Introduction

Quickly ingest Papertrail tab-separated archive files into a ELK stack for fast analysis.

Requirements

• Docker
• Direnv (or some other way to load settings from .env.local)
• Ruby
• Curiosity

Getting Started

Find your Papertrail API token and set it in .env.local

# .env.local
PAPERTRAIL_API_TOKEN=<token>

Ruby setup

gem install bundler
bundle

Get the ELK stack running

docker-compose up -d

Kick it off

bundle exec rake

Browse your results via Kibana.

ELK

Read more at https://elk-docker.readthedocs.io/.

After importing a small amount of data using bundle exec rake index, you can import a pre-configured dashboard to use.

1. Go to Kibana
2. Click Management -> Saved Objects -> Import
3. Drag kibana/export.json into your browser
4. Enjoy!