安裝Filebeat+Elasticsearch+Kibana(單節點)

安裝版本說明

https://www.elastic.co/cn/support/matrix#matrix_compatibility

安裝Filebeat+Elasticsearch+Kibana

https://www.elastic.co/guide/en/elastic-stack-get-started/7.16/get-started-elastic-stack.html

elastic生產環境安全配置

https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-security.html

es中json格式說明

https://blog.csdn.net/fjxcsdn/article/details/102753475

其他

https://www.cnblogs.com/cjsblog/archive/2018/08/08/9445792.html
https://blog.csdn.net/UbuntuTouch/article/details/105933699

Elasticsearch

curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.16.2-linux-x86_64.tar.gz
tar -xzvf elasticsearch-7.16.2-linux-x86_64.tar.gz
cd elasticsearch-7.16.2
./bin/elasticsearch

補充:官方從6.8 和 7.1 開始默認提供安全插件
第一步:打開config/elasticsearch.yaml,在尾部添加下面代碼:
#使用用戶名密碼
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
#使用證書配置
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
第二步:自動生成好幾個默認用戶和密碼
#交互式設置密碼
bin/elasticsearch-setup-passwords interactive
#自動設置密碼
bin/elasticsearch-setup-passwords auto
第三步:切換到elastsearch的目錄下,使用下列命令生成證書
bin/elasticsearch-certutil cert -out config/elastic-certificates.p12 -pass ""
第四部:驗證
#使用用戶名密碼驗證
http://username:password@localhost:9200/
#查看索引
curl http://elastic:yOUzNlC5XX1R5xgH1aeC@localhost:6200/_cat/indices?v
#刪除索引,通配符形式
curl -XDELETE http://elastic:yOUzNlC5XX1R5xgH1aeC@localhost:6200/索引*

kibina

cd /web
curl -L -O https://artifacts.elastic.co/downloads/kibana/kibana-7.16.2-linux-x86_64.tar.gz
tar xzvf kibana-7.16.2-linux-x86_64.tar.gz
ln -s kibana-7.16.2-linux-x86_64 kibana
cd kibana
./bin/kibana

filebeat

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.16.2-linux-x86_64.tar.gz
tar xzvf filebeat-7.16.2-linux-x86_64.tar.gz
#查看支持的模塊
./filebeat modules list
#安裝模塊
./filebeat modules enable system nginx

filebeat.yaml

filebeat.inputs:
- type: filestream
  enabled: false
  paths:
    - /var/log/*.log
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
setup.kibana:
  host: "172.17.0.202:5601"
output.elasticsearch:
  hosts: ["172.17.0.202:6200"]
  username: "elastic"
  password: "yOUzNlC5XX1R5xgH1aeC"
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

filebeat/modules.d/nignx.yaml

- module: nginx
  access:
    enabled: true
    var.paths: ["/var/log/nginx/access.log*"]
    tags: ["access"]
  error:
    enabled: true
    var.paths: ["/var/log/nginx/error.log*"]
    tags: ["error"]
  ingress_controller:
    enabled: false

mon_es

Changed password for user apm_system
PASSWORD apm_system = Nps68SS5rGfKauvrqSGM

Changed password for user kibana_system
PASSWORD kibana_system = xFYYS8zpS6c5CxZpi6N1

Changed password for user kibana
PASSWORD kibana = xFYYS8zpS6c5CxZpi6N1

Changed password for user logstash_system
PASSWORD logstash_system = FknL2hSdVX6VampT7Aya

Changed password for user beats_system
PASSWORD beats_system = ZT5uWkfFq3bNrNkVsXKX

Changed password for user remote_monitoring_user
PASSWORD remote_monitoring_user = Utrcnb4Vg6wUs7daO76e

Changed password for user elastic
PASSWORD elastic = 6CvDdDCwc3ZXPmiRgYOe

參考文檔

最后編輯于
?著作權歸作者所有,轉載或內容合作請聯系作者
平臺聲明:文章內容(如有圖片或視頻亦包括在內)由作者上傳并發布,文章內容僅代表作者本人觀點,簡書系信息發布平臺,僅提供信息存儲服務。

推薦閱讀更多精彩內容