Setting Up Log Aggregation
Overview
Deploy centralized log aggregation platforms (ELK Stack, Grafana Loki, Splunk) with ingestion pipelines, structured parsing, retention policies, visualization dashboards, and alerting. Configure log shippers (Filebeat, Promtail, Fluentd) to collect from applications, containers, and system logs with proper security and scalability.
Prerequisites
- Target infrastructure identified: Kubernetes, Docker Compose, or VMs
- Storage requirements calculated: estimate daily log volume and multiply by retention period
- Network connectivity between log sources and aggregation platform (typically ports 9200, 3100, 8088)
- Authentication mechanism defined (LDAP, OAuth, API tokens, or basic auth)
- Resource allocation planned: Elasticsearch needs significant heap memory (minimum 4GB per node)
Instructions
- Select the log aggregation platform: ELK for full-text search and complex queries, Loki for lightweight Kubernetes-native logging, Splunk for enterprise with advanced analytics
- Deploy the storage backend: Elasticsearch cluster, Loki with object storage (S3/GCS), or Splunk indexers
- Configure log shippers on sources: Filebeat for ELK, Promtail for Loki, Fluentd/Fluent Bit for multi-destination
- Define parsing rules: Logstash grok patterns for unstructured logs, JSON parsing for structured logs, multiline handling for stack traces
- Set retention policies: Index Lifecycle Management (ILM) for Elasticsearch, chunk retention for Loki, index rotation for Splunk
- Deploy visualization: Kibana dashboards for ELK, Grafana dashboards for Loki, Splunk Search for Splunk
- Configure alerting: define log-based alerts for error spikes, application exceptions, and security events
- Implement RBAC: restrict dashboard access and log visibility by team and environment
- Test the full pipeline: generate test logs, verify ingestion, confirm parsing, and validate dashboard display
Output
- Docker Compose or Kubernetes manifests for the log aggregation stack
- Log shipper configuration files (Filebeat YAML, Promtail config, Fluentd conf)
- Parsing and field extraction rules (Logstash pipeline, grok patterns)
- Retention policy configuration (ILM, lifecycle rules)
- Dashboard JSON exports for Kibana or Grafana
- Alert rule definitions for error rate monitoring
Error Handling
| Error |
Cause |
Solution |
Elasticsearch heap space exhausted |
JVM heap too small for index volume |
Increase ES_JAVA_OPTS heap size (set to 50% of available RAM, max 32GB) or add nodes |
Cannot connect to Elasticsearch |
Network issue or Elasticsearch not started |
Verify Elasticsearch is running and healthy; check firewall rules and bind address |
Failed to create index |
Disk space full or index template misconfigured |
Check disk usage with df -h; review index template settings and shard allocation |
Failed to parse log line |
Grok pattern mismatch or unexpected log format |
Test grok patterns with Kibana Grok Debugger; add fallback pattern for unmatched lines |
Promtail: too many open files |
System file descriptor limit too low for log tailing |
Increase ulimit -n to 65536; reduce the number of watched paths |
Examples
- "Deploy an ELK stack on Docker Compose with Filebeat collecting Nginx and application logs, Logstash parsing with grok, and a Kibana dashboard for 5xx error monitoring."
- "Set up Loki + Promtail on Kubernetes with 14-day retention, basic auth, and a Grafana dashboard showing logs per namespace."
- "Configure Fluentd to ship logs from 20 application servers to both Elasticsearch (hot storage, 7 days) and S3 (cold storage, 1 year)."
Resources
Source: jeremylongshore/claude-code-plugins-plus-skills → skills/.curated/setting-up-log-aggregation/SKILL.md
Also appears in: jeremylongshore/claude-code-plugins-plus-skills/plugins/devops/log-aggregation-setup/skills/setting-up-log-aggregation/SKILL.md
1---2name: setting-up-log-aggregation3description: 'Execute use when setting up log aggregation solutions using ELK, Loki, or Splunk. Trigger with phrases like "setup log aggregation", "deploy ELK stack", "configure Loki", or "install Splunk". Generates production-ready configurations for data ingestion, processing, storage, and visualization with proper security and scalability. '4---5
6# Setting Up Log Aggregation
7
8## Overview
9
10Deploy centralized log aggregation platforms (ELK Stack, Grafana Loki, Splunk) with ingestion pipelines, structured parsing, retention policies, visualization dashboards, and alerting. Configure log shippers (Filebeat, Promtail, Fluentd) to collect from applications, containers, and system logs with proper security and scalability.
11
12## Prerequisites
13
14- Target infrastructure identified: Kubernetes, Docker Compose, or VMs
15- Storage requirements calculated: estimate daily log volume and multiply by retention period
16- Network connectivity between log sources and aggregation platform (typically ports 9200, 3100, 8088)
17- Authentication mechanism defined (LDAP, OAuth, API tokens, or basic auth)
18- Resource allocation planned: Elasticsearch needs significant heap memory (minimum 4GB per node)
19
20## Instructions
21
221. Select the log aggregation platform: ELK for full-text search and complex queries, Loki for lightweight Kubernetes-native logging, Splunk for enterprise with advanced analytics
232. Deploy the storage backend: Elasticsearch cluster, Loki with object storage (S3/GCS), or Splunk indexers
243. Configure log shippers on sources: Filebeat for ELK, Promtail for Loki, Fluentd/Fluent Bit for multi-destination
254. Define parsing rules: Logstash grok patterns for unstructured logs, JSON parsing for structured logs, multiline handling for stack traces
265. Set retention policies: Index Lifecycle Management (ILM) for Elasticsearch, chunk retention for Loki, index rotation for Splunk
276. Deploy visualization: Kibana dashboards for ELK, Grafana dashboards for Loki, Splunk Search for Splunk
287. Configure alerting: define log-based alerts for error spikes, application exceptions, and security events
298. Implement RBAC: restrict dashboard access and log visibility by team and environment
309. Test the full pipeline: generate test logs, verify ingestion, confirm parsing, and validate dashboard display
31
32## Output
33
34- Docker Compose or Kubernetes manifests for the log aggregation stack
35- Log shipper configuration files (Filebeat YAML, Promtail config, Fluentd conf)
36- Parsing and field extraction rules (Logstash pipeline, grok patterns)
37- Retention policy configuration (ILM, lifecycle rules)
38- Dashboard JSON exports for Kibana or Grafana
39- Alert rule definitions for error rate monitoring
40
41## Error Handling
42
43| Error | Cause | Solution |
44|-------|-------|---------|
45| `Elasticsearch heap space exhausted` | JVM heap too small for index volume | Increase `ES_JAVA_OPTS` heap size (set to 50% of available RAM, max 32GB) or add nodes |
46| `Cannot connect to Elasticsearch` | Network issue or Elasticsearch not started | Verify Elasticsearch is running and healthy; check firewall rules and bind address |
47| `Failed to create index` | Disk space full or index template misconfigured | Check disk usage with `df -h`; review index template settings and shard allocation |
48| `Failed to parse log line` | Grok pattern mismatch or unexpected log format | Test grok patterns with Kibana Grok Debugger; add fallback pattern for unmatched lines |
49| `Promtail: too many open files` | System file descriptor limit too low for log tailing | Increase `ulimit -n` to 65536; reduce the number of watched paths |
50
51## Examples
52
53- "Deploy an ELK stack on Docker Compose with Filebeat collecting Nginx and application logs, Logstash parsing with grok, and a Kibana dashboard for 5xx error monitoring."
54- "Set up Loki + Promtail on Kubernetes with 14-day retention, basic auth, and a Grafana dashboard showing logs per namespace."
55- "Configure Fluentd to ship logs from 20 application servers to both Elasticsearch (hot storage, 7 days) and S3 (cold storage, 1 year)."
56
57## Resources
58
59- Elastic Stack guide: https://www.elastic.co/guide/
60- Grafana Loki: https://grafana.com/docs/loki/latest/
61- Fluentd documentation: https://docs.fluentd.org/
62- Promtail configuration: https://grafana.com/docs/loki/latest/send-data/promtail/
63
64---
65
66**Source:** [`jeremylongshore/claude-code-plugins-plus-skills`](https://github.com/jeremylongshore/claude-code-plugins-plus-skills) → `skills/.curated/setting-up-log-aggregation/SKILL.md`
67
68**Also appears in:** `jeremylongshore/claude-code-plugins-plus-skills/plugins/devops/log-aggregation-setup/skills/setting-up-log-aggregation/SKILL.md`
thedixitjain