setting-up-log-aggregation
Installation
SKILL.md
Setting Up Log Aggregation
Overview
Deploy centralized log aggregation platforms (ELK Stack, Grafana Loki, Splunk) with ingestion pipelines, structured parsing, retention policies, visualization dashboards, and alerting. Configure log shippers (Filebeat, Promtail, Fluentd) to collect from applications, containers, and system logs with proper security and scalability.
Prerequisites
- Target infrastructure identified: Kubernetes, Docker Compose, or VMs
- Storage requirements calculated: estimate daily log volume and multiply by retention period
- Network connectivity between log sources and aggregation platform (typically ports 9200, 3100, 8088)
- Authentication mechanism defined (LDAP, OAuth, API tokens, or basic auth)
- Resource allocation planned: Elasticsearch needs significant heap memory (minimum 4GB per node)