Skip to main content

Using Cerebro as WebUI to manage an ELK cluster

Get better visibility into your systems with this helpful tool.
Using Cerebro to manage an Elk Cluster

Elasticsearch comes as a set of blocks, and you—as a designer—are supposed to glue them together. Yet, the way the software comes out of the box does not cover everything. So, to me, it was not easy to see the cluster’s heartbeat all in one place. I needed something to give me an overview as well as allow me to take action on basic things.

I wanted to introduce you to a helpful piece of software I found: Cerebro.

According to the Cerebro GitHub page:

Cerebro is an open source (MIT License) elasticsearch web admin tool built using Scala, Play Framework, AngularJS, and Bootstrap.

After you clone the Git repository and run /bin/cerebro with the right user permissions, you can log into http://localhost:9000. I’ll save some "paper" by not following the initial configuration and auth setup, but I presume people will work it out easily.

Once everything's set up, you come to the login screen:

The Cerebro login screen.

And here is the main screen after successfully logging in:

The Cerebro main screen.

Here, we see a table view with indexing nodes (left vertical), daily indexes (top horizontal), and shard indices (chunks of data numbered one, two, three, etc.)

From this point, we can monitor and manipulate (close, delete) indexes, nodes, and overall see the whole cluster’s status. For example, if we run an API call to resync corrupted shards to another node, we can watch the progress on this screen. This is important visibility into what’s going on because with big data something is always more or less broken.

Here, we lost one indexing node. We might need to check if the link is up and the Elasticsearch process has not crashed on that particular node. If we bring the node back online, this dashboard shows you the replication progress in real-time:

Cerebro showing the replication process.

Or, here we have an issue with individual shard indices. They are probably corrupted and need a fix and then manual replication:

Corrupted shards in Cerebro.


There are also cluster configuration menus, and one of the options I found interesting and useful was "snapshots." Sometimes, we need to archive and rotate data to recover free space. Call the snapshot backups, for example, if you have to keep a few years’ data for an external audit.

There are scripts that normally do this for you in the background, so this GUI allows you to browse the indices easily, and open or activate a particular index or day on-demand in one click:

Existing snapshots in Cerebro.

To summarize, I would say this tool saves my nerves and my time when investigating trivial situations. I take a quick look at Cerebro and I know what happened with my cluster. Overall, I found this software stable, useful, and a good addition to my ELK admin toolbox.

Want to learn more advanced techniques for monitoring in Linux? Check out The open source guide to DevOps monitoring tools.

Topics:   Monitoring  
Author’s photo

Danil Mashonkin

Danil Mashonkin was born in Sverdlovsk (Yekaterinburg) former USSR in 1973 and received a degree from the Ural's University of Communications in 1992. He began as a and 1996 and quicly transitioned into  IT as a full stack C programmer in 1999. More about me

Try Red Hat Enterprise Linux

Download it at no charge from the Red Hat Developer program.