# Installing the Talend logging modules

You need to manually install Talend Log Server which includes Kibana and Filebeat to collect logs.

## Before you begin

The Elasticsearch container requires that the vm.max\_map\_count parameter to be set to at least 262144. Check this value on your machine and increase it if needed.

To check this value, run the following command:

```
sysctl vm.max_map_count
```

If you need to increase the value, run the following command:

```
sysctl -w vm.max_map_count=262144
```

To permanently write the value to the sysctl.conf file, run the following command:

```
vm.max_map_count = 262144
```

## Procedure

1. Copy and extract the Talend-LogServer-VA.B.C.zip archive file in the directory of your choice.

   Information noteNote: The directory name must not contain spaces or non-ASCII characters.
2. To start Talend Log Server launch the start\_logserver.sh executable file.

   You cannot run Elasticsearch as the root user. Elasticsearch is part of the Talend Log Server, therefore you cannot run the executable file as root user.
3. Configure the values for LOG\_PATH and APP\_NAME for Filebeat:
   * Open the filebeat.yml file located in the Filebeat directory and set the LOG\_PATH and APP\_NAME values as follows:
     ```
       paths:
         - ${LOG_PATH:/home/Talend/7.2.1/tac/apache-tomcat/logs/*}
       fields:
         app_id: ${APP_NAME:TAC}
     ```
   * Or, set the LOG\_PATH and APP\_NAME environment variables:
     ```
     export  LOG_PATH="/home/Talend/7.2.1/tac/apache-tomcat/logs/*"
     export  APP_NAME="TAC"
     ```
4. Start Filebeat:
   ```
   filebeat -e -c filebeat.yml
   ```

## Results

You can now access Talend Log Server with the following URL: http://localhost:5601/app/kibana#/dashboard/Default-Dashboard.

The ESB event logs that are displayed in the Logging page of Talend Administration Center are collected thanks to the Event Logging features that can be started from the Runtime container. For more information, see the Talend ESB Container Administration Guide.

Troubleshooting: When you start the Talend Log Server, if you do not see logstash-\*, talendesb-\*, and talendaudit-\* indices, complete the following steps:

1. Delete the .kibana index.
   ```
   curl -XDELETE 'http://localhost:9200/.kibana'
   ```
2. Stop the Talend Log Server.
3. Start the Talend Log Server.