ELK for Asterisk CDR

Assumption:

You have 2 VM, 1 for ELK server and the other for Asterisk server
Asterisk is setup so that CDR saved in MySQL db asteriskcdrdb
From ELK VM you can query MySQL on Asterisk server
Asterisk server IP is 192.168.100.2
asteriskcdrdb access from ELK server: user: elkdbuser pass: c03br9hncmdD2$Asd
We're doing this howto step by step on ELK server VM

Let's do it

1. Follow step 1 and 2 from this article to install Elasticsearch and Kibana

Article:

https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elastic-stack-on-ubuntu-20-04

Skip the rest of the article and continue following below steps instead.

2. Install logstash

Install:

sudo apt install logstash

3. Install mysql-connector-java

Download and install:

wget -c https://dev.mysql.com/get/Downloads/Connector-J/mysql-connector-java_8.0.26-1ubuntu20.04_all.deb
sudo dpkg -i mysql-connector-java_8.0.26-1ubuntu20.04_all.deb

mysql-connector-java will be installed in /usr/share/java/:

ls - /usr/share/java/*.jar

4. Connect to MySQL server on Asterisk server

mysql -u elkdbuser -p -h 192.168.100.2 asteriskcdrdb

Run this SQL:

ALTER TABLE `cdr` 
  CHANGE `calldate` `calldate` DATETIME NULL DEFAULT NULL, 
  CHANGE `start` `start` DATETIME NULL DEFAULT NULL, 
  CHANGE `answer` `answer` DATETIME NULL DEFAULT NULL,
  CHANGE `end` `end` DATETIME NULL DEFAULT NULL;

5. Create file `/etc/logstash/conf.d/01-asteriskcdrdb.conf`

Edit the 01-asteriskcdrdb.conf:

nano /etc/logstash/conf.d/01-asteriskcdrdb.conf

Fill with this:

input {
  jdbc {
    jdbc_connection_string => "jdbc:mysql://192.168.100.2:3306/asteriskcdrdb"
    jdbc_user => "elkdbuser"
    jdbc_password => "c03br9hncmdD2$Asd"
    jdbc_driver_library => "/usr/share/java/mysql-connector-java-8.0.26.jar"
    jdbc_driver_class => "com.mysql.jdbc.Driver"
    schedule => "* * * * *"
    statement => "
      SELECT id,calldate,clid,src,dst,dcontext,channel,dstchannel,lastapp,lastdata,
             duration,billsec,disposition,accountcode,uniqueid,linkedid,peeraccount
      FROM cdr WHERE id > :sql_last_value ORDER BY id"
    use_column_value => true
    tracking_column => id
    tracking_column_type => numeric
  }
}
output {
  stdout {
    codec => json_lines
  }
  elasticsearch {
    "hosts" => "localhost:9200"
    "index" => "cdr"
    "document_id" => "%{id}"
  }
}

6. Start logstash

Run:

sudo service logstash start

Enable it to start on book:

sudo systemctl enable logstash

7. Watch logstash log file