{"action":"created","comment":{"url":"https://api.github.com/repos/elastic/stack-docs/pulls/comments/192215761","pull_request_review_id":124926514,"id":192215761,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDE5MjIxNTc2MQ==","diff_hunk":"@@ -0,0 +1,871 @@\n+[[get-started-elastic-stack]]\n+== Getting started with the {stack}\n+\n+Looking for an {stack} (\"ELK tutorial\") that shows how to set up the {stack}? In\n+this tutorial, you learn how to get up and running quickly. First you install\n+the core open source products:\n+\n+* <<install-elasticsearch,{es}>>\n+* <<install-kibana,{kib}>>\n+* <<install-beats,{beats}>>\n+* <<install-logstash,{ls}>>\n+\n+Then you learn how to implement a system monitoring solution that uses\n+{metricbeat} to collect server metrics and ship the data to {es}, where you can\n+search and visualize the data by using {kib}. After you get the basic setup\n+working, you add {ls} for additional parsing.\n+\n+To get started, you can install the {stack} on a single VM or even on your\n+laptop. \n+ \n+IMPORTANT: Implementing security is a critical step in setting up the {stack}.\n+To get up and running quickly with a sample installation, you skip those steps\n+right now, but keep in mind that security is a critical component of your\n+deployment.\n+\n+// REVIEWERS: I haven't discussed security because it really complicates the learning\n+// experience. I think there's a value to teaching users how to set up a basic\n+// installation (and get the various components talking to each other) before\n+// adding security.\n+\n+[float]\n+[[install-prereqs]]\n+=== Before you begin\n+\n+* See the https://www.elastic.co/support/matrix[Elastic Support\n+Matrix] for information about supported operating systems and product\n+compatibility.\n+\n+* Verify that your system meets the\n+https://www.elastic.co/support/matrix#matrix_jvm[minimum JVM requirements] for\n+{ls} and {es}.\n+\n+// REVIEWERS: In the old version of this doc, we mentioned specific versions and\n+// pointed users to the download pages, but I think that might be too much hand\n+// holding. IMO, the support matrix should be the place where users go to\n+// make sure they meet system requirements. Is there anything else we need to\n+// say here about Java requirements here that aren't covered in the matrix?\n+\n+\n+[float]\n+[[install-elasticsearch]]\n+=== Install {es}\n+\n+https://www.elastic.co/products/elasticsearch[{es}] is a real-time,\n+distributed storage, search, and analytics engine. It can be used for many\n+purposes, but one context where it excels is indexing streams of semi-structured\n+data, such as logs or decoded network packets.\n+\n+To download and install {es}, open a terminal window and use the commands that\n+work with your system (<<deb, deb>> for Debian/Ubuntu, <<rpm, rpm>> for\n+Redhat/Centos/Fedora, <<mac, mac>> for OS X, and <<win, win>> for Windows):\n+\n+// REVIEWERS: Should we add Linux to this list? If so, how do the commands differ\n+// from mac OS?\n+\n+[[deb]]*deb:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {elasticsearch_version} of {es} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+[\"source\",\"sh\",subs=\"attributes\"]\n+----\n+curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-{elasticsearch_version}.deb\n+sudo dpkg -i elasticsearch-{elasticsearch_version}.deb\n+sudo /etc/init.d/elasticsearch start\n+----\n+\n+endif::[]\n+\n+[[rpm]]*rpm:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {stack-version} of {es} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-{elasticsearch_version}.rpm\n+sudo rpm -i elasticsearch-{elasticsearch_version}.rpm\n+sudo service elasticsearch start\n+----------------------------------------------------------------------\n+\n+endif::[]\n+\n+[[mac]]*mac:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {stack-version} of {es} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-{elasticsearch_version}.zip\n+unzip elasticsearch-{elasticsearch_version}.zip\n+cd elasticsearch-{elasticsearch_version}\n+./bin/elasticsearch\n+----------------------------------------------------------------------\n+\n+endif::[]\n+\n+[[win]]*win:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {stack-version} of {es} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+. Download the {es} {elasticsearch_version} Windows zip file from the\n+https://www.elastic.co/downloads/elasticsearch[{es} download] page.\n+\n+. Extract the contents of the zip file to a directory on your computer, for\n+example, `C:\\Program Files`.\n+\n+. Open a command prompt as an Administrator and navigate to the directory that\n+contains the extracted files, for example:\n++\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+cd C:\\Program Files\\elasticsearch-{elasticsearch_version}\n+----------------------------------------------------------------------\n+\n+. Start {es}:\n++\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+bin\\elasticsearch.bat\n+----------------------------------------------------------------------\n+\n+endif::[]\n+\n+For other operating systems, go to the\n+https://www.elastic.co/downloads/elasticsearch[{es} download] page.\n+\n+To learn more about installing, configuring, and running {es}, read the\n+https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html[{es} Reference].\n+\n+[float]\n+==== Make sure {es} is up and running\n+\n+\n+To test that the {es} daemon is up and running, try sending an HTTP GET\n+request on port 9200.\n+\n+[source,shell]\n+----------------------------------------------------------------------\n+curl http://127.0.0.1:9200\n+----------------------------------------------------------------------\n+\n+On Windows, if you don't have cURL installed, point your browser to the URL.\n+\n+You should see a response similar to this:\n+\n+[\"source\",\"sh\",subs=\"attributes\"]\n+----------------------------------------------------------------------\n+{\n+  \"name\" : \"yTlRWwX\",\n+  \"cluster_name\" : \"elasticsearch\",\n+  \"cluster_uuid\" : \"C6WovRosQBq65ZxUHvbYOQ\",\n+  \"version\" : {\n+    \"number\" : \"{elasticsearch_version}\",\n+    \"build_flavor\" : \"default\",\n+    \"build_type\" : \"zip\",\n+    \"build_hash\" : \"a0ac115\",\n+    \"build_date\" : \"2018-05-16T03:14:57.689722Z\",\n+    \"build_snapshot\" : false,\n+    \"lucene_version\" : \"7.3.0\",\n+    \"minimum_wire_compatibility_version\" : \"5.6.0\",\n+    \"minimum_index_compatibility_version\" : \"5.0.0\"\n+  },\n+  \"tagline\" : \"You Know, for Search\"\n+}\n+----------------------------------------------------------------------\n+\n+\n+[float]\n+[[install-kibana]]\n+=== Install {kib}\n+\n+https://www.elastic.co/products/kibana[{kib}] is an open source analytics and\n+visualization platform designed to work with {es}. You use {kib} to search,\n+view, and interact with data stored in {es} indices. You can easily perform\n+advanced data analysis and visualize your data in a variety of charts, tables,\n+and maps.\n+\n+To get started, we recommend that you install {kib} on the same server as {es},\n+but it is not required. If you install the products on different servers, you'll\n+need to change the URL (IP:PORT) of the {es} server in the {kib} configuration\n+file, `config/kibana.yml`, before starting {kib}.\n+\n+To download and install {kib}, open a terminal window and use the commands that\n+work with your system:\n+\n+*deb or rpm:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {stack-version} of {kib} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+curl -L -O https://artifacts.elastic.co/downloads/kibana/kibana-{kibana_version}-linux-x86_64.tar.gz\n+tar xzvf kibana-{kibana_version}-linux-x86_64.tar.gz\n+cd kibana-{kibana_version}-linux-x86_64/\n+./bin/kibana\n+----------------------------------------------------------------------\n+\n+endif::[]\n+\n+*mac:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {stack-version} of {kib} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+curl -L -O https://artifacts.elastic.co/downloads/kibana/kibana-{kibana_version}-darwin-x86_64.tar.gz\n+tar xzvf kibana-{kibana_version}-darwin-x86_64.tar.gz\n+cd kibana-{kibana_version}-darwin-x86_64/\n+./bin/kibana\n+----------------------------------------------------------------------\n+\n+endif::[]\n+\n+*win:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {stack-version} of {kib} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+. Download the {kib} {kibana_version} Windows zip file from the\n+https://www.elastic.co/downloads/kibana[{kib} download] page.\n+\n+. Extract the contents of the zip file to a directory on your computer, for\n+example, `C:\\Program Files`.\n+\n+. Open a command prompt as an Administrator and navigate to the directory that\n+contains the extracted files, for example:\n++\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+cd C:\\Program Files\\kibana-{kibana_version}-windows\n+----------------------------------------------------------------------\n+\n+. Start {kib}:\n++\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+bin\\kibana.bat\n+----------------------------------------------------------------------\n+\n+endif::[]\n+\n+For other operating systems, go to the\n+https://www.elastic.co/downloads/kibana[{kib} download] page.\n+\n+To learn more about installing, configuring, and running {kib}, read the\n+https://www.elastic.co/guide/en/kibana/current/index.html[{kib} Reference].\n+\n+[float]\n+==== Launch the {kib} web interface\n+\n+To launch the {kib} web interface, point your browser to port 5601. For example,\n+http://127.0.0.1:5601[http://127.0.0.1:5601].\n+\n+[float]\n+[[install-beats]]\n+=== Install {beats}\n+\n+The {beats} are open source data shippers that you install as agents on your\n+servers to send operational data to {es}. {beats} can send data directly to {es}\n+or via {ls}, where you can further process and enhance the data.\n+\n+Each Beat is a separately installable product. In this tutorial, you learn how\n+to install and run {metricbeat} with the `system` module enabled to collect system\n+metrics.\n+\n+To learn more about installing and configuring other {beats}, see the Getting\n+Started documentation:\n+\n+[options=\"header\"]\n+|=======================\n+|Elastic {beats} | To capture\n+|{packetbeat-ref}/packetbeat-getting-started.html[{packetbeat}] |Network traffic\n+|{filebeat-ref}/filebeat-getting-started.html[{filebeat}] |Log files\n+|{metricbeat-ref}/metricbeat-getting-started.html[{metricbeat}] |Metrics\n+|{winlogbeat-ref}/winlogbeat-getting-started.html[{winlogbeat}] |Windows event logs\n+|{auditbeat-ref}/auditbeat-getting-started.html[{auditbeat}] |Audit data\n+|{heartbeat-ref}/heartbeat-getting-started.html[{heartbeat}] |Uptime monitoring\n+|=======================\n+\n+\n+[float]\n+[[install-metricbeat]]\n+==== Install {metricbeat}\n+\n+To download and install {metricbeat}, open a terminal window and use the commands\n+that work with your system:\n+\n+*deb:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {version} of {metricbeat} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+------------------------------------------------\n+curl -L -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-{version}-amd64.deb\n+sudo dpkg -i metricbeat-{version}-amd64.deb\n+------------------------------------------------\n+\n+endif::[]\n+\n+*rpm:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {version} of {metricbeat} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+------------------------------------------------\n+curl -L -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-{version}-x86_64.rpm\n+sudo rpm -vi metricbeat-{version}-x86_64.rpm\n+------------------------------------------------\n+\n+endif::[]\n+\n+*mac:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {version} of {metricbeat} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+------------------------------------------------\n+curl -L -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-{version}-darwin-x86_64.tar.gz\n+tar xzvf metricbeat-{version}-darwin-x86_64.tar.gz\n+------------------------------------------------\n+\n+endif::[]\n+\n+*win:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {version} of {metricbeat} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+. Download the {metricbeat} Windows zip file from the\n+https://www.elastic.co/downloads/beats/metricbeat[{metricbeat} download] page.\n+\n+. Extract the contents of the zip file into `C:\\Program Files`.\n+\n+. Rename the ++metricbeat-{version}-windows++ directory to ++{metricbeat}++.\n+\n+. Open a PowerShell prompt as an Administrator (right-click the PowerShell icon\n+and select *Run As Administrator*).\n+\n+. From the PowerShell prompt, run the following commands to install {metricbeat}\n+as a Windows service:\n++\n+[source,shell]\n+----------------------------------------------------------------------\n+PS > cd 'C:\\Program Files\\Metricbeat'\n+PS C:\\Program Files\\Metricbeat> .\\install-service-metricbeat.ps1\n+----------------------------------------------------------------------\n++\n+NOTE: If script execution is disabled on your system, set the execution policy\n+for the current session to allow the script to run. For example: `PowerShell.exe\n+-ExecutionPolicy UnRestricted -File .\\install-service-metricbeat.ps1`.\n+\n+endif::[]\n+\n+For other operating systems, go to the\n+https://www.elastic.co/downloads/beats[{beats} download] page.\n+\n+[float]\n+[[ship-system-logs]]\n+==== Ship system metrics to {es}\n+\n+{metricbeat} provides pre-built modules that you can use to rapidly implement\n+and deploy a system monitoring solution, complete with sample dashboards and\n+data visualizations, in about 5 minutes. \n+\n+In this section, you learn how to run the `system` module to collect metrics\n+from the operating system and services running on your server.\n+\n+*Before you begin*: Verify that {es} and {kib} are running and that {es} is\n+ready to receive data from {metricbeat}.\n+\n+To set up the `system` module and start collecting system metrics:\n+\n+. In the {metricbeat} install directory, enable the `system` module:\n++\n+*deb and rpm:*\n++\n+[source,yaml]\n+----\n+sudo metricbeat modules enable system\n+----\n++\n+*mac:*\n++\n+[source,yaml]\n+----\n+./metricbeat modules enable system\n+----\n++\n+*win:*\n++\n+[source,yaml]\n+----\n+PS C:\\Program Files\\Metricbeat> metricbeat.exe modules enable system\n+----\n+\n+. Set up the initial environment:\n++\n+*deb and rpm:*\n++\n+[source,yaml]\n+----\n+sudo metricbeat setup -e\n+----\n++\n+*mac:*\n++\n+[source,yaml]\n+----\n+./metricbeat setup -e\n+----\n++\n+*win:*\n++\n+[source,yaml]\n+----\n+PS C:\\Program Files\\Metricbeat> metricbeat.exe setup -e\n+----\n++\n+The `setup` command loads the {kib} dashboards. If the dashboards are already\n+set up, omit this command. The `-e` flag is optional and sends output to\n+standard error instead of syslog.\n+\n+. Start {metricbeat}:\n++\n+*deb and rpm:*\n++\n+[source,yaml]\n+----\n+sudo service metricbeat start\n+----\n++\n+*mac:*\n++\n+[source,yaml]\n+----\n+./metricbeat -e\n+----\n++\n+*win:*\n++\n+[source,yaml]\n+----\n+PS C:\\Program Files\\Metricbeat> Start-Service metricbeat\n+----\n+\n+\n+{metricbeat} runs and starts sending system metrics to {es}. \n+\n+[float]\n+[[visualize-system-metrics]]\n+==== Visualize system metrics in {kib}\n+\n+To visualize system metrics, open your browser and navigate to the {metricbeat}\n+system overview dashboard: http://localhost:5601/app/kibana#/dashboard/Metricbeat-system-overview\n+\n+TIP: If you don’t see data in {kib}, try changing the date range to a larger\n+range. By default, {kib} shows the last 15 minutes. If you see errors, make\n+sure {metricbeat} is running, then refresh the page.\n+\n+[role=\"screenshot\"]\n+image::images/metricbeat-system-overview.png[{metricbeat} system overview]\n+\n+Click *Host Overview* to see detailed metrics about the selected host.\n+\n+[role=\"screenshot\"]\n+image::images/metricbeat-system-host-details.png[{metricbeat} host overview]\n+\n+Now that you know how to set up the simplest architecture for the {stack}--one\n+or more {beats} sending event data directly to an {es} instance running on the\n+same server--let's add {ls}.\n+\n+[float]\n+[[install-logstash]]\n+\n+=== Install {ls}\n+\n+https://www.elastic.co/products/logstash[{ls}] is a powerful tool that\n+integrates with a wide variety of deployments. It offers a large selection of\n+plugins to help you parse, enrich, transform, and buffer data from a variety of\n+sources.\n+\n+To download and install {ls}, open a terminal window and use the commands that\n+work with your system:\n+\n+*deb:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {stack-version} of {ls} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+curl -L -O https://artifacts.elastic.co/downloads/logstash/logstash-{logstash_version}.deb\n+sudo dpkg -i logstash-{logstash_version}.deb\n+----------------------------------------------------------------------\n+\n+endif::[]\n+\n+*rpm:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {stack-version} of {ls} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+curl -L -O https://artifacts.elastic.co/downloads/logstash/logstash-{logstash_version}.rpm\n+sudo rpm -i logstash-{logstash_version}.rpm\n+----------------------------------------------------------------------\n+\n+endif::[]\n+\n+*mac:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {stack-version} of {ls} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+curl -L -O https://artifacts.elastic.co/downloads/logstash/logstash-{logstash_version}.zip\n+unzip logstash-{logstash_version}.zip\n+----------------------------------------------------------------------\n+\n+endif::[]\n+\n+*win:*\n+\n+ifeval::[\"{release-state}\"==\"unreleased\"]\n+\n+Version {stack-version} of {ls} has not yet been released.\n+\n+endif::[]\n+\n+ifeval::[\"{release-state}\"!=\"unreleased\"]\n+\n+. Download the {ls} {logstash_version} Windows zip file from the\n+https://www.elastic.co/downloads/logstash[{ls} download] page.\n+\n+. Extract the contents of the zip file to a directory on your computer, for\n+example, `C:\\Program Files`.\n+\n+endif::[]\n+\n+For other operating systems, go to the\n+https://www.elastic.co/downloads/logstash[{ls} download] page.\n+\n+To learn more about installing, configuring, and running {ls}, read the\n+{logstash-ref}/index.html[{ls} Reference].\n+\n+// REVIEWERS: I've removed the info about updating the beats input plugin for\n+// Logstah because this tutorial tells people to download the latest version\n+// and in most cases the input plugin version will be recent...so I'm not sure\n+// we need to cover that here.\n+\n+[float]\n+==== Configure {metricbeat} to send events to {ls}\n+\n+{metricbeat} sends events to {es} by default. To send events to {ls}, modify the\n+{metricbeat} configuration file, `metricbeat.yml`. You'll find this file under\n+the {metricbeat} install directory, or `/etc/metricbeat` for rpm and deb.\n+\n+Disable the `output.elasticsearch` section by commenting it out, then enable\n+the `output.logstash` section by uncommenting it: \n+\n+[source,yaml]\n+----\n+#-------------------------- Elasticsearch output ------------------------------\n+#output.elasticsearch:\n+  # Array of hosts to connect to.\n+  #hosts: [\"localhost:9200\"]\n+.\n+.\n+.\n+#----------------------------- Logstash output --------------------------------\n+output.logstash:\n+  # The Logstash hosts\n+  hosts: [\"localhost:5044\"]\n+----\n+\n+\n+Save the file, then restart {metricbeat} to apply the changes.\n+\n+\n+[float]\n+[[logstash-setup]]\n+==== Configure {ls} to read from the {beats} input\n+\n+{ls} provides {logstash-ref}/input-plugins.html[input plugins] for reading from\n+a variety of inputs. In this tutorial, you create a {ls} pipeline configuration\n+that reads from the {beats} input and sends events to the {es} output.\n+\n+To configure {ls}:\n+\n+. Create a new {ls} pipeline configuration file called `logstash.conf` that\n+contains:\n++\n+--\n+* An input stage that configures {ls} to listen on port 5044 for incoming {beats}\n+connections.\n+* An output stage that indexes events into {es}. The output stage also\n+configures {ls} to write to the {metricbeat} index.\n+--\n++\n+For example:\n++\n+[source,ruby]\n+----\n+input {\n+  beats {\n+    port => 5044\n+  }\n+}\n+\n+# The filter part of this file is commented out to indicate that it\n+# is optional.\n+# filter {\n+#\n+# }\n+\n+output {\n+  elasticsearch {\n+    hosts => \"localhost:9200\"\n+    manage_template => false\n+    index => \"%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}\" <1>\n+  }\n+}\n+----\n++\n+This configuration allows you to route events to {ls}, where you have full\n+access the {ls} capabilities for collecting, enriching, and transforming\n+data.\n+\n+\n+[float]\n+==== Start {ls}\n+\n+Use the command that works with your system. If you installed {ls} as a deb or\n+rpm package, make sure the config file is in the `config` directory.\n+\n+*deb:*\n+\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+sudo /etc/init.d/logstash start\n+----------------------------------------------------------------------\n+\n+*rpm:*\n+\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+sudo service logstash start\n+----------------------------------------------------------------------\n+\n+*mac:*\n+\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+./bin/logstash -f logstash.conf\n+----------------------------------------------------------------------\n+\n+*win:*\n+\n+[\"source\",\"sh\",subs=\"attributes,callouts\"]\n+----------------------------------------------------------------------\n+bin\\logstash.bat -f logstash.conf\n+----------------------------------------------------------------------\n+\n+NOTE: The default configuration for {beats} and {ls} uses plain TCP. For\n+encryption you must explicitly enable SSL when you configure {beats} and {ls}.\n+\n+{ls} reads from the {beats} input and indexes events into {es}. You haven't\n+defined a filter section yet, so {ls} simply forwards events to {es} without\n+additional processing. Next, you learn how to define the filter stage.\n+\n+[float]\n+[[logstash-filter]]\n+==== Define a filter to extract data from a field\n+\n+The system metrics collected by {metricbeat} include a field called `cmdline`\n+that contains the full command-line argument used to start the process. For\n+example:\n+\n+[source,json]\n+----\n+\"cmdline\": \"/Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container -childID 3\n+-isForBrowser -boolPrefs 36:1|299:0| -stringPrefs 285:38;{b77ae304-9f53-a248-8bd4-a243dbf2cab1}| -schedulerPrefs\n+0001,2 -greomni /Applications/Firefox.app/Contents/Resources/omni.ja -appomni\n+/Applications/Firefox.app/Contents/Resources/browser/omni.ja -appdir\n+/Applications/Firefox.app/Contents/Resources/browser -profile\n+/Users/dedemorton/Library/Application Support/Firefox/Profiles/mftvzeod.default-1468353066634\n+99468 gecko-crash-server-pipe.99468 org.mozilla.machname.1911848630 tab\"\n+----\n+\n+\n+You might decide that you don't want to send the whole command-line argument to\n+{es}. You can write a grok filter that matches the first part of the command\n+and saves it to a new field. You can also remove the original field, `cmdline`,\n+from the event. For example:\n+\n+// REVIEWERS: I took a stab at this, but I'm not very good at grok or\n+// regex. In fact, I sort of hate it...a lot. Can someone review and suggest\n+// something better based on the format you would expect in this field?\n+\n+[source,ruby]\n+----\n+filter {\n+  if [system][process] {\n+    if [system][process][cmdline] {\n+      grok {\n+        match => { \"[system][process][cmdline]\" => [\"%{CMD:[system][process][short_cmdline]}\"] }\n+        pattern_definitions => {\n+          \"CMD\" => \"(?:/[A-Za-z0-9$.+!*'(){},~:;=@#%&_\\-]*)+\\s*-*[A-Za-z0-9$.+!*'(){},~:;=@#%&_\\-]*\"\n+        }\n+        remove_field => \"[system][process][cmdline]\"\n+      }\n+    }\n+  }\n+}\n+----\n+\n+\n+Learning grok is beyond the scope of this tutorial, but if you want to learn\n+more, see the {logstash-ref}/plugins-filters-grok.html[Grok filter plugin]\n+documentation.","path":"docs/en/getting-started/get-started-stack.asciidoc","position":810,"original_position":810,"commit_id":"903d08f2bf877a1bdbbbb1c5332f480156b30e1b","original_commit_id":"903d08f2bf877a1bdbbbb1c5332f480156b30e1b","user":{"login":"yaauie","id":210924,"node_id":"MDQ6VXNlcjIxMDkyNA==","avatar_url":"https://avatars1.githubusercontent.com/u/210924?v=4","gravatar_id":"","url":"https://api.github.com/users/yaauie","html_url":"https://github.com/yaauie","followers_url":"https://api.github.com/users/yaauie/followers","following_url":"https://api.github.com/users/yaauie/following{/other_user}","gists_url":"https://api.github.com/users/yaauie/gists{/gist_id}","starred_url":"https://api.github.com/users/yaauie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yaauie/subscriptions","organizations_url":"https://api.github.com/users/yaauie/orgs","repos_url":"https://api.github.com/users/yaauie/repos","events_url":"https://api.github.com/users/yaauie/events{/privacy}","received_events_url":"https://api.github.com/users/yaauie/received_events","type":"User","site_admin":false},"body":"Grok can be exceptionally powerful, but it's a super deep rabbit hole to go down before developing solid footing on what Filters bring to the table. Maybe we should start with a different filter?\r\n\r\nIn the Logstash community forums, we tend to steer people _away_ from Grok until they've exhausted other avenues for extracting data (e.g., often-overlooked tools like the Dissect filter can be significantly simpler to implement and maintain). And, because Grok is a pattern language, it is _necessary_ to start with a corpus of messages; starting with a single message is generally a recipe for [disfluency](https://en.wikipedia.org/wiki/Garden_path_sentence).","created_at":"2018-05-31T19:47:02Z","updated_at":"2018-05-31T19:52:23Z","html_url":"https://github.com/elastic/stack-docs/pull/46#discussion_r192215761","pull_request_url":"https://api.github.com/repos/elastic/stack-docs/pulls/46","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/elastic/stack-docs/pulls/comments/192215761"},"html":{"href":"https://github.com/elastic/stack-docs/pull/46#discussion_r192215761"},"pull_request":{"href":"https://api.github.com/repos/elastic/stack-docs/pulls/46"}},"in_reply_to_id":190939176},"pull_request":{"url":"https://api.github.com/repos/elastic/stack-docs/pulls/46","id":190540924,"node_id":"MDExOlB1bGxSZXF1ZXN0MTkwNTQwOTI0","html_url":"https://github.com/elastic/stack-docs/pull/46","diff_url":"https://github.com/elastic/stack-docs/pull/46.diff","patch_url":"https://github.com/elastic/stack-docs/pull/46.patch","issue_url":"https://api.github.com/repos/elastic/stack-docs/issues/46","number":46,"state":"open","locked":false,"title":"Move getting started content and make it more generic","user":{"login":"dedemorton","id":14206422,"node_id":"MDQ6VXNlcjE0MjA2NDIy","avatar_url":"https://avatars3.githubusercontent.com/u/14206422?v=4","gravatar_id":"","url":"https://api.github.com/users/dedemorton","html_url":"https://github.com/dedemorton","followers_url":"https://api.github.com/users/dedemorton/followers","following_url":"https://api.github.com/users/dedemorton/following{/other_user}","gists_url":"https://api.github.com/users/dedemorton/gists{/gist_id}","starred_url":"https://api.github.com/users/dedemorton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dedemorton/subscriptions","organizations_url":"https://api.github.com/users/dedemorton/orgs","repos_url":"https://api.github.com/users/dedemorton/repos","events_url":"https://api.github.com/users/dedemorton/events{/privacy}","received_events_url":"https://api.github.com/users/dedemorton/received_events","type":"User","site_admin":false},"body":"Notes:\r\n\r\n* This is a rewrite of the getting started content in the Beats Platform Reference. Once we finalize this content and add it to the stack docs, I'll remove it from the Platform Reference in versions 6.3 and later. I currently have the content in a stand-alone book to make it easier to build/review.\r\n\r\n* A lot of the content has changed. Please review the full document and respond to my questions.\r\n\r\n* To build the content, pull down the files and from the `docs` repo, run:\r\n\r\n`build_docs.pl --doc ../stack-docs/docs/en/getting-started/index.asciidoc --chunk 1 -open`\r\n\r\n","created_at":"2018-05-25T10:07:20Z","updated_at":"2018-05-31T19:52:23Z","closed_at":null,"merged_at":null,"merge_commit_sha":"db7d4a5244db59abef4a78519eb76d6c4beda4fd","assignee":null,"assignees":[],"requested_reviewers":[{"login":"tsg","id":101817,"node_id":"MDQ6VXNlcjEwMTgxNw==","avatar_url":"https://avatars1.githubusercontent.com/u/101817?v=4","gravatar_id":"","url":"https://api.github.com/users/tsg","html_url":"https://github.com/tsg","followers_url":"https://api.github.com/users/tsg/followers","following_url":"https://api.github.com/users/tsg/following{/other_user}","gists_url":"https://api.github.com/users/tsg/gists{/gist_id}","starred_url":"https://api.github.com/users/tsg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tsg/subscriptions","organizations_url":"https://api.github.com/users/tsg/orgs","repos_url":"https://api.github.com/users/tsg/repos","events_url":"https://api.github.com/users/tsg/events{/privacy}","received_events_url":"https://api.github.com/users/tsg/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/elastic/stack-docs/pulls/46/commits","review_comments_url":"https://api.github.com/repos/elastic/stack-docs/pulls/46/comments","review_comment_url":"https://api.github.com/repos/elastic/stack-docs/pulls/comments{/number}","comments_url":"https://api.github.com/repos/elastic/stack-docs/issues/46/comments","statuses_url":"https://api.github.com/repos/elastic/stack-docs/statuses/903d08f2bf877a1bdbbbb1c5332f480156b30e1b","head":{"label":"dedemorton:stack_getting_started","ref":"stack_getting_started","sha":"903d08f2bf877a1bdbbbb1c5332f480156b30e1b","user":{"login":"dedemorton","id":14206422,"node_id":"MDQ6VXNlcjE0MjA2NDIy","avatar_url":"https://avatars3.githubusercontent.com/u/14206422?v=4","gravatar_id":"","url":"https://api.github.com/users/dedemorton","html_url":"https://github.com/dedemorton","followers_url":"https://api.github.com/users/dedemorton/followers","following_url":"https://api.github.com/users/dedemorton/following{/other_user}","gists_url":"https://api.github.com/users/dedemorton/gists{/gist_id}","starred_url":"https://api.github.com/users/dedemorton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dedemorton/subscriptions","organizations_url":"https://api.github.com/users/dedemorton/orgs","repos_url":"https://api.github.com/users/dedemorton/repos","events_url":"https://api.github.com/users/dedemorton/events{/privacy}","received_events_url":"https://api.github.com/users/dedemorton/received_events","type":"User","site_admin":false},"repo":{"id":134020841,"node_id":"MDEwOlJlcG9zaXRvcnkxMzQwMjA4NDE=","name":"stack-docs","full_name":"dedemorton/stack-docs","owner":{"login":"dedemorton","id":14206422,"node_id":"MDQ6VXNlcjE0MjA2NDIy","avatar_url":"https://avatars3.githubusercontent.com/u/14206422?v=4","gravatar_id":"","url":"https://api.github.com/users/dedemorton","html_url":"https://github.com/dedemorton","followers_url":"https://api.github.com/users/dedemorton/followers","following_url":"https://api.github.com/users/dedemorton/following{/other_user}","gists_url":"https://api.github.com/users/dedemorton/gists{/gist_id}","starred_url":"https://api.github.com/users/dedemorton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dedemorton/subscriptions","organizations_url":"https://api.github.com/users/dedemorton/orgs","repos_url":"https://api.github.com/users/dedemorton/repos","events_url":"https://api.github.com/users/dedemorton/events{/privacy}","received_events_url":"https://api.github.com/users/dedemorton/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/dedemorton/stack-docs","description":"Elastic Stack Documentation","fork":true,"url":"https://api.github.com/repos/dedemorton/stack-docs","forks_url":"https://api.github.com/repos/dedemorton/stack-docs/forks","keys_url":"https://api.github.com/repos/dedemorton/stack-docs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dedemorton/stack-docs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dedemorton/stack-docs/teams","hooks_url":"https://api.github.com/repos/dedemorton/stack-docs/hooks","issue_events_url":"https://api.github.com/repos/dedemorton/stack-docs/issues/events{/number}","events_url":"https://api.github.com/repos/dedemorton/stack-docs/events","assignees_url":"https://api.github.com/repos/dedemorton/stack-docs/assignees{/user}","branches_url":"https://api.github.com/repos/dedemorton/stack-docs/branches{/branch}","tags_url":"https://api.github.com/repos/dedemorton/stack-docs/tags","blobs_url":"https://api.github.com/repos/dedemorton/stack-docs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dedemorton/stack-docs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dedemorton/stack-docs/git/refs{/sha}","trees_url":"https://api.github.com/repos/dedemorton/stack-docs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dedemorton/stack-docs/statuses/{sha}","languages_url":"https://api.github.com/repos/dedemorton/stack-docs/languages","stargazers_url":"https://api.github.com/repos/dedemorton/stack-docs/stargazers","contributors_url":"https://api.github.com/repos/dedemorton/stack-docs/contributors","subscribers_url":"https://api.github.com/repos/dedemorton/stack-docs/subscribers","subscription_url":"https://api.github.com/repos/dedemorton/stack-docs/subscription","commits_url":"https://api.github.com/repos/dedemorton/stack-docs/commits{/sha}","git_commits_url":"https://api.github.com/repos/dedemorton/stack-docs/git/commits{/sha}","comments_url":"https://api.github.com/repos/dedemorton/stack-docs/comments{/number}","issue_comment_url":"https://api.github.com/repos/dedemorton/stack-docs/issues/comments{/number}","contents_url":"https://api.github.com/repos/dedemorton/stack-docs/contents/{+path}","compare_url":"https://api.github.com/repos/dedemorton/stack-docs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dedemorton/stack-docs/merges","archive_url":"https://api.github.com/repos/dedemorton/stack-docs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dedemorton/stack-docs/downloads","issues_url":"https://api.github.com/repos/dedemorton/stack-docs/issues{/number}","pulls_url":"https://api.github.com/repos/dedemorton/stack-docs/pulls{/number}","milestones_url":"https://api.github.com/repos/dedemorton/stack-docs/milestones{/number}","notifications_url":"https://api.github.com/repos/dedemorton/stack-docs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dedemorton/stack-docs/labels{/name}","releases_url":"https://api.github.com/repos/dedemorton/stack-docs/releases{/id}","deployments_url":"https://api.github.com/repos/dedemorton/stack-docs/deployments","created_at":"2018-05-19T01:59:16Z","updated_at":"2018-05-19T01:59:18Z","pushed_at":"2018-05-25T09:56:21Z","git_url":"git://github.com/dedemorton/stack-docs.git","ssh_url":"git@github.com:dedemorton/stack-docs.git","clone_url":"https://github.com/dedemorton/stack-docs.git","svn_url":"https://github.com/dedemorton/stack-docs","homepage":null,"size":12046,"stargazers_count":0,"watchers_count":0,"language":null,"has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":null,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"elastic:master","ref":"master","sha":"7bb1ecfcc40111e1fd0a619070628336183bfeb8","user":{"login":"elastic","id":6764390,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY3NjQzOTA=","avatar_url":"https://avatars0.githubusercontent.com/u/6764390?v=4","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"repo":{"id":71835381,"node_id":"MDEwOlJlcG9zaXRvcnk3MTgzNTM4MQ==","name":"stack-docs","full_name":"elastic/stack-docs","owner":{"login":"elastic","id":6764390,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY3NjQzOTA=","avatar_url":"https://avatars0.githubusercontent.com/u/6764390?v=4","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/elastic/stack-docs","description":"Elastic Stack Documentation","fork":false,"url":"https://api.github.com/repos/elastic/stack-docs","forks_url":"https://api.github.com/repos/elastic/stack-docs/forks","keys_url":"https://api.github.com/repos/elastic/stack-docs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/elastic/stack-docs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/elastic/stack-docs/teams","hooks_url":"https://api.github.com/repos/elastic/stack-docs/hooks","issue_events_url":"https://api.github.com/repos/elastic/stack-docs/issues/events{/number}","events_url":"https://api.github.com/repos/elastic/stack-docs/events","assignees_url":"https://api.github.com/repos/elastic/stack-docs/assignees{/user}","branches_url":"https://api.github.com/repos/elastic/stack-docs/branches{/branch}","tags_url":"https://api.github.com/repos/elastic/stack-docs/tags","blobs_url":"https://api.github.com/repos/elastic/stack-docs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/elastic/stack-docs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/elastic/stack-docs/git/refs{/sha}","trees_url":"https://api.github.com/repos/elastic/stack-docs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/elastic/stack-docs/statuses/{sha}","languages_url":"https://api.github.com/repos/elastic/stack-docs/languages","stargazers_url":"https://api.github.com/repos/elastic/stack-docs/stargazers","contributors_url":"https://api.github.com/repos/elastic/stack-docs/contributors","subscribers_url":"https://api.github.com/repos/elastic/stack-docs/subscribers","subscription_url":"https://api.github.com/repos/elastic/stack-docs/subscription","commits_url":"https://api.github.com/repos/elastic/stack-docs/commits{/sha}","git_commits_url":"https://api.github.com/repos/elastic/stack-docs/git/commits{/sha}","comments_url":"https://api.github.com/repos/elastic/stack-docs/comments{/number}","issue_comment_url":"https://api.github.com/repos/elastic/stack-docs/issues/comments{/number}","contents_url":"https://api.github.com/repos/elastic/stack-docs/contents/{+path}","compare_url":"https://api.github.com/repos/elastic/stack-docs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/elastic/stack-docs/merges","archive_url":"https://api.github.com/repos/elastic/stack-docs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/elastic/stack-docs/downloads","issues_url":"https://api.github.com/repos/elastic/stack-docs/issues{/number}","pulls_url":"https://api.github.com/repos/elastic/stack-docs/pulls{/number}","milestones_url":"https://api.github.com/repos/elastic/stack-docs/milestones{/number}","notifications_url":"https://api.github.com/repos/elastic/stack-docs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/elastic/stack-docs/labels{/name}","releases_url":"https://api.github.com/repos/elastic/stack-docs/releases{/id}","deployments_url":"https://api.github.com/repos/elastic/stack-docs/deployments","created_at":"2016-10-24T21:52:57Z","updated_at":"2018-05-30T23:11:27Z","pushed_at":"2018-05-31T18:10:43Z","git_url":"git://github.com/elastic/stack-docs.git","ssh_url":"git@github.com:elastic/stack-docs.git","clone_url":"https://github.com/elastic/stack-docs.git","svn_url":"https://github.com/elastic/stack-docs","homepage":null,"size":11840,"stargazers_count":3,"watchers_count":3,"language":"Java","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":5,"mirror_url":null,"archived":false,"open_issues_count":13,"license":null,"forks":5,"open_issues":13,"watchers":3,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/elastic/stack-docs/pulls/46"},"html":{"href":"https://github.com/elastic/stack-docs/pull/46"},"issue":{"href":"https://api.github.com/repos/elastic/stack-docs/issues/46"},"comments":{"href":"https://api.github.com/repos/elastic/stack-docs/issues/46/comments"},"review_comments":{"href":"https://api.github.com/repos/elastic/stack-docs/pulls/46/comments"},"review_comment":{"href":"https://api.github.com/repos/elastic/stack-docs/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/elastic/stack-docs/pulls/46/commits"},"statuses":{"href":"https://api.github.com/repos/elastic/stack-docs/statuses/903d08f2bf877a1bdbbbb1c5332f480156b30e1b"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"yaauie"}}