS}"
			}
		}

		date {
		      match => ["time_local", "dd/MMM/YYYY:HH:mm:ss Z"]
		      target => "@timestamp"
		      remove_field => "time_local"
		}

	}
}

output {
	elasticsearch {
		hosts => "elasticsearch:9200"
		user => "elastic"
		password => "changeme"
	}
}
EOF



# Set xpack to free version
sed -i 's/trial/basic/' elasticsearch/config/elasticsearch.yml

PW=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 12 | head -n 1)
MYIP=$(curl -s http://zxx.dk/clean/)

for f in docker-compose.yml docker-stack.yml extensions/app-search/config/app-search.yml extensions/app-search/app-search-compose.yml extensions/apm-server/config/apm-server.yml kibana/config/kibana.yml logstash/pipeline/logstash.conf logstash/config/logstash.yml ; do 
  echo $f
  sed -i "s/changeme/$PW/g" $f
done

docker-compose up -d

if [ -f "/etc/sysconfig/iptables" ]; then
  iptables-save > /etc/sysconfig/iptables
fi

if [ -f "/etc/iptables/rules.v4" ]; then
  iptables-save > /etc/iptables/rules.v4
fi

echo $PW > ELK-PASSWORD.txt

echo "You have an ELK stack now. You must"
echo
echo
echo
echo
echo <<EOF

  Kibana URL: http://$MYIP:5601
  Username: elastic
  Password: $PW

  For shipping nginx logs, simply add this to nginx config: 

---- SNIP ----
  log_format logstash '\$remote_addr - \$remote_user [\$time_local] "\$host" '
                      '"\$request" \$status \$body_bytes_sent '
                      '"\$http_referer" "\$http_user_agent" \$request_time \$upstream_response_time';
  access_log syslog:server=$MYIP:5140,tag=nginx_access logstash;
---- /SNIP ----


  WAIT! You need to configure iptables on this machine too (assuming fbhlab). 
  I recommend adding these: 
  -A INPUT -s YOUR.CURRENT.IP/32 -j ACCEPT
  -A INPUT -s SERVER.TO.COLLECT.FROM.IP/32 -j ACCEPT

  They should be added to /etc/sysconfig/iptables around line 45 where the other ACCEPTs are.
  Dont forget systemctl restart iptables
  
  Happy logging!


EOF

