From f97045405cce9268ee1e79cbef976f41ffefdf7a Mon Sep 17 00:00:00 2001 From: bmorelli25 Date: Wed, 26 Apr 2023 14:22:24 -0700 Subject: [PATCH 01/22] move and rename logs --- docs/en/observability/application-logs.asciidoc | 2 +- docs/en/observability/index.asciidoc | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/en/observability/application-logs.asciidoc b/docs/en/observability/application-logs.asciidoc index 2cfd14e1f0..4950cbd49f 100644 --- a/docs/en/observability/application-logs.asciidoc +++ b/docs/en/observability/application-logs.asciidoc @@ -1,5 +1,5 @@ [[application-logs]] -= Application logs += Monitor application logs Application logs provide valuable insight into events that have occurred within your services and applications. diff --git a/docs/en/observability/index.asciidoc b/docs/en/observability/index.asciidoc index 3dfb7e5d5a..5f230ed990 100644 --- a/docs/en/observability/index.asciidoc +++ b/docs/en/observability/index.asciidoc @@ -26,7 +26,7 @@ include::{docs-root}/shared/attributes.asciidoc[] :apm-repo-dir: {apm-server-root}/docs :beats-repo-dir: {beats-root}/libbeat/docs :shared: {observability-docs-root}/docs/en/shared -:kibana-repo-dir: {kibana-root}/docs +:kibana-repo-dir: {kibana-root}/docs :synthetics_version: v1.0.0-beta.40 :project-monitors: project monitors @@ -72,9 +72,9 @@ include::observability-ui.asciidoc[leveloffset=+1] // APM include::apm.asciidoc[leveloffset=+1] -// Logs -include::application-logs.asciidoc[leveloffset=+1] +include::application-logs.asciidoc[leveloffset=+2] +// Logs include::monitor-logs.asciidoc[leveloffset=+1] include::tail-logs.asciidoc[leveloffset=+2] From 826f91b829163186550a5c2cbdeaa93607d73c64 Mon Sep 17 00:00:00 2001 From: bmorelli25 Date: Wed, 26 Apr 2023 14:22:30 -0700 Subject: [PATCH 02/22] update cases wording --- docs/en/observability/create-cases.asciidoc | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/en/observability/create-cases.asciidoc b/docs/en/observability/create-cases.asciidoc index e0e677ddf2..781188e5b9 100644 --- a/docs/en/observability/create-cases.asciidoc +++ b/docs/en/observability/create-cases.asciidoc @@ -1,10 +1,10 @@ [[create-cases]] = Cases -Cases are used to open and track observability issues directly in the Elastic -{observability} app. You can add assignees and tags to your cases, set their -severity and status, and add alerts, comments, and visualizations. You can also -send cases to third party systems by +Collect and share information about observability issues by opening a case directly +in the Elastic {observability} app. Cases allow you to track key investigation details, +add assignees and tags to your cases, set their severity and status, and add alerts, +comments, and visualizations. You can also send cases to third party systems by <>. [role="screenshot"] From 3bc914ee7de002c21d5fb3541d7021224d29d49a Mon Sep 17 00:00:00 2001 From: dedemorton Date: Wed, 26 Apr 2023 17:17:37 -0700 Subject: [PATCH 03/22] Add new getting started section (WIP) --- docs/en/observability/index.asciidoc | 27 ++------ docs/en/observability/ingest-splunk.asciidoc | 42 ++++++++++--- docs/en/observability/ingest-traces.asciidoc | 56 +++++++++-------- ...idoc => logs-metrics-get-started.asciidoc} | 45 +++++--------- .../observability-get-started.asciidoc | 11 ++++ docs/en/observability/redirects.asciidoc | 62 +++++++++++++++++++ .../synthetics-private-location.asciidoc | 2 +- 7 files changed, 157 insertions(+), 88 deletions(-) rename docs/en/observability/{ingest-logs-metrics-uptime.asciidoc => logs-metrics-get-started.asciidoc} (87%) create mode 100644 docs/en/observability/observability-get-started.asciidoc diff --git a/docs/en/observability/index.asciidoc b/docs/en/observability/index.asciidoc index 3dfb7e5d5a..3cde7be7be 100644 --- a/docs/en/observability/index.asciidoc +++ b/docs/en/observability/index.asciidoc @@ -40,31 +40,14 @@ include::observability-introduction.asciidoc[leveloffset=+1] // What's new include::whats-new.asciidoc[leveloffset=+1] -// Send data to Elasticsearch -include::add-observability-data.asciidoc[leveloffset=+1] +// Get started with Elastic Observability +include::observability-get-started.asciidoc[leveloffset=+1] -include::spin-up-stack.asciidoc[leveloffset=+2] +include::logs-metrics-get-started.asciidoc[leveloffset=+2] -include::deploy-agent-to-send-data.asciidoc[leveloffset=+2] +include::ingest-traces.asciidoc[leveloffset=+2] -include::ingest-logs-metrics-uptime.asciidoc[leveloffset=+3] - -include::ingest-traces.asciidoc[leveloffset=+3] - -include::ingest-splunk.asciidoc[leveloffset=+3] - -include::deploy-beats-to-send-data.asciidoc[leveloffset=+2] - -include::ingest-logs.asciidoc[leveloffset=+3] - -include::ingest-metrics.asciidoc[leveloffset=+3] - -include::ingest-uptime.asciidoc[leveloffset=+3] - -include::instrument-apps.asciidoc[leveloffset=+3] - -// AWS Serverless Forwarder -include::aws-elastic-serverless-forwarder.asciidoc[leveloffset=+2] +include::ingest-splunk.asciidoc[leveloffset=+2] // Observability overview page include::observability-ui.asciidoc[leveloffset=+1] diff --git a/docs/en/observability/ingest-splunk.asciidoc b/docs/en/observability/ingest-splunk.asciidoc index 7c4ee49d6f..e52b0966c6 100644 --- a/docs/en/observability/ingest-splunk.asciidoc +++ b/docs/en/observability/ingest-splunk.asciidoc @@ -3,19 +3,19 @@ :modulename: system nginx mysql -[[ingest-splunk]] -= Ingest data from Splunk (Experimental) +//TODO: Decide whether it really makes sense to move this. Maybe it's OK to +//leave this here for now since it's for a subset of users who might actually +//consider this info to be getting started info? -[NOTE] -===== -If you haven't already, you need to install {es} for storing and -searching your data, and {kib} for visualizing and managing it. For -more information, see <>. -After {es} and {kib} are installed, {fleet} must be enabled; see the -<>. +//TODO: Rename file and anchor plus set up redirect if we decide to keep this +//as a GS topic. +[[ingest-splunk]] += Get started with data from Splunk (Experimental) -===== +++++ +Data from Splunk +++++ Apache, AWS CloudTrail, Nginx, and Zeek integrations offer the ability to seamlessly ingest data from a Splunk Enterprise instance. Data @@ -36,6 +36,28 @@ image::images/elastic-agent-splunk.png[Splunk integration components] To ingest Nginx data from Splunk, perform the following steps. The options are the same for Apache, AWS CloudTrail, and Zeek. +[discrete] +[[splunk-prereqs]] +== Prerequisites + +//TODO: Consider using shared region to single source this info. + +To follow the steps in this guide, you need an {stack} deployment that includes: + +* {es} for storing and searching data +* {kib} for visualizing and managing data +* Kibana user with `All` privileges on {fleet} and Integrations. Since many +Integrations assets are shared across spaces, users need the Kibana privileges +in all spaces. +* Integrations Server (included by default in every {ess} deployment) + +To get started quickly, spin up a deployment of our hosted {ess}. The {ess} is +available on AWS, GCP, and Azure. {ess-trial}[Try it out for free]. + +TIP: Not using {fleet}? Advanced users who want to configure and manage +{agent}s manually can +{fleet-guide}/install-standalone-elastic-agent.html[run agents standalone]. + [discrete] [[splunk-step-one]] == Step 1: Add integration diff --git a/docs/en/observability/ingest-traces.asciidoc b/docs/en/observability/ingest-traces.asciidoc index ee1722586c..3632791ede 100644 --- a/docs/en/observability/ingest-traces.asciidoc +++ b/docs/en/observability/ingest-traces.asciidoc @@ -1,10 +1,14 @@ -[[ingest-traces]] -= Ingest application traces with {agent} +[[traces-apm-get-started]] += Get started with application traces and APM ++++ -Ingest traces +Traces and APM ++++ +//TODO: Ask Brandon--can I rename this file? I guess we will need to coordinate +//with a corresponding update for APM. I just think it's good to rip of the +//bandaid and give these files accurate names. WDYT? + // THIS CONTENT IS ALSO USED IN THE APM GUIDE // tag::apm-quick-start[] @@ -17,36 +21,32 @@ This guide describes how to: For feedback and questions, please contact us in the {forum}[discuss forum]. [discrete] -[[fleet-prereqs-traces]] +[[ingest-prereqs-traces]] == Prerequisites -You need {es} for storing and searching your data, and {kib} for visualizing and -managing it. You can use our {ess-product}[hosted {ess}] on {ecloud} -(recommended), or self-manage the {stack} on your own hardware. - -Here's what you need for each deployment type: +//TODO: Ask Brandon if it's Ok to make this a shared region. I'm thinking "no" +//because it will get weird, but maybe if we use the full path in the include, +//it will be OK? -include::{ingest-docs-root}/docs/en/ingest-management/tab-widgets/prereq-widget.asciidoc[] - -[discrete] -[[set-up-fleet-traces]] -== Step 1: Set up {fleet} +To follow the steps in this guide, you need an {stack} deployment that includes: -Use {fleet} in {kib} to get APM data into the {stack}. +* {es} for storing and searching data +* {kib} for visualizing and managing data +* Kibana user with `All` privileges on {fleet} and Integrations. Since many +Integrations assets are shared across spaces, users need the Kibana privileges +in all spaces. +* Integrations Server (included by default in every {ess} deployment) -The first time you use {fleet}, you might need to set it up and add a -{fleet-server}: +To get started quickly, spin up a deployment of our hosted {ess}]. The {ess} is +available on AWS, GCP, and Azure. {ess-trial}[Try it out for free]. -include::{ingest-docs-root}/docs/en/ingest-management/tab-widgets/add-fleet-server/widget.asciidoc[] - -For more information, refer to {fleet-guide}/fleet-server.html[{fleet-server}]. - -NOTE: The APM integration does not support running {agent} in standalone mode; -you must use {fleet} to manage {agent}. +TIP: Not using {fleet}? Advanced users who want to configure and manage +{agent}s manually can +{fleet-guide}/install-standalone-elastic-agent.html[run agents standalone]. [discrete] [[add-apm-integration]] -== Step 2: Configure the APM integration +== Step 1: Configure the APM integration {ecloud} runs a hosted version of {integrations-server} that includes the APM integration. Self-managed users will need to add the APM integration before configuring it. @@ -55,7 +55,9 @@ include::./tab-widgets/add-apm-integration/widget.asciidoc[] [discrete] [[add-agent-to-fleet-traces]] -== Step 3: Install and run an {agent} on your machine +== Step 2: Install and run an {agent} on your machine + +//TODO: Ask Brandon how to handle references to self managed users here **** This step is optional for both {ess} and self-managed users as @@ -84,7 +86,7 @@ include::{ingest-docs-root}/docs/en/ingest-management/elastic-agent/install-flee [discrete] [[add-apm-integration-agents]] -== Step 4: Install APM agents +== Step 3: Install APM agents APM agents are written in the same language as your service. To monitor a new service, you must install the agent and configure it with a service name, @@ -118,7 +120,7 @@ endif::[] [discrete] [[view-apm-integration-data]] -== Step 5: View your data +== Step 4: View your data Back in {kib}, under {observability}, select APM. You should see application performance monitoring data flowing into the {stack}! diff --git a/docs/en/observability/ingest-logs-metrics-uptime.asciidoc b/docs/en/observability/logs-metrics-get-started.asciidoc similarity index 87% rename from docs/en/observability/ingest-logs-metrics-uptime.asciidoc rename to docs/en/observability/logs-metrics-get-started.asciidoc index b5d1e1a6a5..ca44426e83 100644 --- a/docs/en/observability/ingest-logs-metrics-uptime.asciidoc +++ b/docs/en/observability/logs-metrics-get-started.asciidoc @@ -1,8 +1,8 @@ -[[ingest-logs-metrics-uptime]] -= Ingest logs and metrics with {agent} +[[logs-metrics-get-started]] += Get started with logs and metrics ++++ -Ingest logs and metrics +Logs and metrics ++++ **** @@ -18,39 +18,28 @@ This guide describes how to: For feedback and questions, please contact us in the {forum}[discuss forum]. [discrete] -[[fleet-prereqs]] +[[logs-metrics-prereqs]] == Prerequisites -You need {es} for storing and searching your data, and {kib} for visualizing and -managing it. You can use our {ess-product}[hosted {ess}] on {ecloud} -(recommended), or self-manage the {stack} on your own hardware. +To follow the steps in this guide, you need an {stack} deployment that includes: -Here's what you need for each deployment type: +* {es} for storing and searching data +* {kib} for visualizing and managing data +* Kibana user with `All` privileges on {fleet} and Integrations. Since many +Integrations assets are shared across spaces, users need the Kibana privileges +in all spaces. +* Integrations Server (included by default in every {ess} deployment) --- -include::{ingest-docs-root}/docs/en/ingest-management/tab-widgets/prereq-widget.asciidoc[] --- - -[discrete] -[[set-up-fleet]] -== Step 1: Set up {fleet} - -Use {fleet} in {kib} to get logs, metrics, and security data into the {stack}. +To get started quickly, spin up a deployment of our hosted {ess}. The {ess} is +available on AWS, GCP, and Azure. {ess-trial}[Try it out for free]. TIP: Not using {fleet}? Advanced users who want to configure and manage {agent}s manually can {fleet-guide}/install-standalone-elastic-agent.html[run agents standalone]. -The first time you use {fleet}, you might need to set it up and add a -{fleet-server}: - -include::{ingest-docs-root}/docs/en/ingest-management/tab-widgets/add-fleet-server/widget.asciidoc[] - -For more information, refer to {fleet-guide}/fleet-server.html[{fleet-server}]. - [discrete] [[add-system-integration]] -== Step 2: Add the {agent} System integration +== Step 1: Add the {agent} System integration {agent} is a single, unified way to add monitoring for logs, metrics, and other types of data to a host. It can also protect hosts from security threats, query @@ -104,7 +93,7 @@ TIP: If you accidentally close the popup, go to **{fleet} > Agents**, then click [discrete] [[add-agent-to-fleet]] -== Step 3: Install and run an {agent} on your machine +== Step 2: Install and run an {agent} on your machine The **Add agent** flyout has two options: **Enroll in {fleet}** and **Run standalone**. The default is to enroll the agents in {fleet}, as this @@ -133,7 +122,7 @@ data. [discrete] [[view-data]] -== Step 4: Monitor host logs and metrics +== Step 3: Monitor host logs and metrics . Verify that data is flowing. Wait until agent enrollment is confirmed and incoming data is received, then click **View assets** to access dashboards @@ -165,7 +154,7 @@ You can hover over any visualization to adjust its settings, or click the [discrete] [[add-nginx-integration]] -== Step 5: Monitor Nginx logs and metrics +== Step 4: Monitor Nginx logs and metrics [discrete] Next, add an Nginx integration to the policy used by your agent. diff --git a/docs/en/observability/observability-get-started.asciidoc b/docs/en/observability/observability-get-started.asciidoc new file mode 100644 index 0000000000..f3ee1e96e4 --- /dev/null +++ b/docs/en/observability/observability-get-started.asciidoc @@ -0,0 +1,11 @@ +[[observability-get-started]] += Get started with Elastic Observability + +++++ +Get started +++++ + +Overview of the process. +Diagram would be nice. +Mention other ingest methods (cloud native, Beats, etc) +Introduce the topics nested under this container. \ No newline at end of file diff --git a/docs/en/observability/redirects.asciidoc b/docs/en/observability/redirects.asciidoc index 50268d1159..23c6a86153 100644 --- a/docs/en/observability/redirects.asciidoc +++ b/docs/en/observability/redirects.asciidoc @@ -3,6 +3,68 @@ The following pages have moved or been deleted. +[role="exclude",id="add-observability-data"] +=== Send data to {es} + +Refer to <>. + +[role="exclude",id="spin-up-stack"] +=== Spin up the {stack} + +This page no longer exists in the Observability Guide. To learn how to sign up +for an {ess} trial, refer to our {ess-trial}[{es} Service Trial] page. To learn +how to install the {stack} on your own hardware, refer to +{stack-ref}/installing-elastic-stack.html[Installing the {stack}]. + +[role="exclude",id="deploy-agent-to-send-data"] +=== Deploy {agent} to send data + +Refer to <>. + +[role="exclude",id="deploy-beats-to-send-data"] +=== Deploy {beats} to send data + +This page no longer exists in the Observability Guide. To learn how to deploy +{beats}, refer to the {beats-ref}/getting-started.html[Beats getting started documentation]. + +[role="exclude",id="ingest-logs"] +=== Ingest logs with {filebeat} + +This page no longer exists in the Observability Guide. To learn how to deploy +{filebeat}, refer to the +{filebeat-ref}/filebeat-installation-configuration.html[{filebeat} quick start guide]. + +[role="exclude",id="ingest-metrics"] +=== Ingest metrics with {metricbeat} + +This page no longer exists in the Observability Guide. To learn how to deploy +{metricbeat}, refer to the +{metricbeat-ref}/metricbeat-installation-configuration.html[{metricbeat} quick start guide]. + +[role="exclude",id="ingest-uptime"] +=== Ingest uptime data with {heartbeat} + +This page no longer exists in the Observability Guide. To learn how to deploy +{heartbeat}, refer to the +{heartbeat-ref}/metricbeat-installation-configuration.html[{heartbeat} quick start guide]. + +[role="exclude",id="instrument-apps"] +=== Instrument applications with APM + +This page no longer exists in the Observability Guide. To learn how to +instrument applications with APM, refer to +//TODO: ADD LINK HERE + +[role="exclude",id="ingest-logs-metrics-uptime"] +=== Ingest logs and metrics with {agent} + +Refer to <>. + +[role="exclude",id="ingest-traces"] +=== Ingest application traces with {agent} + +Refer to <>. + [role="exclude",id="synthetic-monitoring-visualizations"] === Synthetic monitoring visualizations diff --git a/docs/en/observability/synthetics-private-location.asciidoc b/docs/en/observability/synthetics-private-location.asciidoc index 895b35b07f..9019469125 100644 --- a/docs/en/observability/synthetics-private-location.asciidoc +++ b/docs/en/observability/synthetics-private-location.asciidoc @@ -41,7 +41,7 @@ Before running a monitor on a {private-location}, you'll need to: Start by setting up {fleet-server} and {agent}: * *Set up {fleet-server}*: If you are using {ecloud}, {fleet-server} will already be provided and you can skip this step. -To learn more, refer to <>. +To learn more, refer to {fleet-guide}/fleet-server.html[Set up {fleet-server}]. * **Create an agent policy**: For more information on agent policies and creating them, refer to {fleet-guide}/agent-policy.html#create-a-policy[{agent} policy]. From 9feddeac1aaacc3b5989bee99636e9e6abdb8275 Mon Sep 17 00:00:00 2001 From: dedemorton Date: Wed, 26 Apr 2023 18:16:23 -0700 Subject: [PATCH 04/22] Fix broken link --- docs/en/observability/redirects.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/en/observability/redirects.asciidoc b/docs/en/observability/redirects.asciidoc index 8059955df8..ee53c81821 100644 --- a/docs/en/observability/redirects.asciidoc +++ b/docs/en/observability/redirects.asciidoc @@ -46,7 +46,7 @@ This page no longer exists in the Observability Guide. To learn how to deploy This page no longer exists in the Observability Guide. To learn how to deploy {heartbeat}, refer to the -{heartbeat-ref}/metricbeat-installation-configuration.html[{heartbeat} quick start guide]. +{heartbeat-ref}/heartbeat-installation-configuration.html[{heartbeat} quick start guide]. [role="exclude",id="instrument-apps"] === Instrument applications with APM From 78f836873c242eb3ee4a313c6d9596cab521ee21 Mon Sep 17 00:00:00 2001 From: dedemorton Date: Thu, 27 Apr 2023 12:31:15 -0700 Subject: [PATCH 05/22] In progress changes --- docs/en/observability/ingest-splunk.asciidoc | 165 ------------------ .../logs-metrics-get-started.asciidoc | 5 + docs/en/observability/redirects.asciidoc | 6 + 3 files changed, 11 insertions(+), 165 deletions(-) delete mode 100644 docs/en/observability/ingest-splunk.asciidoc diff --git a/docs/en/observability/ingest-splunk.asciidoc b/docs/en/observability/ingest-splunk.asciidoc deleted file mode 100644 index e52b0966c6..0000000000 --- a/docs/en/observability/ingest-splunk.asciidoc +++ /dev/null @@ -1,165 +0,0 @@ -[chapter, role="xpack"] -[[ingest-splunk]] - -:modulename: system nginx mysql - -//TODO: Decide whether it really makes sense to move this. Maybe it's OK to -//leave this here for now since it's for a subset of users who might actually -//consider this info to be getting started info? - -//TODO: Rename file and anchor plus set up redirect if we decide to keep this -//as a GS topic. - -[[ingest-splunk]] -= Get started with data from Splunk (Experimental) - -++++ -Data from Splunk -++++ - -Apache, AWS CloudTrail, Nginx, and Zeek integrations offer the ability -to seamlessly ingest data from a Splunk Enterprise instance. Data -will be automatically mapped to the Elastic Common Schema, making it -available for rapid analysis in Elastic solutions, including Security -and {observability}. - -These integrations work by using the `httpjson` input in {agent} to -run a Splunk search via the Splunk REST API and then extract the raw -event from the results. The raw event is then processed via the -{agent}. The Splunk search is customizable and the interval between -searches is customizable. These integrations only get new data since -the last query, not historical data. - -[role="screenshot"] -image::images/elastic-agent-splunk.png[Splunk integration components] - -To ingest Nginx data from Splunk, perform the following steps. -The options are the same for Apache, AWS CloudTrail, and Zeek. - -[discrete] -[[splunk-prereqs]] -== Prerequisites - -//TODO: Consider using shared region to single source this info. - -To follow the steps in this guide, you need an {stack} deployment that includes: - -* {es} for storing and searching data -* {kib} for visualizing and managing data -* Kibana user with `All` privileges on {fleet} and Integrations. Since many -Integrations assets are shared across spaces, users need the Kibana privileges -in all spaces. -* Integrations Server (included by default in every {ess} deployment) - -To get started quickly, spin up a deployment of our hosted {ess}. The {ess} is -available on AWS, GCP, and Azure. {ess-trial}[Try it out for free]. - -TIP: Not using {fleet}? Advanced users who want to configure and manage -{agent}s manually can -{fleet-guide}/install-standalone-elastic-agent.html[run agents standalone]. - -[discrete] -[[splunk-step-one]] -== Step 1: Add integration - -// lint ignore add-nginx-integration -Find the Nginx integration and begin adding it as described in -<>. - -[discrete] -[[splunk-step-two]] -== Step 2: Enable Collect logs from third-party REST API - -Enable "Collect logs from third-party REST API" and disable both "Collect -logs from Nginx instances" and "Collect metrics from Nginx instances". - -[role="screenshot"] -image::images/kibana-fleet-third-party-rest-api.png[{fleet} showing enabling third-party REST API] - -[discrete] -[[splunk-step-three]] -== Step 3: Enter connection information - -Enter the required information to connect to the Splunk Enterprise REST API. - -The URL of the Splunk Enterprise Server must include the scheme (`http` or `https`), -the IP address or hostname of the Splunk Enterprise Server, and the port the -REST API is listening on. - -The Splunk username and password must be of a user with a role or -capability to use REST API endpoints. Administrative users have these -permissions by default. - -SSL Configuration is available under the "Advanced options". These may be necessary -if Splunk Enterprise server uses self-signed certificates. See -{filebeat-ref}/configuration-ssl.html[SSL Options] -for valid configuration options. - -[role="screenshot"] -image::images/kibana-fleet-third-party-rest-settings.png[{fleet} showing enabling third-party REST API settings] - -[discrete] -[[splunk-step-four]] -== Step 4: Enter information to select data from Splunk - -For each type of log file, enter the interval and Splunk search string. - -The interval is expressed as a -https://golang.org/pkg/time/#ParseDuration[Go duration]. The interval -is the time between requests sent to the Splunk Enterprise REST API to -request new information. Intervals less than one second are not -recommended; Splunk only maintains second accuracy for index time. -The interval should closely match the rate at which data arrives at -the Splunk Enterprise Server. For example, an interval of "5s" for -data that only arrives at the Splunk Enterprise Server every hour will -generate unnecessary load on the Splunk Enterprise Server. - -The search string is the Splunk search used to uniquely describe the -events that match the type of log file you are trying to configure. -For example, to uniquely describe Nginx access logs `search -sourcetype=nginx:plus:access` might be used. Note, the search string -must begin with "search" for details refer to the Splunk REST API -manual and the "search/jobs/export" endpoint. - -Be aware that each time the {agent} connects to the Splunk Enterprise -REST API a Splunk search is performed. Because of this you want to be -sure your search string is as specific as possible, since this reduces -the load on the Splunk Enterprise Server. - -Tags may be added in the "Advanced options". For example, if you'd -like to tag events coming from Splunk with a 'Splunk' tag, you can add -it here. By default, the forward tag is present to indicate that -events are being forwarded via an intermediary, i.e. Splunk. - -[role="screenshot"] -image::images/kibana-fleet-third-party-rest-dataset-settings.png[{fleet} showing enabling third-party REST API settings] - -[discrete] -[[splunk-step-five]] -== Step 5: Save Integration - -Click Save Integration - -Data and Dashboards will be available just as if you had collected -the data on the Nginx host using log files. - - -[discrete] -[[splunk-considerations]] -=== Considerations and questions - -The time on the host running the agent and the Splunk Enterprise -Server should be synchronized to the same time source, with correct -timezone information. Failure to do this could result in delays in -transferring data or gaps in the data received. - -**Does the Splunk data need to be in a specific format or mapped to -Splunk's Common Information Model?** No, because these integrations -take the raw event from Splunk and process that. There is no -dependency on any Splunk processing. - -**Are events mapped to Elastic Common Schema (ECS)?** Yes, events from -these integrations go through the exact same processing as if {agent} -had gotten the event from the original source. So the same level of -mapping to ECS occurs. - diff --git a/docs/en/observability/logs-metrics-get-started.asciidoc b/docs/en/observability/logs-metrics-get-started.asciidoc index ca44426e83..dd9dfc1a74 100644 --- a/docs/en/observability/logs-metrics-get-started.asciidoc +++ b/docs/en/observability/logs-metrics-get-started.asciidoc @@ -21,6 +21,7 @@ For feedback and questions, please contact us in the {forum}[discuss forum]. [[logs-metrics-prereqs]] == Prerequisites +// tag::monitoring-prereqs[] To follow the steps in this guide, you need an {stack} deployment that includes: * {es} for storing and searching data @@ -32,10 +33,14 @@ in all spaces. To get started quickly, spin up a deployment of our hosted {ess}. The {ess} is available on AWS, GCP, and Azure. {ess-trial}[Try it out for free]. +// end::monitoring-prereqs[] +// tag::standalone-tip[] TIP: Not using {fleet}? Advanced users who want to configure and manage {agent}s manually can {fleet-guide}/install-standalone-elastic-agent.html[run agents standalone]. +// end::standalone-tip[] + [discrete] [[add-system-integration]] diff --git a/docs/en/observability/redirects.asciidoc b/docs/en/observability/redirects.asciidoc index ee53c81821..a527860db4 100644 --- a/docs/en/observability/redirects.asciidoc +++ b/docs/en/observability/redirects.asciidoc @@ -64,6 +64,12 @@ Refer to <>. === Ingest application traces with {agent} Refer to <>. + +[[ingest-splunk]] += Ingest data from Splunk (Experimental) + +Refer to <>. + [role="exclude",id="aws-elastic-serverless-forwarder"] === Elastic Serverless Forwarder for AWS From a8362583c38b154a77dfa4e84842ea80bee8a6c1 Mon Sep 17 00:00:00 2001 From: dedemorton Date: Thu, 27 Apr 2023 12:32:54 -0700 Subject: [PATCH 06/22] Rename splunk file --- .../observability/splunk-get-started.asciidoc | 144 ++++++++++++++++++ 1 file changed, 144 insertions(+) create mode 100644 docs/en/observability/splunk-get-started.asciidoc diff --git a/docs/en/observability/splunk-get-started.asciidoc b/docs/en/observability/splunk-get-started.asciidoc new file mode 100644 index 0000000000..e1a2f6bd0a --- /dev/null +++ b/docs/en/observability/splunk-get-started.asciidoc @@ -0,0 +1,144 @@ +[chapter, role="xpack"] +[[splunk-get-started]] + +:modulename: system nginx mysql + +[[ingest-splunk]] += Get started with data from Splunk (Experimental) + +++++ +Data from Splunk +++++ + +Apache, AWS CloudTrail, Nginx, and Zeek integrations offer the ability +to seamlessly ingest data from a Splunk Enterprise instance. Data +will be automatically mapped to the Elastic Common Schema, making it +available for rapid analysis in Elastic solutions, including Security +and {observability}. + +These integrations work by using the `httpjson` input in {agent} to +run a Splunk search via the Splunk REST API and then extract the raw +event from the results. The raw event is then processed via the +{agent}. The Splunk search is customizable and the interval between +searches is customizable. These integrations only get new data since +the last query, not historical data. + +[role="screenshot"] +image::images/elastic-agent-splunk.png[Splunk integration components] + +To ingest Nginx data from Splunk, perform the following steps. +The options are the same for Apache, AWS CloudTrail, and Zeek. + +[discrete] +[[splunk-prereqs]] +== Prerequisites + +include::{observability-docs-root}/docs/en/observability/logs-metrics-get-started.asciidoc[tag=monitoring-prereqs] + +include::{observability-docs-root}/docs/en/observability/logs-metrics-get-started.asciidoc[tag=standalone-tip] + +[discrete] +[[splunk-step-one]] +== Step 1: Add integration + +// lint ignore add-nginx-integration +Find the Nginx integration and begin adding it as described in +<>. + +[discrete] +[[splunk-step-two]] +== Step 2: Enable Collect logs from third-party REST API + +Enable "Collect logs from third-party REST API" and disable both "Collect +logs from Nginx instances" and "Collect metrics from Nginx instances". + +[role="screenshot"] +image::images/kibana-fleet-third-party-rest-api.png[{fleet} showing enabling third-party REST API] + +[discrete] +[[splunk-step-three]] +== Step 3: Enter connection information + +Enter the required information to connect to the Splunk Enterprise REST API. + +The URL of the Splunk Enterprise Server must include the scheme (`http` or `https`), +the IP address or hostname of the Splunk Enterprise Server, and the port the +REST API is listening on. + +The Splunk username and password must be of a user with a role or +capability to use REST API endpoints. Administrative users have these +permissions by default. + +SSL Configuration is available under the "Advanced options". These may be necessary +if Splunk Enterprise server uses self-signed certificates. See +{filebeat-ref}/configuration-ssl.html[SSL Options] +for valid configuration options. + +[role="screenshot"] +image::images/kibana-fleet-third-party-rest-settings.png[{fleet} showing enabling third-party REST API settings] + +[discrete] +[[splunk-step-four]] +== Step 4: Enter information to select data from Splunk + +For each type of log file, enter the interval and Splunk search string. + +The interval is expressed as a +https://golang.org/pkg/time/#ParseDuration[Go duration]. The interval +is the time between requests sent to the Splunk Enterprise REST API to +request new information. Intervals less than one second are not +recommended; Splunk only maintains second accuracy for index time. +The interval should closely match the rate at which data arrives at +the Splunk Enterprise Server. For example, an interval of "5s" for +data that only arrives at the Splunk Enterprise Server every hour will +generate unnecessary load on the Splunk Enterprise Server. + +The search string is the Splunk search used to uniquely describe the +events that match the type of log file you are trying to configure. +For example, to uniquely describe Nginx access logs `search +sourcetype=nginx:plus:access` might be used. Note, the search string +must begin with "search" for details refer to the Splunk REST API +manual and the "search/jobs/export" endpoint. + +Be aware that each time the {agent} connects to the Splunk Enterprise +REST API a Splunk search is performed. Because of this you want to be +sure your search string is as specific as possible, since this reduces +the load on the Splunk Enterprise Server. + +Tags may be added in the "Advanced options". For example, if you'd +like to tag events coming from Splunk with a 'Splunk' tag, you can add +it here. By default, the forward tag is present to indicate that +events are being forwarded via an intermediary, i.e. Splunk. + +[role="screenshot"] +image::images/kibana-fleet-third-party-rest-dataset-settings.png[{fleet} showing enabling third-party REST API settings] + +[discrete] +[[splunk-step-five]] +== Step 5: Save Integration + +Click Save Integration + +Data and Dashboards will be available just as if you had collected +the data on the Nginx host using log files. + + +[discrete] +[[splunk-considerations]] +=== Considerations and questions + +The time on the host running the agent and the Splunk Enterprise +Server should be synchronized to the same time source, with correct +timezone information. Failure to do this could result in delays in +transferring data or gaps in the data received. + +**Does the Splunk data need to be in a specific format or mapped to +Splunk's Common Information Model?** No, because these integrations +take the raw event from Splunk and process that. There is no +dependency on any Splunk processing. + +**Are events mapped to Elastic Common Schema (ECS)?** Yes, events from +these integrations go through the exact same processing as if {agent} +had gotten the event from the original source. So the same level of +mapping to ECS occurs. + From f78c76d1fed2b774981f740c1c26423bb158d626 Mon Sep 17 00:00:00 2001 From: mdbirnstiehl Date: Thu, 27 Apr 2023 15:50:50 -0500 Subject: [PATCH 07/22] move UI content to observabilty intro page --- .../observability-introduction.asciidoc | 126 ++++++++++++------ 1 file changed, 82 insertions(+), 44 deletions(-) diff --git a/docs/en/observability/observability-introduction.asciidoc b/docs/en/observability/observability-introduction.asciidoc index 52c4211269..91ced4978c 100644 --- a/docs/en/observability/observability-introduction.asciidoc +++ b/docs/en/observability/observability-introduction.asciidoc @@ -2,77 +2,115 @@ [role="xpack"] = What is Elastic {observability}? -{observability} provides you with granular insights and context into the behavior -of applications running in your environments. At Elastic, we view observability as an -attribute of any system that you build and want to monitor. Being able to detect -and fix root cause events quickly within an observable system is what we consider -a minimum requirement for any analyst. - -https://www.elastic.co/observability[Elastic {observability}] provides you with a -single stack to unify your logs, infrastructure metrics, uptime data, application traces, user experience data, and synthetics. -Ingest your data directly to {es}, where you can further process and enhance the data, -before visualizing it in {kib}. - -image::images/observability.png[Elastic {observability}] +{observability} provides granular insights and context into the behavior of applications running in your environments. +It's is an important part of any system that you build and want to monitor. +Being able to detect and fix root cause events quickly within an observable system should be a minimum requirement for any analyst. Search, monitor, and apply analytics in real time to events happening across all of your environments. Analyze the logs for a specific transaction, monitor the performance metrics for the host or container that it ran in, trace the transaction, and check the overall service availability. +https://www.elastic.co/observability[Elastic {observability}] provides a +single stack to unify your logs, infrastructure metrics, uptime data, application traces, user experience data, synthetics, and universal profiling. +Ingest your data directly to {es}, where you can further process and enhance the data, +before visualizing it and adding alerts in {kib}. + +//Add new data flow graphic + [float] -[[logs-overview]] -== Logs data +[[apm-overview]] +== Application performance monitoring (APM) + +Instrument your code and collect performance data and errors at runtime by installing APM agents +like Java, Go, .NET, and many more. + +On the {observability} **Overview** page, the *Services* chart shows the total number of services running within your environment and the total number of transactions per minute that were captured by the Elastic APM +agent instrumenting those services. -Analyze log data from your hosts, services, Kubernetes, Apache, and many more. To view a -live stream of your logs and to filter, pin, or highlight the data you need, drill-down into the {logs-app}. +[role="screenshot"] +image::images/apm.png[Summary of Services on the {observability} overview page] + +You can then drill down into the {apm-app} by clicking *Show service inventory* to quickly find the APM traces for underlying services. + +For more information, see <>. [float] [[metrics-overview]] -== Infrastructure data +== Infrastructure monitoring -Monitor system and service metrics from your servers, Docker, Kubernetes, Prometheus, along with other -services and applications. To monitor and filter your data by hosts, pods, containers, -or EC2 instances, drill-down into the {infrastructure-app}. You can also create custom groupings such as -availability zones or namespaces. +Monitor system and service metrics from your servers, Docker, Kubernetes, Prometheus, and other +services and applications. -[float] -[[apm-overview]] -== APM data +On the {observability} **Overview** page, the *Hosts* table shows your top hosts with the most significant resource footprints. These metrics help you evaluate host efficiency and determine if resource consumption is impacting end-users. -To instrument your code and collect performance data and errors at runtime, install APM agents -like Java, Go, .NET, and many more. To quickly find the APM traces for underlying services, -drill-down into the {apm-app}. +[role="screenshot"] +image::images/metrics-summary.png[Summary of Hosts on the {observability} overview page] -[float] -[[uptime-overview]] -== Uptime data +You can then drill down into the {infrastructure-app} by clicking *Show inventory*. Here you can monitor and filter your data by hosts, pods, containers,or EC2 instances and create custom groupings such as availability zones or namespaces. -Install and configure {heartbeat} on your servers to monitor host availability, service -uptime, web site endpoints, and API monitoring. For detailed -monitor summaries, with support for monitors from multiple locations, drill-down into -the {uptime-app}. +For more information, see <>. [float] [[user-experience-overview]] -== User experience data +== Real user monitoring (RUM) + +Quantify and analyze the perceived performance of your web application with {user-experience} data, powered by the APM RUM agent. Unlike testing environments, {user-experience} data reflects real-world user experiences. + +On the {observability} **Overview** page, the *{user-experience}* chart provides a snapshot of core web vitals for the service with the most traffic. + +[role="screenshot"] +image::images/obs-overview-ue.png[Summary of {user-experience} metrics on the {observability} overview page] -{user-experience} data, powered by the APM Real User Monitoring (RUM) agent, -provides a way to quantify and analyze the perceived performance of your web application. +You can then drill down into the {user-experience} dashboard by clicking *Show dashboard* too see data by URL, operating system, browser, and location. + +For more information, see <>. + +[float] +[[logs-overview]] +== Log monitoring + +Analyze log data from your hosts, services, Kubernetes, Apache, and many more. + +On the {observability} **Overview** page, the *Log Events* chart helps you detect and inspect possible log anomalies across each of your ingested log sources to determine if the log rate is outside of your expected bounds. + +[role="screenshot"] +image::images/log-rate.png[Summary of Log Events on the {observability} overview page] + +You can then drill-down into the {logs-app} by clicking *Show log stream* to view a live stream of your logs and filter, pin, or highlight the data you need. + +For more information, see <>. [float] [[synthetic-monitoring-overview]] -== Synthetic monitoring data +== Synthetic monitoring -beta[] Synthetic monitoring allows you to simulate actions and requests that an end-user would perform -on your site at predefined intervals and in a controlled environment. +beta[] Simulate actions and requests that an end-user would perform on your site at predefined intervals and in a controlled environment. The end result is rich, consistent, and repeatable data that you can trend and alert on. +For more information, see <>. + +[float] +[[universal-profiling-overview]] +== Universal Profiling +beta[] Build stack traces to get visibility into your system without application source code changes or instrumentation. Use flamegraphs to explore your systems performance and identify the most expensive lines of code, increase CPU resource efficiency, debug performance regressions, and reduce cloud spend. + +For more information, see <>. + [float] [[alerts-overview]] == Alerting -To help keep you aware of potential issues in your environments, the {logs-app}, {infrastructure-app}, -{apm-app}, and the {uptime-app} all integrate with {kib}’s alerting -and actions feature. It provides a set of built-in actions and specific threshold rules -for you to use and enables central management of all rules from {kib} Management. +Stay aware of potential issues in your environments with {kib}’s alerting +and actions feature that integrates with the {logs-app}, {infrastructure-app}, and +{apm-app}. It provides a set of built-in actions and specific threshold rules + and enables central management of all rules from {kib} Management. + +On the {observability} **Overview** page, the *Alerts* table provides a snapshot of alerts occurring within the specified time frame. The table includes the alert status, when it was last updated, the reason for the alert, and more. + +[role="screenshot"] +image::images/alerts-overview.png[Summary of Alerts on the {observability} overview page] + +You can then see more details on these alerts by clicking *Show alerts*. + +For more information, see <>. \ No newline at end of file From 0a507b55048b93483bfde14ce679c6fd63687085 Mon Sep 17 00:00:00 2001 From: mdbirnstiehl Date: Thu, 27 Apr 2023 15:51:31 -0500 Subject: [PATCH 08/22] delete UI page and remove from index --- docs/en/observability/index.asciidoc | 3 - .../observability/observability-ui.asciidoc | 120 ------------------ 2 files changed, 123 deletions(-) delete mode 100644 docs/en/observability/observability-ui.asciidoc diff --git a/docs/en/observability/index.asciidoc b/docs/en/observability/index.asciidoc index b3debe133d..e02c63900b 100644 --- a/docs/en/observability/index.asciidoc +++ b/docs/en/observability/index.asciidoc @@ -49,9 +49,6 @@ include::ingest-traces.asciidoc[leveloffset=+2] include::ingest-splunk.asciidoc[leveloffset=+2] -// Observability overview page -include::observability-ui.asciidoc[leveloffset=+1] - // APM include::apm.asciidoc[leveloffset=+1] diff --git a/docs/en/observability/observability-ui.asciidoc b/docs/en/observability/observability-ui.asciidoc deleted file mode 100644 index 5512a79bf1..0000000000 --- a/docs/en/observability/observability-ui.asciidoc +++ /dev/null @@ -1,120 +0,0 @@ -[[observability-ui]] -[role="xpack"] -= {observability} overview page - -++++ -{observability} overview page -++++ - -Whether you’re an analyst or an admin, {kib} makes your data actionable by providing -three key functions. {kib} is: - -* **An open-source analytics and visualization platform.** -Use {kib} to explore your {es} data, and then build beautiful visualizations and dashboards. - -* **A UI for managing the {stack}.** -Manage your security settings, assign user roles, take snapshots, roll up your data, -and more — all from the convenience of a {kib} UI. - -* **A centralized hub for Elastic's solutions.** From log analytics to -metrics discovery to APM, {kib} is the portal for accessing these and other capabilities. - -Within {kib}, the *{observability} Overview* page contains a wide variety of charts -displaying analytics relating to the components that help you make your systems -observable: logs, infrastructure metrics, APM, and uptime data. - -Additionally, the alerts chart keeps you informed of any issues that you may need -to resolve quickly. - -[float] -[[view-alerts]] -== Alerts - -The *Alerts* table provides a snapshot of alerts occurring within the specified time frame. -The table includes the alert status, when it was last updated, the reason for the alert, and more. - -To see more details about these alerts, click *Show alerts*. For more information on creating and managing alerts, -see <>. - -[role="screenshot"] -image::images/alerts-overview.png[Summary of Alerts on the {observability} overview page] - -[float] -[[view-log-rates]] -== Log Events - -The *Log Events* chart helps you to detect and inspect possible log anomalies across each of -your ingested log sources. The visualization helps you determine if the log rate is outside -of your expected bounds, and therefore could be considered anomalous. Any drop in the log -rate could suggest a system has stopped responding, or a spike could denote a DDoS attack. - -To drill down and view these logs in the *{logs-app}*, click *Show log stream*. For more information, -see <>. - -//TODO: what are the specific metric fields? - -[role="screenshot"] -image::images/log-rate.png[Summary of Log Events on the {observability} overview page] - -[float] -[[view-system-metrics]] -== Hosts - -The *Hosts* table displays your top hosts with the most significant -resource footprints. These metrics help you evaluate host efficiency and determine if -resource consumption is impacting end-users. - -Uptime, memory usage, and the system load metrics enable you to identify -possible memory leaks and whether disk resources need to be added or redistributed. Inbound and -outbound traffic metrics allow you to visualize any possible spikes to help determine whether -any hosts are choking your network. - -To drill down and view these performance metrics in the *{infrastructure-app}*, click *Show inventory*. -For more information, see <>. - -[role="screenshot"] -image::images/metrics-summary.png[Summary of Hosts on the {observability} overview page] - -[float] -[[view-services-and-transactions]] -== Services - -The *Services* chart displays the total number of services running within your environment -and the total number of transactions per minute that were captured by the Elastic APM -agent instrumenting those services. - -To drill down and view this APM data in the *{apm-app}*, click *Show service inventory*. - -[role="screenshot"] -image::images/apm.png[Summary of Services on the {observability} overview page] - -[float] -[[view-systems-availability]] -== Monitors - -To help you react quickly to availability issues before they affect your users, the *Uptime* -chart provides you with a snapshot of the overall availability of your hosts, network devices, or third-party -services. Based on the last check reported by {heartbeat}, you can view the total number of detected monitors, -along with the number of monitors in an `up` or `down` state. - -To drill down and view this uptime data in the *{uptime-app}*, click *Show monitors*. -For more information, see <>. - -[role="screenshot"] -image::images/uptime-summary.png[Summary of Monitors on the {observability} overview page] - -[float] -[[view-user-experience]] -== {user-experience} - -The *{user-experience}* chart provides a snapshot of core web vitals for the service with the most traffic. -User experience provides a way to quantify and analyze the perceived performance of your web application. -Unlike testing environments, {user-experience} data reflects real-world user experiences. -Drill down further by looking at data by URL, operating system, browser, and location — -all of which can impact how your application performs on end-user machines. - -To drill down and view this {user-experience} data, click *Show dashboard*. -For more information, see <>. - -[role="screenshot"] -image::images/obs-overview-ue.png[Summary of {user-experience} metrics on the {observability} overview page] From cc0a7f4a619c102a8b0cf11dc6dd2fc666226317 Mon Sep 17 00:00:00 2001 From: dedemorton Date: Thu, 27 Apr 2023 15:21:15 -0700 Subject: [PATCH 09/22] Add changes from review --- docs/en/observability/index.asciidoc | 3 +- docs/en/observability/ingest-traces.asciidoc | 66 ++----------------- docs/en/observability/redirects.asciidoc | 9 +-- .../observability/splunk-get-started.asciidoc | 2 +- 4 files changed, 11 insertions(+), 69 deletions(-) diff --git a/docs/en/observability/index.asciidoc b/docs/en/observability/index.asciidoc index e02c63900b..48ddfcffe3 100644 --- a/docs/en/observability/index.asciidoc +++ b/docs/en/observability/index.asciidoc @@ -45,9 +45,10 @@ include::observability-get-started.asciidoc[leveloffset=+1] include::logs-metrics-get-started.asciidoc[leveloffset=+2] +//TOOD: Rename this file to traces-get-started in a follow-on PR include::ingest-traces.asciidoc[leveloffset=+2] -include::ingest-splunk.asciidoc[leveloffset=+2] +include::splunk-get-started.asciidoc[leveloffset=+2] // APM include::apm.asciidoc[leveloffset=+1] diff --git a/docs/en/observability/ingest-traces.asciidoc b/docs/en/observability/ingest-traces.asciidoc index 3632791ede..d7ac3811a1 100644 --- a/docs/en/observability/ingest-traces.asciidoc +++ b/docs/en/observability/ingest-traces.asciidoc @@ -1,14 +1,10 @@ -[[traces-apm-get-started]] +[[ingest-traces]] = Get started with application traces and APM ++++ Traces and APM ++++ -//TODO: Ask Brandon--can I rename this file? I guess we will need to coordinate -//with a corresponding update for APM. I just think it's good to rip of the -//bandaid and give these files accurate names. WDYT? - // THIS CONTENT IS ALSO USED IN THE APM GUIDE // tag::apm-quick-start[] @@ -21,72 +17,22 @@ This guide describes how to: For feedback and questions, please contact us in the {forum}[discuss forum]. [discrete] -[[ingest-prereqs-traces]] +[[traces-prereqs]] == Prerequisites -//TODO: Ask Brandon if it's Ok to make this a shared region. I'm thinking "no" -//because it will get weird, but maybe if we use the full path in the include, -//it will be OK? - -To follow the steps in this guide, you need an {stack} deployment that includes: - -* {es} for storing and searching data -* {kib} for visualizing and managing data -* Kibana user with `All` privileges on {fleet} and Integrations. Since many -Integrations assets are shared across spaces, users need the Kibana privileges -in all spaces. -* Integrations Server (included by default in every {ess} deployment) - -To get started quickly, spin up a deployment of our hosted {ess}]. The {ess} is -available on AWS, GCP, and Azure. {ess-trial}[Try it out for free]. - -TIP: Not using {fleet}? Advanced users who want to configure and manage -{agent}s manually can -{fleet-guide}/install-standalone-elastic-agent.html[run agents standalone]. +include::{observability-docs-root}/docs/en/observability/logs-metrics-get-started.asciidoc[tag=monitoring-prereqs] [discrete] [[add-apm-integration]] == Step 1: Configure the APM integration {ecloud} runs a hosted version of {integrations-server} that includes the APM integration. -Self-managed users will need to add the APM integration before configuring it. - -include::./tab-widgets/add-apm-integration/widget.asciidoc[] - -[discrete] -[[add-agent-to-fleet-traces]] -== Step 2: Install and run an {agent} on your machine - -//TODO: Ask Brandon how to handle references to self managed users here - -**** -This step is optional for both {ess} and self-managed users as -{ecloud} spins up an {agent} instance automatically, and self managed users installed an {agent} instance manually in Step 1. -Unless you need to add additional {agent}s, skip this step. -**** - -{agent} is a single, unified way to add monitoring for logs, metrics, and other -types of data to a host. It can also protect hosts from security threats, query -data from operating systems, forward data from remote services or hardware, and -more. A single agent makes it easier and faster to deploy monitoring across your -infrastructure. Each agent has a single policy you can update to add -integrations for new data sources, security protections, and more. - -Don't confuse {agent} with APM agents--they are different components. -In a later step, you'll instrument your code with APM agents and send the data -to an APM Server instance that {agent} spins up. - -If you plan on enabling Real User Monitoring (RUM), you must run {agent} centrally. -If RUM is disabled, you should run {agent} on edge machines. - -To send APM data to the {stack}: - -include::{ingest-docs-root}/docs/en/ingest-management/elastic-agent/install-fleet-managed-elastic-agent.asciidoc[tag=agent-enroll] +include::./tab-widgets/add-apm-integration/content.asciidoc[tag=ess] [discrete] [[add-apm-integration-agents]] -== Step 3: Install APM agents +== Step 2: Install APM agents APM agents are written in the same language as your service. To monitor a new service, you must install the agent and configure it with a service name, @@ -120,7 +66,7 @@ endif::[] [discrete] [[view-apm-integration-data]] -== Step 4: View your data +== Step 3: View your data Back in {kib}, under {observability}, select APM. You should see application performance monitoring data flowing into the {stack}! diff --git a/docs/en/observability/redirects.asciidoc b/docs/en/observability/redirects.asciidoc index a527860db4..562f5e6863 100644 --- a/docs/en/observability/redirects.asciidoc +++ b/docs/en/observability/redirects.asciidoc @@ -53,20 +53,15 @@ This page no longer exists in the Observability Guide. To learn how to deploy This page no longer exists in the Observability Guide. To learn how to instrument applications with APM, refer to -//TODO: ADD LINK HERE +{apm-guide-ref}/current/getting-started-apm-server.html [role="exclude",id="ingest-logs-metrics-uptime"] === Ingest logs and metrics with {agent} Refer to <>. -[role="exclude",id="ingest-traces"] -=== Ingest application traces with {agent} - -Refer to <>. - [[ingest-splunk]] -= Ingest data from Splunk (Experimental) +=== Ingest data from Splunk (Experimental) Refer to <>. diff --git a/docs/en/observability/splunk-get-started.asciidoc b/docs/en/observability/splunk-get-started.asciidoc index e1a2f6bd0a..e39c96069b 100644 --- a/docs/en/observability/splunk-get-started.asciidoc +++ b/docs/en/observability/splunk-get-started.asciidoc @@ -3,7 +3,7 @@ :modulename: system nginx mysql -[[ingest-splunk]] +[[splunk-get-started]] = Get started with data from Splunk (Experimental) ++++ From 2321957804689d5d118ca8578496cc14b7d63ce0 Mon Sep 17 00:00:00 2001 From: dedemorton Date: Thu, 27 Apr 2023 15:39:38 -0700 Subject: [PATCH 10/22] Fix broken link --- docs/en/observability/redirects.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/en/observability/redirects.asciidoc b/docs/en/observability/redirects.asciidoc index 562f5e6863..ab0163a663 100644 --- a/docs/en/observability/redirects.asciidoc +++ b/docs/en/observability/redirects.asciidoc @@ -53,7 +53,7 @@ This page no longer exists in the Observability Guide. To learn how to deploy This page no longer exists in the Observability Guide. To learn how to instrument applications with APM, refer to -{apm-guide-ref}/current/getting-started-apm-server.html +{apm-guide-ref}/getting-started-apm-server.html [role="exclude",id="ingest-logs-metrics-uptime"] === Ingest logs and metrics with {agent} From f02df296fc54cb963b00e5eaa8f9af1f4741919e Mon Sep 17 00:00:00 2001 From: bmorelli25 Date: Thu, 27 Apr 2023 20:33:38 -0700 Subject: [PATCH 11/22] add rough draft svg diagrams --- .../diagrams/get-started.asciidoc | 19 ++++++++ .../diagrams/what-is-obs.asciidoc | 45 +++++++++++++++++++ .../observability-get-started.asciidoc | 3 ++ .../observability-introduction.asciidoc | 15 ++++--- 4 files changed, 75 insertions(+), 7 deletions(-) create mode 100644 docs/en/observability/diagrams/get-started.asciidoc create mode 100644 docs/en/observability/diagrams/what-is-obs.asciidoc diff --git a/docs/en/observability/diagrams/get-started.asciidoc b/docs/en/observability/diagrams/get-started.asciidoc new file mode 100644 index 0000000000..014c44a5ba --- /dev/null +++ b/docs/en/observability/diagrams/get-started.asciidoc @@ -0,0 +1,19 @@ +++++ +
+ + + + + + + + + + + + + + + +
+++++ \ No newline at end of file diff --git a/docs/en/observability/diagrams/what-is-obs.asciidoc b/docs/en/observability/diagrams/what-is-obs.asciidoc new file mode 100644 index 0000000000..ee82420c95 --- /dev/null +++ b/docs/en/observability/diagrams/what-is-obs.asciidoc @@ -0,0 +1,45 @@ +++++ +
+ + + + +Elastic Observability + + + + +Microservices Cloud-native OpenTelemetry Serverless + +APM data +Application Cloud Container Database Infrastructure Web + +Logs + + + + + + + +Out of the box +Dashboards Visualizations Anomaly detection Dependency mapping + + +Custom curated +Alerts Cases Contextual signals Custom links + + +Container Database Host Network Storage + +Metrics +Uptime User experience User journey Web performance + +Synthetic +Application Cloud-native eBPF Infrastructure Services Whole system + +Profiling + + +
+++++ \ No newline at end of file diff --git a/docs/en/observability/observability-get-started.asciidoc b/docs/en/observability/observability-get-started.asciidoc index f3ee1e96e4..06f233ccc7 100644 --- a/docs/en/observability/observability-get-started.asciidoc +++ b/docs/en/observability/observability-get-started.asciidoc @@ -5,6 +5,9 @@ Get started ++++ +[subs=attributes+] +include::diagrams/get-started.asciidoc[] + Overview of the process. Diagram would be nice. Mention other ingest methods (cloud native, Beats, etc) diff --git a/docs/en/observability/observability-introduction.asciidoc b/docs/en/observability/observability-introduction.asciidoc index 91ced4978c..6c5f797b71 100644 --- a/docs/en/observability/observability-introduction.asciidoc +++ b/docs/en/observability/observability-introduction.asciidoc @@ -2,8 +2,8 @@ [role="xpack"] = What is Elastic {observability}? -{observability} provides granular insights and context into the behavior of applications running in your environments. -It's is an important part of any system that you build and want to monitor. +{observability} provides granular insights and context into the behavior of applications running in your environments. +It's is an important part of any system that you build and want to monitor. Being able to detect and fix root cause events quickly within an observable system should be a minimum requirement for any analyst. Search, monitor, and apply analytics in real time to events happening across all of @@ -14,16 +14,17 @@ service availability. https://www.elastic.co/observability[Elastic {observability}] provides a single stack to unify your logs, infrastructure metrics, uptime data, application traces, user experience data, synthetics, and universal profiling. Ingest your data directly to {es}, where you can further process and enhance the data, -before visualizing it and adding alerts in {kib}. +before visualizing it and adding alerts in {kib}. -//Add new data flow graphic +[subs=attributes+] +include::diagrams/what-is-obs.asciidoc[] [float] [[apm-overview]] == Application performance monitoring (APM) Instrument your code and collect performance data and errors at runtime by installing APM agents -like Java, Go, .NET, and many more. +like Java, Go, .NET, and many more. On the {observability} **Overview** page, the *Services* chart shows the total number of services running within your environment and the total number of transactions per minute that were captured by the Elastic APM agent instrumenting those services. @@ -40,7 +41,7 @@ For more information, see <>. == Infrastructure monitoring Monitor system and service metrics from your servers, Docker, Kubernetes, Prometheus, and other -services and applications. +services and applications. On the {observability} **Overview** page, the *Hosts* table shows your top hosts with the most significant resource footprints. These metrics help you evaluate host efficiency and determine if resource consumption is impacting end-users. @@ -111,6 +112,6 @@ On the {observability} **Overview** page, the *Alerts* table provides a snapshot [role="screenshot"] image::images/alerts-overview.png[Summary of Alerts on the {observability} overview page] -You can then see more details on these alerts by clicking *Show alerts*. +You can then see more details on these alerts by clicking *Show alerts*. For more information, see <>. \ No newline at end of file From 3b53881a95b716cd2acb0589bfcb3ae143c1d336 Mon Sep 17 00:00:00 2001 From: bmorelli25 Date: Fri, 28 Apr 2023 07:51:17 -0700 Subject: [PATCH 12/22] fix link --- docs/en/observability/diagrams/what-is-obs.asciidoc | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/docs/en/observability/diagrams/what-is-obs.asciidoc b/docs/en/observability/diagrams/what-is-obs.asciidoc index ee82420c95..607a03b6b3 100644 --- a/docs/en/observability/diagrams/what-is-obs.asciidoc +++ b/docs/en/observability/diagrams/what-is-obs.asciidoc @@ -36,9 +36,8 @@ Uptime User experience User journey Web performance Synthetic -Application Cloud-native eBPF Infrastructure Services Whole system - -Profiling +Profiling +Application Cloud-native eBPF Infrastructure Services Whole system From e96e16f139451f9515e0616649c239e460ebedb2 Mon Sep 17 00:00:00 2001 From: bmorelli25 Date: Fri, 28 Apr 2023 07:59:23 -0700 Subject: [PATCH 13/22] moar diagram stuffs --- .../diagrams/what-is-obs.asciidoc | 70 +++++++++---------- 1 file changed, 33 insertions(+), 37 deletions(-) diff --git a/docs/en/observability/diagrams/what-is-obs.asciidoc b/docs/en/observability/diagrams/what-is-obs.asciidoc index 607a03b6b3..1fcfbb896e 100644 --- a/docs/en/observability/diagrams/what-is-obs.asciidoc +++ b/docs/en/observability/diagrams/what-is-obs.asciidoc @@ -1,43 +1,39 @@ ++++
- - - -Elastic Observability - - - - -Microservices Cloud-native OpenTelemetry Serverless - -APM data -Application Cloud Container Database Infrastructure Web - -Logs - - - - - - - -Out of the box -Dashboards Visualizations Anomaly detection Dependency mapping - - -Custom curated -Alerts Cases Contextual signals Custom links - - -Container Database Host Network Storage - -Metrics -Uptime User experience User journey Web performance - -Synthetic -Profiling -Application Cloud-native eBPF Infrastructure Services Whole system + + + +Elastic Observability + + + + +APM data +Microservices Cloud-native OpenTelemetry Serverless +Logs +Application Cloud Container Database Infrastructure Web + + + + + + + +Out of the box +Dashboards Visualizations Anomaly detection Dependency mapping + + +Custom curated +Alerts Cases Contextual signals Custom links + + +Metrics +Container Database Host Network Storage +Synthetic +Uptime User experience User journey Web performance +Profiling +Application Cloud-native eBPF Infrastructure Services Whole system
From a8c9dc82454e1ef6b1363359101d830737e344e5 Mon Sep 17 00:00:00 2001 From: mdbirnstiehl Date: Fri, 28 Apr 2023 10:32:58 -0500 Subject: [PATCH 14/22] update with review suggestions --- .../observability-introduction.asciidoc | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/docs/en/observability/observability-introduction.asciidoc b/docs/en/observability/observability-introduction.asciidoc index 6c5f797b71..66f6e4e852 100644 --- a/docs/en/observability/observability-introduction.asciidoc +++ b/docs/en/observability/observability-introduction.asciidoc @@ -3,13 +3,8 @@ = What is Elastic {observability}? {observability} provides granular insights and context into the behavior of applications running in your environments. -It's is an important part of any system that you build and want to monitor. -Being able to detect and fix root cause events quickly within an observable system should be a minimum requirement for any analyst. - -Search, monitor, and apply analytics in real time to events happening across all of -your environments. Analyze the logs for a specific transaction, monitor the performance metrics -for the host or container that it ran in, trace the transaction, and check the overall -service availability. +It's an important part of any system that you build and want to monitor. +Being able to detect and fix root cause events quickly within an observable system is a minimum requirement for any analyst. https://www.elastic.co/observability[Elastic {observability}] provides a single stack to unify your logs, infrastructure metrics, uptime data, application traces, user experience data, synthetics, and universal profiling. @@ -78,7 +73,7 @@ On the {observability} **Overview** page, the *Log Events* chart helps you detec [role="screenshot"] image::images/log-rate.png[Summary of Log Events on the {observability} overview page] -You can then drill-down into the {logs-app} by clicking *Show log stream* to view a live stream of your logs and filter, pin, or highlight the data you need. +You can then drill down into the {logs-app} by clicking *Show log stream* to view a live stream of your logs, and the filter, pin, or highlight the data you need. For more information, see <>. @@ -86,7 +81,7 @@ For more information, see <>. [[synthetic-monitoring-overview]] == Synthetic monitoring -beta[] Simulate actions and requests that an end-user would perform on your site at predefined intervals and in a controlled environment. +beta[] Simulate actions and requests that an end user would perform on your site at predefined intervals and in a controlled environment. The end result is rich, consistent, and repeatable data that you can trend and alert on. For more information, see <>. @@ -94,7 +89,7 @@ For more information, see <>. [float] [[universal-profiling-overview]] == Universal Profiling -beta[] Build stack traces to get visibility into your system without application source code changes or instrumentation. Use flamegraphs to explore your systems performance and identify the most expensive lines of code, increase CPU resource efficiency, debug performance regressions, and reduce cloud spend. +beta[] Build stack traces to get visibility into your system without application source code changes or instrumentation. Use flamegraphs to explore system performance and identify the most expensive lines of code, increase CPU resource efficiency, debug performance regressions, and reduce cloud spend. For more information, see <>. From 5056f3190710746c44303d821109fcdd2fed1c8a Mon Sep 17 00:00:00 2001 From: dedemorton Date: Fri, 28 Apr 2023 10:53:14 -0700 Subject: [PATCH 15/22] Remove standalone tip --- docs/en/observability/logs-metrics-get-started.asciidoc | 7 ------- docs/en/observability/splunk-get-started.asciidoc | 2 -- 2 files changed, 9 deletions(-) diff --git a/docs/en/observability/logs-metrics-get-started.asciidoc b/docs/en/observability/logs-metrics-get-started.asciidoc index dd9dfc1a74..06011b4303 100644 --- a/docs/en/observability/logs-metrics-get-started.asciidoc +++ b/docs/en/observability/logs-metrics-get-started.asciidoc @@ -35,13 +35,6 @@ To get started quickly, spin up a deployment of our hosted {ess}. The {ess} is available on AWS, GCP, and Azure. {ess-trial}[Try it out for free]. // end::monitoring-prereqs[] -// tag::standalone-tip[] -TIP: Not using {fleet}? Advanced users who want to configure and manage -{agent}s manually can -{fleet-guide}/install-standalone-elastic-agent.html[run agents standalone]. -// end::standalone-tip[] - - [discrete] [[add-system-integration]] == Step 1: Add the {agent} System integration diff --git a/docs/en/observability/splunk-get-started.asciidoc b/docs/en/observability/splunk-get-started.asciidoc index e39c96069b..d97790e246 100644 --- a/docs/en/observability/splunk-get-started.asciidoc +++ b/docs/en/observability/splunk-get-started.asciidoc @@ -35,8 +35,6 @@ The options are the same for Apache, AWS CloudTrail, and Zeek. include::{observability-docs-root}/docs/en/observability/logs-metrics-get-started.asciidoc[tag=monitoring-prereqs] -include::{observability-docs-root}/docs/en/observability/logs-metrics-get-started.asciidoc[tag=standalone-tip] - [discrete] [[splunk-step-one]] == Step 1: Add integration From 256fbe8564eee393f14c77f001cf9aa261b6e934 Mon Sep 17 00:00:00 2001 From: dedemorton Date: Fri, 28 Apr 2023 13:17:21 -0700 Subject: [PATCH 16/22] Remove old files --- .../add-observability-data.asciidoc | 21 -- .../deploy-agent-to-send-data.asciidoc | 19 -- .../deploy-beats-to-send-data.asciidoc | 27 -- docs/en/observability/gcp-dataflow.asciidoc | 1 - docs/en/observability/ingest-logs.asciidoc | 211 -------------- docs/en/observability/ingest-metrics.asciidoc | 173 ------------ docs/en/observability/ingest-uptime.asciidoc | 262 ------------------ .../en/observability/instrument-apps.asciidoc | 63 ----- .../observability/monitor-aws-agent.asciidoc | 3 +- .../observability/monitor-aws-beats.asciidoc | 1 - docs/en/observability/monitor-gcp.asciidoc | 1 - .../view-infrastructure-metrics.asciidoc | 3 +- .../observability/monitor-java-app.asciidoc | 2 +- .../monitor-k8s/monitor-k8s-overview.asciidoc | 3 +- docs/en/observability/redirects.asciidoc | 6 +- docs/en/observability/spin-up-stack.asciidoc | 14 - .../en/observability/user-experience.asciidoc | 2 +- 17 files changed, 10 insertions(+), 802 deletions(-) delete mode 100644 docs/en/observability/add-observability-data.asciidoc delete mode 100644 docs/en/observability/deploy-agent-to-send-data.asciidoc delete mode 100644 docs/en/observability/deploy-beats-to-send-data.asciidoc delete mode 100644 docs/en/observability/ingest-logs.asciidoc delete mode 100644 docs/en/observability/ingest-metrics.asciidoc delete mode 100644 docs/en/observability/ingest-uptime.asciidoc delete mode 100644 docs/en/observability/instrument-apps.asciidoc delete mode 100644 docs/en/observability/spin-up-stack.asciidoc diff --git a/docs/en/observability/add-observability-data.asciidoc b/docs/en/observability/add-observability-data.asciidoc deleted file mode 100644 index 766eeee1e2..0000000000 --- a/docs/en/observability/add-observability-data.asciidoc +++ /dev/null @@ -1,21 +0,0 @@ -[[add-observability-data]] -= Send data to {es} - -Elastic provides two main ways to send data to {es}: - -* *{agent}*, a single agent for logs, metrics, uptime, security data, and threat -prevention. - -* *Legacy {beats}*, lightweight data shippers that send operational data to -{es}. Elastic provides separate {beats} for different types of data, such as -logs, metrics, and uptime. - -The method you use depends on your use case, which features you need, and -whether you want to centrally manage your agents. Not sure whether to use -{beats} or {agent}? Refer to {fleet-guide}/beats-agent-comparison.html[{beats} -and {agent} capabilities]. - -To get started, refer to: - -* <> -* <> \ No newline at end of file diff --git a/docs/en/observability/deploy-agent-to-send-data.asciidoc b/docs/en/observability/deploy-agent-to-send-data.asciidoc deleted file mode 100644 index e2d94112a8..0000000000 --- a/docs/en/observability/deploy-agent-to-send-data.asciidoc +++ /dev/null @@ -1,19 +0,0 @@ -[[deploy-agent-to-send-data]] -= Deploy {agent} to send data - -{agent} is a single, unified way to add monitoring for logs, metrics, and other -types of data to a host. It can also protect hosts from security threats, query -data from operating systems, forward data from remote services or hardware, and -more. - -Prefer to use our legacy {beats} for your use case? Refer to -<>. - -To get started with {agent}, refer to: - -* <> - -* <> - -* <> - diff --git a/docs/en/observability/deploy-beats-to-send-data.asciidoc b/docs/en/observability/deploy-beats-to-send-data.asciidoc deleted file mode 100644 index 3213c7e3b6..0000000000 --- a/docs/en/observability/deploy-beats-to-send-data.asciidoc +++ /dev/null @@ -1,27 +0,0 @@ -[[deploy-beats-to-send-data]] -= Deploy {beats} to send data - -{beats} are lightweight data shippers that send operational data to -{es}. Elastic provides separate {beats} for different types of data, such as -logs, metrics, and uptime. To send observability data, you must install multiple -shippers on a single host. - -Prefer to use a single agent for your use case? Refer to -<>. - -To get started with {beats}: - -. Install and configure {filebeat} on your servers to collect log events. For details, refer to -<>. - -. Install and configure {metricbeat} on your servers to collect and preprocess system -and service metrics, such as information about running processes, as well as CPU, memory, -disk, and network utilization numbers. For details, refer to <>. - -. Install and configure {heartbeat} on your servers to periodically check the status of your -services. For details, refer to <>. - -. If you have added an APM Server as part of an {ess-trial}[{ess}] deployment, configure your -APM agents to send data to your {es} cluster. For details, refer to <>. - - diff --git a/docs/en/observability/gcp-dataflow.asciidoc b/docs/en/observability/gcp-dataflow.asciidoc index c9d77ac69e..357cd45f83 100644 --- a/docs/en/observability/gcp-dataflow.asciidoc +++ b/docs/en/observability/gcp-dataflow.asciidoc @@ -19,7 +19,6 @@ view those logs in {kib}. Create a deployment using our hosted {ess} on {ess-trial}[{ecloud}]. The deployment includes an {es} cluster for storing and searching your data, and {kib} for visualizing and managing your data. -For more information, see <>. [discrete] ==== Step 1: Install the GCP integration diff --git a/docs/en/observability/ingest-logs.asciidoc b/docs/en/observability/ingest-logs.asciidoc deleted file mode 100644 index 7c3b082f0d..0000000000 --- a/docs/en/observability/ingest-logs.asciidoc +++ /dev/null @@ -1,211 +0,0 @@ -[chapter, role="xpack"] -[[ingest-logs]] - -:beatname_uc: Filebeat -:beatname_lc: filebeat -:beatname_pkg: {beatname_lc} -:beatname_url: {beats-ref-root}/{beatname_lc}/{branch} -:modulename: nginx -:has_modules_command: - -[[ingest-logs]] -= Ingest logs with {filebeat} - -++++ -Ingest logs -++++ - -[NOTE] -===== -If you haven't already, you need to install {es} for storing and searching your data, and {kib} for visualizing and -managing it. For more information, see <>. -===== - -Install and configure {filebeat} on your servers to collect log events. {filebeat} allows you ship log data from sources that come -in the form of files. It monitors the log files or locations that you specify, -collects log events, and forwards them to {es}. To ease the collection and parsing of -log formats for common applications such as Apache, MySQL, and Kafka, a number of -{filebeat-ref}/filebeat-modules.html[modules] are available. - -[discrete] -[[install-filebeat]] -== Step 1: Install {beatname_uc} - -Install {beatname_uc} on all the servers you want to monitor. - -To download and install {beatname_uc}, use the commands that work with your system: - -include::{beats-repo-dir}/tab-widgets/install-widget.asciidoc[] - -[discrete] -[[other-filebeat-installations]] -=== Other installation options - -// TODO: include a ref to the new docs for running cloud on Kubernetes. Issue number https://github.com/elastic/beats/pull/19966 -* {filebeat-ref}/running-on-kubernetes.html[Kubernetes] -* {filebeat-ref}/running-on-docker.html[Docker] -* {filebeat-ref}/running-on-cloudfoundry.html[Cloud Foundry] -* {filebeat-ref}/setup-repositories.html[APT or YUM] -* https://www.elastic.co/downloads/beats/filebeat[Download page] - -[discrete] -[[logs-connect-to-stack]] -== Step 2: Connect to {es} and {kib} - -Connections to {es} and {kib} are required to set up {beatname_uc}. - -Set the connection information in `filebeat.yml`. To locate this configuration file, -see {filebeat-ref}/directory-layout.html[Directory layout]. - -include::{beats-repo-dir}/tab-widgets/set-connection-widget.asciidoc[] - -To learn more about required roles and privileges, see {filebeat-ref}/feature-roles.html[Grant users access to secured resources]. - -[NOTE] -===== - -You can send data to other {filebeat-ref}/configuring-output.html[outputs], such as {ls}, -but that requires additional configuration and setup. - -===== - -[discrete] -[[enable-logs-modules]] -== Step 3: Enable and configure modules - -{beatname_uc} uses modules to collect and parse log data. - -. Identify the modules you need to enable. To see a list of available {filebeat-ref}/filebeat-modules.html[modules], run: -+ --- -include::{beats-repo-dir}/tab-widgets/list-modules-widget.asciidoc[] --- -+ -Can’t find a module for your file type? Skip this section and -{filebeat-ref}/configuration-filebeat-options.html[configure the input manually]. - -. From the installation directory, enable one or more modules. For example, the -following command enables the +{modulename}+ module config: -+ --- -include::{beats-repo-dir}/tab-widgets/enable-modules-widget.asciidoc[] --- - -. In the module config under `modules.d`, change the module settings to match -your environment. You must enable at least one fileset in the module. -**Filesets are disabled by default.** -+ -For example, log locations are set based on the OS. If your logs aren't in -default locations, set the `paths` variable: -+ --- -[source,yaml] ----- -- module: nginx - access: - enabled: true - var.paths: ["/var/log/nginx/access.log*"] <1> ----- --- - -To see the full list of variables for a module, see the documentation under -{filebeat-ref}/filebeat-modules.html[Modules]. - -[TIP] -===== -To test your configuration file, change to the directory where the {beatname_uc} binary -is installed, and run {beatname_uc} in the foreground with the following options specified: -`./filebeat test config -e`. Make sure your config files are in the path expected by -{beatname_uc} (see {filebeat-ref}/directory-layout.html[Directory layout]), -or use the `-c` flag to specify the path to the config file. -===== - -For more information about configuring {beatname_uc}, also see: - -* {filebeat-ref}/configuring-howto-filebeat.html[Configure {beatname_uc}] -* {beats-ref}/config-file-format.html[Config file format] -* {filebeat-ref}/filebeat-reference-yml.html[`filebeat.reference.yml`]: This reference -configuration file shows all non-deprecated options. You’ll find it in the same location as `filebeat.yml`. - -[discrete] -[[set-filebeat-assets]] -== Step 4: Set up assets -{beatname_uc} comes with predefined assets for parsing, indexing, and -visualizing your data. To load these assets: - -. Make sure the user specified in `filebeat.yml` is -{filebeat-ref}/privileges-to-setup-beats.html[authorized to set up {beatname_uc}]. - -. From the installation directory, run: -+ --- -include::{beats-repo-dir}/tab-widgets/setup-widget.asciidoc[] --- -+ -`-e` is optional and sends output to standard error instead of the configured log output. - -This step loads the recommended {ref}/indices-templates.html[index template] for writing to {es} -and deploys the sample dashboards for visualizing the data in {kib}. - -This step does not load the ingest pipelines used to parse log lines. By -default, ingest pipelines are set up automatically the first time you run the -module and connect to {es}. - -[TIP] -===== -A connection to {es} (or {ess}) is required to set up the initial -environment. If you're using a different output, such as {ls}, see: - -* {filebeat-ref}/filebeat-template.html#load-template-manually[Load the index template manually] -* {filebeat-ref}/load-kibana-dashboards.html[Load {kib} dashboards] -* {filebeat-ref}/load-ingest-pipelines.html[Load ingest pipelines] -===== - -[discrete] -[[start-filebeat]] -== Step 5: Start {beatname_uc} - -Before starting {beatname_uc}, modify the user credentials in -`filebeat.yml` and specify a user who is -{filebeat-ref}/privileges-to-publish-events.html[authorized to publish events]. - -To start {beatname_uc}, run: - -// tag::start-step[] -:requires-sudo: -include::{beats-repo-dir}/tab-widgets/start-widget.asciidoc[] -:requires-sudo!: -// end::start-step[] - -{beatname_uc} should begin streaming events to {es}. - -[discrete] -[[view-logs-kibana]] -== Step 6: Confirm logs are streaming - -Let's confirm your data is correctly streaming to your cloud instance. - -. Launch {kib}: -+ --- -include::{beats-repo-dir}/tab-widgets/open-kibana-widget.asciidoc[] --- - -. Open the main menu, then click *Discover*. -+ -. Select `filebeat-*` as your {data-source}. -+ -Each document in the index that matches the `filebeat-*` {data-source} -is displayed. By default, *Discover* shows data for the last 15 minutes. If you have -a time-based index, and no data displays, you might need to increase the time range. -+ -You can now search your log messages, filter your search results, add or remove fields, -examine the document contents in either table or JSON format, and view a document in context. - -Now let's have a look at the <>. - -:!beatname_uc: -:!beatname_lc: -:!beatname_pkg: -:!modulename: -:!has_modules_command: diff --git a/docs/en/observability/ingest-metrics.asciidoc b/docs/en/observability/ingest-metrics.asciidoc deleted file mode 100644 index d5049b38cd..0000000000 --- a/docs/en/observability/ingest-metrics.asciidoc +++ /dev/null @@ -1,173 +0,0 @@ -[chapter, role="xpack"] -[[ingest-metrics]] - -:beatname_uc: Metricbeat -:beatname_lc: metricbeat -:beatname_pkg: {beatname_lc} -:beatname_url: {beats-ref-root}/{beatname_lc}/{branch} -:modulename: nginx -:has_modules_command: - -[[ingest-metrics]] -= Ingest metrics with {metricbeat} - -++++ -Ingest metrics -++++ - -[NOTE] -===== -If you haven't already, you need to install {es} for storing and searching your data, and {kib} for visualizing and -managing it. For more information, see <>. -===== - -Install and configure {metricbeat} on your servers to collect and preprocess system -and service metrics, such as information about running processes, as well as CPU, memory, -disk, and network utilization numbers. - -{metricbeat} comes with predefined assets for parsing, indexing, and -visualizing your data. To load these assets, {metricbeat} uses -{metricbeat-ref}/metricbeat-modules.html[modules], before sending them to {es}. Each -integration defines the basic logic for collecting data from specific services, such as -Redis or MySQL. A module consists of metricsets that fetch and structure the data. To learn more, see -{metricbeat-ref}/how-metricbeat-works.html[How {metricbeat} works]. - -[discrete] -[[install-metricbeat]] -== Step 1: Install {metricbeat} - -Install {metricbeat} as close as possible to the service you want to monitor. - -To download and install {metricbeat}, use the commands that work with your system: - -include::{beats-repo-dir}/tab-widgets/install-widget.asciidoc[] - -[discrete] -=== Other installation options - -* {metricbeat-ref}/running-on-kubernetes.html[Kubernetes] -* {metricbeat-ref}/running-on-docker.html[Docker] -* {metricbeat-ref}/running-on-cloudfoundry.html[Cloud Foundry] -* {metricbeat-ref}/setup-repositories.html[APT or YUM] -* https://www.elastic.co/downloads/beats/{beatname_lc}[Download page] - -[discrete] -[[metrics-connect-to-stack]] -== Step 2: Connect to {es} and {kib} - -Connections to {es} and {kib} are required to set up {beatname_uc}. - -Set the connection information in `metricbeat.yml`. To locate this configuration file, -see {metricbeat-ref}/directory-layout.html[Directory layout]. - -include::{beats-repo-dir}/tab-widgets/set-connection-widget.asciidoc[] - -To learn more about required roles and privileges, see {metricbeat-ref}/feature-roles.html[Grant users access to secured resources]. - -[discrete] -[[enable-metrics-modules]] -== Step 3: Enable and configure modules - -. Identify the modules you need to enable. To see a list of available {metricbeat-ref}/metricbeat-modules.html[modules], run: -+ --- -include::{beats-repo-dir}/tab-widgets/list-modules-widget.asciidoc[] --- - -. From the installation directory, enable one or more modules. If you accept the default configuration without enabling additional -modules, {beatname_uc} collects system metrics only. -+ -The following command enables the +{modulename}+ config in the `modules.d` directory: -+ --- -include::{beats-repo-dir}/tab-widgets/enable-modules-widget.asciidoc[] --- -+ -See the {metricbeat-ref}/command-line-options.html#modules-command[modules command] -to learn more about this command. If you are using a Docker image, -see {metricbeat-ref}/running-on-docker.html[Run {metricbeat} on Docker]. - -. In the module config under `modules.d`, change the module settings to match your environment. -See {metricbeat-ref}/configuration-metricbeat.html#module-config-options[Standard config options] -for more about available settings. - -TIP: To test your configuration file, change to the directory where the {beatname_uc} binary is installed, and run -{beatname_uc} in the foreground with the following options specified: `./metricbeat test config -e`. Make sure -your config files are in the path expected by {beatname_uc} (see -{metricbeat-ref}/directory-layout.html[Directory layout]), or use -the `-c` flag to specify the path to the config file. - -For more information about configuring {beatname_uc}, also see: - -* {metricbeat-ref}/configuring-howto-metricbeat.html[Configure {beatname_uc}] -* {beats-ref}/config-file-format.html[Config file format] -* {metricbeat-ref}/metricbeat-reference-yml.html[`metricbeat.reference.yml`]: -This reference configuration file shows all non-deprecated options. You’ll find it in the same location as `metricbeat.yml`. - -[discrete] -[[set-metricbeat-assets]] -== Step 4: Set up assets - -{beatname_uc} comes with predefined assets for parsing, indexing, and -visualizing your data. To load these assets: - -. Make sure the user specified in `metricbeat.yml` is authorized to set up {metricbeat-ref}/privileges-to-setup-beats.html[{beatname_uc}]. - -. From the installation directory, run: -+ --- -include::{beats-repo-dir}/tab-widgets/setup-widget.asciidoc[] --- -+ -`-e` is optional and sends output to standard error instead of the configured log output. - -This step loads the recommended {ref}/indices-templates.html[index template] -for writing to {es} and deploys the sample dashboards for visualizing the data in {kib}. - -TIP: A connection to {es} (or {ess}) is required to set up the initial environment. -If you’re using a different output, such as {ls}, see -{metricbeat-ref}/metricbeat-template.html#load-template-manually[Load the index template manually] -and {metricbeat-ref}/load-kibana-dashboards.html[Load {kib} dashboards]. - -[discrete] -[[start-metricbeat]] -== Step 5: Start {beatname_uc} - -Before starting {beatname_uc}, modify the user credentials in -`metricbeat.yml` and specify a user who is -{metricbeat-ref}/privileges-to-publish-events.html[authorized to publish events]. - -To start {beatname_uc}, run: - -// tag::start-step[] -:requires-sudo: -include::{beats-repo-dir}/tab-widgets/start-widget.asciidoc[] -:requires-sudo!: -// end::start-step[] - -[discrete] -[[view-metrics-kibana]] -== Step 6: Confirm metrics are ingested - -Let's confirm your data is correctly ingested to your cluster. - -. Launch {kib}: -+ --- -include::{beats-repo-dir}/tab-widgets/open-kibana-widget.asciidoc[] --- - -. Open the main menu, then click *Discover* -+ -. Select `metricbeat-*` as your {data-source}. -+ -Each document in the index that matches the `metricbeat-*` {data-source} -is displayed. By default, *Discover* shows data for the last 15 minutes. - -Now let's have a look at the <>. - -:!beatname_uc: -:!beatname_lc: -:!beatname_pkg: -:!modulename: -:!has_modules_command: diff --git a/docs/en/observability/ingest-uptime.asciidoc b/docs/en/observability/ingest-uptime.asciidoc deleted file mode 100644 index 91fc731328..0000000000 --- a/docs/en/observability/ingest-uptime.asciidoc +++ /dev/null @@ -1,262 +0,0 @@ -[chapter, role="xpack"] -[[ingest-uptime]] - -:beatname_uc: Heartbeat -:beatname_lc: heartbeat -:beatname_pkg: heartbeat-elastic -:beatname_url: {beats-ref-root}/{beatname_lc}/{branch} - -[[ingest-uptime]] -= Ingest uptime data with {heartbeat} - -++++ -Ingest uptime data -++++ - -[NOTE] -===== -If you haven't already, you need to install {es} for storing and searching your data, and {kib} for visualizing and -managing it. For more information, see <>. -===== - -Install and configure {heartbeat} on your servers to periodically check the status of your -services. {heartbeat} uses probing to monitor the availability of services and helps -verify that you’re meeting your service level agreements for service uptime. -You typically install {heartbeat} as part of a monitoring service that runs on a separate machine -and possibly even outside of the network where the services that you want to monitor are running. - -[discrete] -[[deployment-considerations]] -== Deployment considerations - -There are multiple ways to deploy Uptime and {heartbeat}. A guiding principle is that when -an outage takes down the service being monitored, it should not take down {heartbeat}. - -{heartbeat} is commonly run as a centralized service within a data center. -While it's possible to run it as a separate "sidecar" process paired with each process/container, -we recommend against it. Running {heartbeat} centrally ensures you will still be able to see -monitoring data in the event of an overloaded, disconnected, or otherwise malfunctioning server. - -For further redundancy, you may want to deploy multiple instances of {heartbeat} across geographic and network boundaries -to provide more data. - -For example: - -* A site served from a content delivery network (CDN) with points of presence (POPs) around the globe. -+ -To check if your site is reachable via CDN POPS, deploy multiple {heartbeat} instances at -different data centers around the world. -+ -* A service within a single data center that is accessed across multiple VPNs. -+ -Set up one {heartbeat} instance within the VPN the service operates from, and another within an additional -VPN that users access the service from. In the event of an outage, having both instances helps pinpoint -the network errors. -+ -* A single service running primarily in a US east coast data center, with a hot failover located in -a US west coast data center. -+ -In each data center, run a {heartbeat} instance that checks both the local -copy of the service and its counterpart across the country. Set up two monitors in each region, one for -the local service, and one for the remote service. In the event of a data center failure, it will be -immediately apparent if the service has a connectivity issue to the outside world, or if the failure is only internal. - -[discrete] -[[install-heartbeat]] -== Step 1: Install {beatname_uc} - -You typically install {heartbeat} as part of a monitoring service that runs on a separate machine -and possibly even outside of the network where the services that you want to monitor are running. - -To download and install {beatname_uc}, use the commands that work with your system: - -include::{beats-repo-dir}/tab-widgets/install-widget.asciidoc[] - -[discrete] -[[other-heartbeat-installations]] -=== Other installation options - -* {heartbeat-ref}/running-on-docker.html[Docker] -* {heartbeat-ref}/setup-repositories.html[APT or YUM] -* https://www.elastic.co/downloads/beats/heartbeat[Download page] - -[discrete] -[[uptime-connect-to-stack]] -== Step 2: Connect to {es} and {kib} - -Connections to {es} and {kib} are required to set up {beatname_uc}. - -Set the connection information in `heartbeat.yml`. To locate this configuration file, -see {heartbeat-ref}/directory-layout.html[Directory layout]. - -include::{beats-repo-dir}/tab-widgets/set-connection-widget.asciidoc[] - -[NOTE] -===== - -You can send data to other {heartbeat-ref}/configuring-output.html[outputs], such as {ls}, -but that requires additional configuration and setup. - -===== - -To learn more about required roles and privileges, see {heartbeat-ref}/feature-roles.html[Grant users access to secured resources]. - -[discrete] -[[heartbeat-configuration]] -== Step 3: Configure {beatname_uc} monitors - -{beatname_uc} provides monitors to check the status of hosts at set intervals. -{beatname_uc} currently provides monitors for ICMP, TCP, and HTTP (see -{heartbeat-ref}/heartbeat-overview.html[{beatname_uc} overview] for more about these monitors). - -You configure each monitor individually. In `heartbeat.yml`, specify the -list of monitors that you want to enable. Each item in the list begins with a -dash (-). The following example configures {beatname_uc} to use two monitors, an -`icmp` monitor and a `tcp` monitor: - -[source,yaml] ----------------------------------------------------------------------- -heartbeat.monitors: -- type: icmp - schedule: '*/5 * * * * * *' <1> - hosts: ["myhost"] -- type: tcp - schedule: '@every 5s' <2> - hosts: ["myhost:12345"] - mode: any <3> ----------------------------------------------------------------------- -<1> The `icmp` monitor is scheduled to run exactly every 5 seconds (10:00:00, -10:00:05, and so on). The `schedule` option uses a cron-like syntax based on -https://github.com/gorhill/cronexpr#implementation[this `cronexpr` implementation]. -<2> The `tcp` monitor is set to run every 5 seconds from the time when {beatname_uc} -was started. {beatname_uc} adds the `@every` keyword to the syntax provided by the -`cronexpr` package. -<3> The `mode` specifies whether to ping one IP (`any`) or all resolvable IPs -(`all`). - -[TIP] -===== - -To test your configuration file, change to the directory where the {beatname_uc} binary -is installed, and run {beatname_uc} in the foreground with the following options specified: -`./heartbeat test config -e`. Make sure your config files are in the path expected by -{beatname_uc} (see {heartbeat-ref}/directory-layout.html[Directory layout]), or use the -`-c` flag to specify the path to the config file. -===== - -For more information about configuring {beatname_uc}, also see: - -* {heartbeat-ref}/configuring-howto-heartbeat.html[Configure {beatname_uc}] -* {beats-ref}/config-file-format.html[Config file format] -* {heartbeat-ref}/heartbeat-reference-yml.html[`heartbeat.reference.yml`]: This -reference configuration file shows all non-deprecated options. You’ll find it in the same location as `heartbeat.yml`. - -[discrete] -[[configure-heartbeat-location]] -== Step 4: Configure {beatname_uc} location - -{beatname_uc} can be deployed in multiple locations so that you can detect -differences in availability and response times across those locations. -Configure the {beatname_uc} location to allow {kib} to display location-specific -information on Uptime maps and perform Uptime {anomaly-detect} based -on location. - -To configure the location of a {beatname_uc} instance, modify the -`add_observer_metadata` processor in +{beatname_lc}.yml+. The following -example specifies the `geo.name` of the `add_observer_metadata` processor as -`us-east-1a`: - -[source,yaml] ----------------------------------------------------------------------- -# ============================ Processors ============================ - -processors: - - add_observer_metadata: - # Optional, but recommended geo settings for the location Heartbeat is running in - geo: <1> - # Token describing this location - name: us-east-1a <2> - # Lat, Lon " - #location: "37.926868, -78.024902" <3> ----------------------------------------------------------------------- -<1> Uncomment the `geo` setting. -<2> Uncomment `name` and assign the name of the location of the {heartbeat} server. -<3> Optionally uncomment `location` and assign the latitude and longitude. - -[TIP] -===== - -To test your configuration file, change to the directory where the {beatname_uc} binary -is installed, and run {beatname_uc} in the foreground with the following options specified: -`./heartbeat test config -e`. Make sure your config files are in the path expected by -{beatname_uc} (see {heartbeat-ref}/directory-layout.html[Directory layout]), or use the -`-c` flag to specify the path to the config file. -===== - -[discrete] -[[set-heartbeat-assets]] -== Step 5: Set up assets - -{beatname_uc} comes with predefined assets for parsing, indexing, and -visualizing your data. To load these assets: - -. Make sure the user specified in `heartbeat.yml` is -{heartbeat-ref}/privileges-to-setup-beats.html[authorized to set up {beatname_uc}]. - -. From the installation directory, run: -+ --- -include::{beats-repo-dir}/tab-widgets/setup-widget.asciidoc[] --- -+ -`-e` is optional and sends output to standard error instead of the configured log output. - -This step loads the recommended {ref}/indices-templates.html[index template] for writing to {es}. -It does not install {beatname_uc} dashboards. {beatname_uc} dashboards and -installation steps are available in the -https://github.com/elastic/uptime-contrib[uptime-contrib] GitHub repository. - -[TIP] -===== -A connection to {es} (or {ess}) is required to set up the initial -environment. If you're using a different output, such as {ls}, see -{heartbeat-ref}/heartbeat-template.html#load-template-manually[Load the index template manually]. -===== - -[discrete] -[[start-heartbeat]] -== Step 6: Start {beatname_uc} - -Before starting {beatname_uc}, modify the user credentials in -`heartbeat.yml` and specify a user who is -{heartbeat-ref}/privileges-to-publish-events.html[authorized to publish events]. - -To start {beatname_uc}, run: - -// tag::start-step[] -:requires-sudo: -include::{beats-repo-dir}/tab-widgets/start-widget.asciidoc[] -:requires-sudo!: -// end::start-step[] - -{beatname_uc} is now ready to check the status of your services and send events to your defined output. - -[discrete] -[[view-uptime-kibana]] -== Step 7: View your data in {kib} - -Let's confirm your data is correctly ingested to your cluster. - -. Launch {kib}: -+ --- -include::{beats-repo-dir}/tab-widgets/open-kibana-widget.asciidoc[] --- - -. In the side navigation, click *{observability} > Uptime*. - -Now let's have a look at the <>. - -:!beatname_uc: -:!beatname_lc: -:!beatname_pkg: diff --git a/docs/en/observability/instrument-apps.asciidoc b/docs/en/observability/instrument-apps.asciidoc deleted file mode 100644 index 9b3b10d8ec..0000000000 --- a/docs/en/observability/instrument-apps.asciidoc +++ /dev/null @@ -1,63 +0,0 @@ -[chapter, role="xpack"] -[[instrument-apps]] -= Instrument applications with APM - -++++ -Instrument applications -++++ - -Elastic APM monitors software services and applications in real time, collects unhandled -errors and exceptions, and automatically picks up basic host-level metrics and agent specific metrics. - -[NOTE] -===== -If you haven’t already, you need to install {es} for storing and searching your data, {kib} for -visualizing and managing it, and APM Server. For more information, see <>. -===== - -[discrete] -[[install-apm-agents]] -== Step 1: Install APM agents - --- -include::{apm-repo-dir}/legacy/tab-widgets/install-agents-widget.asciidoc[] --- - -[discrete] -[[configuring-apm]] -== Step 2: Configure APM - -[[configure-apm-data]] -Now that you're up and running with Elastic APM, you may want to adjust some configuration settings. -Luckily, there are many different ways to tweak and tune the Elastic ecosystem to adapt it to your needs. - -[[configure-apm-agents]] -*Configure APM Agents* - --- -include::{apm-repo-dir}/legacy/tab-widgets/configure-agent-widget.asciidoc[] --- - -[[configure-elastic-cloud]] -*Configure APM Server* - --- -include::{apm-repo-dir}/legacy/tab-widgets/configure-server-widget.asciidoc[] --- - -[discrete] -[[view-apm-data]] -== Step 3: View your data in {kib} - -To view the <> page: - -. Launch {kib}: -+ --- -include::{beats-repo-dir}/tab-widgets/open-kibana-widget.asciidoc[] --- - -. In the side navigation, select *{observability}*, and click *Overview*. - -:!beatname_uc: -:!beatname_lc: diff --git a/docs/en/observability/monitor-aws-agent.asciidoc b/docs/en/observability/monitor-aws-agent.asciidoc index 59aefefbbe..4c0af838b9 100644 --- a/docs/en/observability/monitor-aws-agent.asciidoc +++ b/docs/en/observability/monitor-aws-agent.asciidoc @@ -33,8 +33,7 @@ that your logs are streaming to {es}. Create a deployment using our hosted {ess} on {ess-trial}[{ecloud}]. The deployment includes an {es} cluster for storing and searching your data, -and {kib} for visualizing and managing your data. To learn more, refer to -<>. +and {kib} for visualizing and managing your data. In this tutorial, we assume that: diff --git a/docs/en/observability/monitor-aws-beats.asciidoc b/docs/en/observability/monitor-aws-beats.asciidoc index e3b2c23718..1af78a045d 100644 --- a/docs/en/observability/monitor-aws-beats.asciidoc +++ b/docs/en/observability/monitor-aws-beats.asciidoc @@ -27,7 +27,6 @@ You'll learn how to: Create a deployment using our hosted {ess} on {ess-trial}[{ecloud}]. The deployment includes an {es} cluster for storing and searching your data, and {kib} for visualizing and managing your data. -To learn more, see <>. With this tutorial, we assume that your logs and your infrastructure data are already shipped to CloudWatch. We are going to show you how you can diff --git a/docs/en/observability/monitor-gcp.asciidoc b/docs/en/observability/monitor-gcp.asciidoc index 8a49c8bce9..1722a33d0a 100644 --- a/docs/en/observability/monitor-gcp.asciidoc +++ b/docs/en/observability/monitor-gcp.asciidoc @@ -33,7 +33,6 @@ Google Cloud module] and view those logs in {kib}. Create a deployment using our hosted {ess} on {ess-trial}[{ecloud}]. The deployment includes an {es} cluster for storing and searching your data, and {kib} for visualizing and managing your data. -For more information, see <>. [discrete] === Step 1: Setup a Service Account diff --git a/docs/en/observability/monitor-infra/view-infrastructure-metrics.asciidoc b/docs/en/observability/monitor-infra/view-infrastructure-metrics.asciidoc index 31857e11e6..d2e9cca0b1 100644 --- a/docs/en/observability/monitor-infra/view-infrastructure-metrics.asciidoc +++ b/docs/en/observability/monitor-infra/view-infrastructure-metrics.asciidoc @@ -19,8 +19,7 @@ If there are no metrics to display, {kib} prompts you to add a metrics integration. Click **Add a metrics integration** to get started. If you want to add more data in the future, click **Add data** from any page in -the Infrastructure UI. To learn more about adding observability data, refer to -<>. +the Infrastructure UI. ==== // end::add-metrics-tip[] diff --git a/docs/en/observability/monitor-java-app.asciidoc b/docs/en/observability/monitor-java-app.asciidoc index a19bc906c0..7c2a48c50f 100644 --- a/docs/en/observability/monitor-java-app.asciidoc +++ b/docs/en/observability/monitor-java-app.asciidoc @@ -22,7 +22,7 @@ Java agent]. Create a deployment using our hosted {ess} on {ess-trial}[{ecloud}]. The deployment includes an {es} cluster for storing and searching your data, {kib} for visualizing and managing -your data, and an APM server. For more information, see <>. +your data, and an APM server. If you do not want to follow all those steps listed here and take a look at the final java code, check out the https://github.com/elastic/observability-contrib/tree/main/monitor-java-app[observability-contrib diff --git a/docs/en/observability/monitor-k8s/monitor-k8s-overview.asciidoc b/docs/en/observability/monitor-k8s/monitor-k8s-overview.asciidoc index b00ac89118..32d46f7c99 100644 --- a/docs/en/observability/monitor-k8s/monitor-k8s-overview.asciidoc +++ b/docs/en/observability/monitor-k8s/monitor-k8s-overview.asciidoc @@ -74,5 +74,4 @@ learn how to deploy monitoring to your Kubernetes environment. == Before you begin To monitor Kubernetes, you need {es} for storing and searching your -observability data, and {kib} for visualizing and managing it. For more -information, see <>. +observability data, and {kib} for visualizing and managing it. diff --git a/docs/en/observability/redirects.asciidoc b/docs/en/observability/redirects.asciidoc index ab0163a663..23609cb47d 100644 --- a/docs/en/observability/redirects.asciidoc +++ b/docs/en/observability/redirects.asciidoc @@ -3,6 +3,8 @@ The following pages have moved or been deleted. +//Start links removed in Spacetime revamp (https://github.com/elastic/observability-docs/pull/2880) + [role="exclude",id="add-observability-data"] === Send data to {es} @@ -60,11 +62,13 @@ instrument applications with APM, refer to Refer to <>. -[[ingest-splunk]] +[role="exclude",id="ingest-splunk"] === Ingest data from Splunk (Experimental) Refer to <>. +//End links removed in Spactime revamp (https://github.com/elastic/observability-docs/pull/2880) + [role="exclude",id="aws-elastic-serverless-forwarder"] === Elastic Serverless Forwarder for AWS diff --git a/docs/en/observability/spin-up-stack.asciidoc b/docs/en/observability/spin-up-stack.asciidoc deleted file mode 100644 index 47144a2466..0000000000 --- a/docs/en/observability/spin-up-stack.asciidoc +++ /dev/null @@ -1,14 +0,0 @@ -[[spin-up-stack]] -= Spin up the {stack} - -To use Elastic {observability}, you need {es} for storing and searching your -data, and {kib} for visualizing and managing it. - -You can use our -https://www.elastic.co/cloud/elasticsearch-service[hosted {ess}] -on {ecloud} (recommended), or self-manage the {stack} on your own hardware. - -include::{shared}/spin-up-the-stack/widget.asciidoc[] - -Now that you have provisioned your first deployment of your {es} cluster, -you’re ready to ingest your logs, metrics, uptime data, and APM data. diff --git a/docs/en/observability/user-experience.asciidoc b/docs/en/observability/user-experience.asciidoc index 73bbdd7e65..80a2a6e0dc 100644 --- a/docs/en/observability/user-experience.asciidoc +++ b/docs/en/observability/user-experience.asciidoc @@ -70,7 +70,7 @@ metrics every time a user hits one of your pages. This data is stored in {es}, where it can be visualized using {kib}. The RUM agent can be installed as a dependency to your application, or with just a few lines of JavaScript. -It only takes a few minutes to <>. +It only takes a few minutes to {apm-guide-ref}/getting-started-apm-server.html[get started]. [discrete] [[user-experience-tab]] From 43478d7a8df42fdf464b9879f4f5b6e1c643e52f Mon Sep 17 00:00:00 2001 From: bmorelli25 Date: Fri, 28 Apr 2023 13:45:04 -0700 Subject: [PATCH 17/22] colab diagram --- .../diagrams/get-started.asciidoc | 37 +++++++++++++------ 1 file changed, 25 insertions(+), 12 deletions(-) diff --git a/docs/en/observability/diagrams/get-started.asciidoc b/docs/en/observability/diagrams/get-started.asciidoc index 014c44a5ba..158e2af527 100644 --- a/docs/en/observability/diagrams/get-started.asciidoc +++ b/docs/en/observability/diagrams/get-started.asciidoc @@ -1,19 +1,32 @@ ++++
- - - - - - - - - - - - + + + + + + + + + +1 +Ingest your data +Ingest your data with
turn-key integrations in just a few clicks + +2 + +3 +Choose your source +Hundreds of data sources are supported +View your data +Curated user interfaces and visualizations show what’s happening in your systems +Customize +Add hosts, data sources, alerts, anomaly detection, and more + +4 +
++++ \ No newline at end of file From ea49d2f9c14f445857e9754898447c5e30c03616 Mon Sep 17 00:00:00 2001 From: Brandon Morelli Date: Fri, 28 Apr 2023 13:47:53 -0700 Subject: [PATCH 18/22] Update docs/en/observability/user-experience.asciidoc --- docs/en/observability/user-experience.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/en/observability/user-experience.asciidoc b/docs/en/observability/user-experience.asciidoc index 80a2a6e0dc..bbb98ab543 100644 --- a/docs/en/observability/user-experience.asciidoc +++ b/docs/en/observability/user-experience.asciidoc @@ -70,7 +70,7 @@ metrics every time a user hits one of your pages. This data is stored in {es}, where it can be visualized using {kib}. The RUM agent can be installed as a dependency to your application, or with just a few lines of JavaScript. -It only takes a few minutes to {apm-guide-ref}/getting-started-apm-server.html[get started]. +It only takes a few minutes to {apm-guide-ref}/apm-rum.html[get started]. [discrete] [[user-experience-tab]] From b7c2b207b8ecd2d6eb7f5c5a0bc9240063516502 Mon Sep 17 00:00:00 2001 From: dedemorton Date: Fri, 28 Apr 2023 18:40:29 -0700 Subject: [PATCH 19/22] Add overview for getting started topics --- .../observability-get-started.asciidoc | 40 +++++++++++++++++-- 1 file changed, 36 insertions(+), 4 deletions(-) diff --git a/docs/en/observability/observability-get-started.asciidoc b/docs/en/observability/observability-get-started.asciidoc index 06f233ccc7..45babfa397 100644 --- a/docs/en/observability/observability-get-started.asciidoc +++ b/docs/en/observability/observability-get-started.asciidoc @@ -5,10 +5,42 @@ Get started ++++ +Learn how to spin up a deployment of our hosted {ess} and use Elastic +Observability to gain deeper insight into the behavior of your applications and +systems. + +The guides in this section describe how to: + [subs=attributes+] include::diagrams/get-started.asciidoc[] -Overview of the process. -Diagram would be nice. -Mention other ingest methods (cloud native, Beats, etc) -Introduce the topics nested under this container. \ No newline at end of file +1. **Choose your source.** Elastic integrates with hundreds of data sources for +unified visibility across all your applications and systems. + +2. **Ingest your data.** Turn-key integrations provide a repeatable workflow to +ingest data from all your sources: you install an integration, configure it, and +deploy an agent to collect your data. + +3. **View your data.** Navigate seamlessly between Observabilty UIs and +dashboards to identify and resolve problems quickly. + +4. **Customize.** Expand your deployment and add features like alerting and anomaly +detection. + +[discrete] +== Get started now + +Follow the steps in these guides to get started: + +* <> +* <> +* <> + +[discrete] +== Related content + +* {estc-welcome}/getting-started-guides.html[Welcome to Elastic] for new users +* {cloud}/ec-cloud-ingest-data.html[Adding data to {es}] for other ways to +ingest data +* <> for hands-on steps + From bc0c8b4f7b0d85eaa53dd8254c0eff2c9d631410 Mon Sep 17 00:00:00 2001 From: bmorelli25 Date: Mon, 1 May 2023 13:58:53 -0700 Subject: [PATCH 20/22] use svg not asciidoc --- .../diagrams/get-started.asciidoc | 32 --------------- .../diagrams/what-is-obs.asciidoc | 40 ------------------- docs/en/observability/images/get-started.svg | 21 ++++++++++ .../observability-get-started.asciidoc | 4 +- .../observability-introduction.asciidoc | 3 +- 5 files changed, 23 insertions(+), 77 deletions(-) delete mode 100644 docs/en/observability/diagrams/get-started.asciidoc delete mode 100644 docs/en/observability/diagrams/what-is-obs.asciidoc create mode 100644 docs/en/observability/images/get-started.svg diff --git a/docs/en/observability/diagrams/get-started.asciidoc b/docs/en/observability/diagrams/get-started.asciidoc deleted file mode 100644 index 158e2af527..0000000000 --- a/docs/en/observability/diagrams/get-started.asciidoc +++ /dev/null @@ -1,32 +0,0 @@ -++++ -
- - - - - - - - - - -1 -Ingest your data -Ingest your data with
turn-key integrations in just a few clicks - -2 - -3 -Choose your source -Hundreds of data sources are supported -View your data -Curated user interfaces and visualizations show what’s happening in your systems -Customize -Add hosts, data sources, alerts, anomaly detection, and more - -4 - - - -
-++++ \ No newline at end of file diff --git a/docs/en/observability/diagrams/what-is-obs.asciidoc b/docs/en/observability/diagrams/what-is-obs.asciidoc deleted file mode 100644 index 1fcfbb896e..0000000000 --- a/docs/en/observability/diagrams/what-is-obs.asciidoc +++ /dev/null @@ -1,40 +0,0 @@ -++++ -
- - - - -Elastic Observability - - - - -APM data -Microservices Cloud-native OpenTelemetry Serverless -Logs -Application Cloud Container Database Infrastructure Web - - - - - - - -Out of the box -Dashboards Visualizations Anomaly detection Dependency mapping - - -Custom curated -Alerts Cases Contextual signals Custom links - - -Metrics -Container Database Host Network Storage -Synthetic -Uptime User experience User journey Web performance -Profiling -Application Cloud-native eBPF Infrastructure Services Whole system - - -
-++++ \ No newline at end of file diff --git a/docs/en/observability/images/get-started.svg b/docs/en/observability/images/get-started.svg new file mode 100644 index 0000000000..487355b2f9 --- /dev/null +++ b/docs/en/observability/images/get-started.svg @@ -0,0 +1,21 @@ + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/en/observability/observability-get-started.asciidoc b/docs/en/observability/observability-get-started.asciidoc index 45babfa397..4f5cd93fc4 100644 --- a/docs/en/observability/observability-get-started.asciidoc +++ b/docs/en/observability/observability-get-started.asciidoc @@ -11,8 +11,7 @@ systems. The guides in this section describe how to: -[subs=attributes+] -include::diagrams/get-started.asciidoc[] +image::images/get-started.svg[] 1. **Choose your source.** Elastic integrates with hundreds of data sources for unified visibility across all your applications and systems. @@ -43,4 +42,3 @@ Follow the steps in these guides to get started: * {cloud}/ec-cloud-ingest-data.html[Adding data to {es}] for other ways to ingest data * <> for hands-on steps - diff --git a/docs/en/observability/observability-introduction.asciidoc b/docs/en/observability/observability-introduction.asciidoc index 66f6e4e852..089b5f0802 100644 --- a/docs/en/observability/observability-introduction.asciidoc +++ b/docs/en/observability/observability-introduction.asciidoc @@ -11,8 +11,7 @@ single stack to unify your logs, infrastructure metrics, uptime data, applicatio Ingest your data directly to {es}, where you can further process and enhance the data, before visualizing it and adding alerts in {kib}. -[subs=attributes+] -include::diagrams/what-is-obs.asciidoc[] +// DIAGRAM GOES HERE [float] [[apm-overview]] From f5845220d43fb7e45f7698df39eddcf2e2a25faa Mon Sep 17 00:00:00 2001 From: mdbirnstiehl Date: Mon, 1 May 2023 16:01:27 -0500 Subject: [PATCH 21/22] update overview diagram --- .../images/what-is-observability.svg | 24 +++++++++++++++++++ .../observability-introduction.asciidoc | 5 ++-- 2 files changed, 26 insertions(+), 3 deletions(-) create mode 100644 docs/en/observability/images/what-is-observability.svg diff --git a/docs/en/observability/images/what-is-observability.svg b/docs/en/observability/images/what-is-observability.svg new file mode 100644 index 0000000000..b92a7b4912 --- /dev/null +++ b/docs/en/observability/images/what-is-observability.svg @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/en/observability/observability-introduction.asciidoc b/docs/en/observability/observability-introduction.asciidoc index 66f6e4e852..20a992545a 100644 --- a/docs/en/observability/observability-introduction.asciidoc +++ b/docs/en/observability/observability-introduction.asciidoc @@ -7,12 +7,11 @@ It's an important part of any system that you build and want to monitor. Being able to detect and fix root cause events quickly within an observable system is a minimum requirement for any analyst. https://www.elastic.co/observability[Elastic {observability}] provides a -single stack to unify your logs, infrastructure metrics, uptime data, application traces, user experience data, synthetics, and universal profiling. +single stack to unify your logs, infrastructure metrics, application traces, user experience data, synthetics, and universal profiling. Ingest your data directly to {es}, where you can further process and enhance the data, before visualizing it and adding alerts in {kib}. -[subs=attributes+] -include::diagrams/what-is-obs.asciidoc[] +image::images/what-is-observability.svg[Elastic {observability} overview diagram] [float] [[apm-overview]] From 20ce794cfe82b745a3b96c53802ced8579cc9c41 Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Mon, 1 May 2023 15:43:20 -0700 Subject: [PATCH 22/22] Apply suggestions from code review --- docs/en/observability/observability-get-started.asciidoc | 2 +- docs/en/observability/observability-introduction.asciidoc | 2 +- docs/en/observability/redirects.asciidoc | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/en/observability/observability-get-started.asciidoc b/docs/en/observability/observability-get-started.asciidoc index 4f5cd93fc4..435599c217 100644 --- a/docs/en/observability/observability-get-started.asciidoc +++ b/docs/en/observability/observability-get-started.asciidoc @@ -38,7 +38,7 @@ Follow the steps in these guides to get started: [discrete] == Related content -* {estc-welcome}/getting-started-guides.html[Welcome to Elastic] for new users +* {estc-welcome}/index.html[Starting with the {es} Platform and its Solutions] for new users * {cloud}/ec-cloud-ingest-data.html[Adding data to {es}] for other ways to ingest data * <> for hands-on steps diff --git a/docs/en/observability/observability-introduction.asciidoc b/docs/en/observability/observability-introduction.asciidoc index 20a992545a..b2f143ac56 100644 --- a/docs/en/observability/observability-introduction.asciidoc +++ b/docs/en/observability/observability-introduction.asciidoc @@ -37,7 +37,7 @@ For more information, see <>. Monitor system and service metrics from your servers, Docker, Kubernetes, Prometheus, and other services and applications. -On the {observability} **Overview** page, the *Hosts* table shows your top hosts with the most significant resource footprints. These metrics help you evaluate host efficiency and determine if resource consumption is impacting end-users. +On the {observability} **Overview** page, the *Hosts* table shows your top hosts with the most significant resource footprints. These metrics help you evaluate host efficiency and determine if resource consumption is impacting end users. [role="screenshot"] image::images/metrics-summary.png[Summary of Hosts on the {observability} overview page] diff --git a/docs/en/observability/redirects.asciidoc b/docs/en/observability/redirects.asciidoc index 23609cb47d..747fa3ddae 100644 --- a/docs/en/observability/redirects.asciidoc +++ b/docs/en/observability/redirects.asciidoc @@ -55,7 +55,7 @@ This page no longer exists in the Observability Guide. To learn how to deploy This page no longer exists in the Observability Guide. To learn how to instrument applications with APM, refer to -{apm-guide-ref}/getting-started-apm-server.html +{apm-guide-ref}/getting-started-apm-server.html[Getting started with APM Server]. [role="exclude",id="ingest-logs-metrics-uptime"] === Ingest logs and metrics with {agent}