Configuring Logstash

After successfully installing Logstash, it is important to configure it for optimal performance and seamless integration with OMEGAMON® AI Insights.

1. Edit the logstash_omaiv2.conf configuration file from the delivery_directory/logstash directory and change every variable for elasticsearch with your Elasticsearch host name.

   where delivery_directory is the root directory of the uncompressed delivery package.

   After configuring, copy the logstash_omaiv2.conf configuration file to the kmua_directory/logstash/config directory.

   where kmua_directory refers to the location where you installed the executable kmua for OMEGAMON AI Insights.

2. Copy the following files into the kmua_directory/logstash/config directory from the delivery repository (delivery_kmua_v2.1.0.0.tar.gz):
   • query-template-cpu-time.json
   • query-template-lpar.json
   • query-template-lpar-network.json
   • query-template-tcp.json
3. In the startup.options file, located in the kmua_directory/logstash/config/ directory, configure the JVM memory according to the ingestion load and the number of end users.
   LS_JAVA_OPTS="-Xmx2g -Xms2g"
4. Create a run script startlogstash.sh in kmua_directory. Use the following script for the file content.

   export LS_JAVA_HOME=/usr/lib/jvm/java-17-openjdk-17.0.7.0.7-3.el8.s390x 
   cd path_to_logstash 
   rm -f nohup.out 
   rm -f nohup.err 
   nohup ./bin/logstash -f ./config/logstash_omaiv2.conf > nohup.out 2>
   nohup.err < /dev/null & 
    

5. Run the script startlogstash.sh to start Logstash.
6. To reduce disk space and CPU overhead considerations, you can filter some LPARs during capture to perform Machine Learning processing only on the LPARs of interest, usually the production LPARs. You can modify the Logstash configuration file omegamon.conf to include or exclude a list of LPARs.
   Use the following code to modify the output section.

   Production LPAR filter inclusion

   output {
     if [table_name] in [ "km5wlmclrx" , "ascpuutil" ]  {
       if [lpar_name] in [ "lparname1" , "lparname2" , "lparname3" ...  ]  {
         elasticsearch {
           id => "elasticsearch1"
           hosts => [elastic_url:elastic_port"]
           user => elastic_username
           password => elastic_password
           index => "%{[@metadata][index_namespace]}-%{product_code}-%{table_name}-ds"
           action => "create"
           manage_template => false
         }
       }
     }

   Note: When performing LPAR filtering, the filtered data will not be stored in the OMEGAMON AI Insights database, so it will not be possible to retrieve the filtered data later. If necessary, consider LPAR filter exclusion.

   Production LPAR filter exclusion

   output {
     if [table_name] in [ "km5wlmclrx" , "ascpuutil" ]  {
       if [lpar_name] not in [ "lparname1" , "lparname2" , "lparname3" ...  ]  {
         ...
       }
     }