前言
大家好,我是无名小歌。
明天给大家分享一个 centos7 零碎搭建 2022 年最新 ELK 日志剖析零碎,目前版本是 8.2.2。值得注意的是装置 ELK 时,您必须在整个 ELK 中应用雷同的版本,如:Elasticsearch 8.2.2,则装置 Kibana 8.2.2 和 Logstash 8.2.2,如果呈现不对应的状况,如:Elasticsearch 是 8.2.2 版本、Kibana-6.8 等或是其余版本,则须要进行对应版本的降级到 8.2.2 版本。
就说这么多,上面正式开始吧!!!
ELK 日志剖析零碎(介绍)
- Elasticsearch:ELK 中最外围的是 E(elasticsearch),咱们能够从单词上了解翻译过去就是“弹性搜寻”。提供搜寻、剖析、存储数据三大性能,特点稳固,牢靠,疾速(弹性)。
- Logstash:一个具备实时流水线性能的开源数据收集引擎。Logstash 能够动静地对立来自不同起源的数据,并将数据规范化到您抉择的目的地。为各种高级上游剖析和可视化用例清理和遍及所有数据。简略了解的话就是用来收集日志 log 的。
- Kibana:ELK 日志剖析零碎十分敌对的 Web 界面,能够帮忙咱们搜寻、察看、爱护数据、剖析数据、治理、监控和爱护 Elastic Stack(Elasticsearch、Kibana、Beats 和 Logstash 等组合在一起的统称)
日志是非结构化的数据(数据量大,不易查问),这也是应用 ELK 的次要起因之一。
环境筹备
本次教程采纳单节点形式
零碎 | 内存 | IP | 网卡模式 |
---|---|---|---|
Linux | 12G | 192.168.200.4 | NAT |
举荐内存 12G,以下 ELK 零碎占用内存为 靠近 8G,所以只有大于 8G 应该问题不大,但为了保障体验举荐 10G、12G。
部署 ELK
Elasticsearch
- 调整过程最大关上文件数数量
cat >> /etc/security/limits.conf << EOF
hard nofile 65535
soft nofile 65535
EOF
- 调整过程最大虚拟内存区域数量
cat >> /etc/sysctl.conf << EOF
vm.max_map_count=262144
EOF
sysctl -p
-
装置公共签名密钥
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
-
配置 elasticsearch yum 源
cat >> /etc/yum.repos.d/ELK.repo << EOF [elasticsearch] name=Elasticsearch repository for 8.x packages baseurl=https://artifacts.elastic.co/packages/8.x/yum gpgcheck=1 gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch enabled=0 autorefresh=1 type=rpm-md EOF
-
应用 yum install 命令装置,装置过程须要期待一段时间,因为下载的包有足足的 502M(挺大的)
留神看装置实现后会呈现 Security autoconfiguration information 字段(平安主动配置信息)
装置 Elasticsearch 时,默认启用并配置平安性能,会主动进行以下平安配置:- 启用身份验证和受权,并为 elastic 内置超级用户生成明码。
- 为传输层和 HTTP 层生成 TLS 的证书和密钥,并应用这些密钥和证书启用和配置 TLS。
过程中如果呈现下载中断,继续执行下列命令即可直至实现。
$ yum install --enablerepo=elasticsearch elasticsearch -y
...
...
--------------------------- Security autoconfiguration information ------------------------------
Authentication and authorization are enabled.
TLS for the transport and HTTP layers is enabled and configured.
#弹性内置超级用户生成的明码为:se_pNHcZwLawBfF7pxUs
The generated password for the elastic built-in superuser is : se_pNHcZwLawBfF7pxUs
#如果此节点应退出现有群集,则能够应用下列命令
If this node should join an existing cluster, you can reconfigure this with
'/usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token <token-here>'
after creating an enrollment token on your existing cluster.
You can complete the following actions at any time:
#重置弹性内置超级用户的明码
Reset the password of the elastic built-in superuser with
'/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic'.
#应用为 Kibana 实例生成注册令牌
Generate an enrollment token for Kibana instances with
'/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana'.
#应用为 Elasticsearch 节点生成注册令牌
Generate an enrollment token for Elasticsearch nodes with
'/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node'.
-------------------------------------------------------------------------------------------------
### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using systemd
#自启动命令
sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
### You can start elasticsearch service by executing
#启动命令
sudo systemctl start elasticsearch.service
-
启动 Elasticsearch
应用上述生成的启动命令,启动也须要期待一段时间,这里内存占用大概 6G。
sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
sudo systemctl start elasticsearch.service
-
测试 Elasticsearch
这里你会发现咱们浏览器应用 http 协定是不能拜访的,并不是咱们服务有问题。
本地宿主机拜访 Elasticsearch,服务端口 9200:
$ curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200
Enter host password for user 'elastic':
{
"name" : "node1",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "xuxHYu-0SN-PFcghs8V0ow",
"version" : {
"number" : "8.2.2",
"build_flavor" : "default",
"build_type" : "rpm",
"build_hash" : "9876968ef3c745186b94fdabd4483e01499224ef",
"build_date" : "2022-05-25T15:47:06.259735307Z",
"build_snapshot" : false,
"lucene_version" : "9.1.0",
"minimum_wire_compatibility_version" : "7.17.0",
"minimum_index_compatibility_version" : "7.0.0"
},
"tagline" : "You Know, for Search"
}
浏览器拜访 Elasticsearch,服务端口 9200,如:https://192.168.200.4:9200
浏览器拜访请留神,Elasticsearch-8.2.2 版本,如果应用 http 协定是无法访问的必须应用 https 协定。
用户名:elastic
明码:se_pNHcZwLawBfF7pxUs
留神:这里浏览器会呈现提醒不平安的状况(不要慌)顺次点击:高级 –> 接管危险,就会跳转到登录界面了。
明码对应弹性内置超级用户生成的明码。
呈现和本地拜访的内容是统一的,这样咱们的 Elasticsearch 装置实现。
Kibana
-
配置 Kibana yum 源
cat >> /etc/yum.repos.d/ELK.repo << EOF [kibana-8.x] name=Kibana repository for 8.x packages baseurl=https://artifacts.elastic.co/packages/8.x/yum gpgcheck=1 gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch enabled=1 autorefresh=1 type=rpm-md EOF
-
应用 yum install 命令装置,装置过程也须要期待一段时间(248M)
过程中如果呈现下载中断,继续执行下列命令即可直至实现。
yum install kibana -y
-
批改配置文件 /etc/kibana/kibana.yml
解除正文:server.port、server.host
server.host:填写本人主机 ip
-
启动 Kibana
sudo /bin/systemctl daemon-reload sudo /bin/systemctl enable kibana.service sudo systemctl start kibana.service
-
测试 Kibana
启动期待一分钟后,浏览器拜访 Kibana,服务端口 5601,如:http://192.168.200.4:5601/
拜访 Kibana 时,应用 http 协定是能够拜访的,https 协定不能拜访。
如下图:kibana-8.2.2 版本须要令牌登录,上面应用命令生成令牌。
<font color=red>留神:</font> 如果拜访时呈现下列问题,点击解决办法。
-
应用
elasticsearch-create-enrollment-token
命令为 Kibana 生成一个注册令牌:输出注册令牌,将 Kibana 与 Elasticsearch 连接起来。
下列命令是装置 elasticsearch 时平安主动配置信息中所生成。/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
- 应用
kibana-verification-code
命令生成验证码
输出验证码之后,kibana 会进行:保留设置 –> 启动 elastic–> 实现设置操作。
$ /usr/share/kibana/bin/kibana-verification-code
Your verification code is: 409 686
-
输出用户明码登录
用户明码应用装置 elasticsearch 时生成的用户明码。
用户名:elastic
明码:se_pNHcZwLawBfF7pxUs
Logstash
-
配置 Logstash yum 源
cat >> /etc/yum.repos.d/ELK.repo << EOF [logstash-8.x] name=Elastic repository for 8.x packages baseurl=https://artifacts.elastic.co/packages/8.x/yum gpgcheck=1 gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch enabled=1 autorefresh=1 type=rpm-md EOF
-
应用 yum install 命令装置,装置过程也须要期待一段时间(322 M)
过程中如果呈现下载中断,继续执行下列命令即可直至实现。
yum install logstash -y
- 测试 Logstash
咱们通过运行最根本的 Logstash Pipeline 来测试。
Logstash 管道具备两个必需元素 input 和 output 和一个可选元素 filter。
运行步骤:输出插件应用来自源的数据,过滤器插件依据您的指定批改数据,输入插件将数据写入指标。
运行 Logstash Pipeline
输入内容第 8 行呈现
Successfully started Logstash API endpoint
,阐明胜利启动 Logstashstdin 插件呈现期待输出提醒(The stdin plugin is now waiting for input:),输出 hello world 测试。
Ctrl+D 退出 Logstash Pipeline
[root@node1 ~]# /usr/share/logstash/bin/logstash -e 'input {stdin {} } output {stdout {} }'
Using bundled JDK: /usr/share/logstash/jdk
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[INFO] 2022-05-30 10:19:11.092 [main] runner - Starting Logstash {"logstash.version"=>"8.2.2", "jruby.version"=>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.14.1+1 on 11.0.14.1+1 +indy +jit [linux-x86_64]"}
[INFO] 2022-05-30 10:19:11.110 [main] runner - JVM bootstrap flags: [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -Djruby.jit.threshold=0, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED]
[WARN] 2022-05-30 10:19:12.090 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO] 2022-05-30 10:19:15.968 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[INFO] 2022-05-30 10:19:17.783 [Converge PipelineAction::Create<main>] Reflections - Reflections took 272 ms to scan 1 urls, producing 120 keys and 395 values
[INFO] 2022-05-30 10:19:19.375 [Converge PipelineAction::Create<main>] javapipeline - Pipeline `main` is configured with `pipeline.ecs_compatibility: v8` setting. All plugins in this pipeline will default to `ecs_compatibility => v8` unless explicitly configured otherwise.
[INFO] 2022-05-30 10:19:19.723 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["config string"], :thread=>"#<Thread:0x7c068ea7 run>"}
[INFO] 2022-05-30 10:19:21.346 [[main]-pipeline-manager] javapipeline - Pipeline Java execution initialization time {"seconds"=>1.61}
[INFO] 2022-05-30 10:19:21.520 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}
# stdin 插件呈现期待输出提醒,请输出 hello world
The stdin plugin is now waiting for input:
hello world
{
"@version" => "1",
"event" => {"original" => "hello world"},
"message" => "hello world",
"@timestamp" => 2022-05-30T02:27:01.888886Z,
"host" => {"hostname" => "node1"}
}
ELK-8.2.2 版本日志剖析零碎自此搭建实现!!!
参考资料
https://www.elastic.co/guide/…