ELK logstash-7.5收集交换机日志

古城微笑少年丶 2022-09-12 08:56 401阅读 0赞

问题：有人反馈说7.x版本收集不了交换机日志，在此记录一次logstash-7.5收集华为交换机的日志记录。

前提：ELK环境已经安装完成，具体操作查看另外篇文章

一、交换机配置

添加：info-center loghost 192.168.14.210，IP地址是logstash服务器，华为交换机默认是UDP514端口发送数据

  1. 1、查看交换机版本
  2. [SW30]display  version 
  3. Huawei Versatile Routing Platform Software
  4. VRP (R) software, Version 5.70 (S2700 V100R006C05)
  5. Copyright (C) 2003-2013 HUAWEI TECH CO., LTD
  6. Quidway S2700-9TP-SI-AC Routing Switch uptime is 23 weeks, 5 days, 7 hours, 28 minutes
  8. E8FED 0(Master) : uptime is 23 weeks, 5 days, 7 hours, 27 minutes
  9. 64M bytes DDR Memory
  10. 16M bytes FLASH
  11. Pcb      Version :  VER E
  12. Basic  BOOTROM  Version :  149 Compiled at Mar 15 2013, 11:02:25
  13. Software Version : VRP (R) Software, Version 5.70 (V100R006C05)
  15. 2、配置内容
  16. [SW30]display  current-configuration  | in info
  17.  info-center loghost 192.168.14.210
  18.  snmp-agent sys-info version all

二、logstash7.5安装

1、安装JDK

  1. [root@localhost ~]# tar -zxvf jdk-11.0.5_linux-x64_bin.tar.gz -C /usr/local/
  2. [root@localhost ~]# vim /etc/profile
  3. export JAVA_HOME=/usr/local/jdk-11.0.5/
  4. export PATH=$PATH:$JAVA_HOME/bin
  5. export CLASSPATH=.:$JAVA_HOME/lib/tools.jar:$JAVA_HOME/lib/dt.jar:$CLASSPATH
  7. [root@localhost ~]# source  /etc/profile

2、解压logstash二进制包

  1. [root@localhost ~]#tar -zxvf logstash-7.5.0.tar.gz  -C /usr/local/

3、添加环境变量

  1. [root@localhost ~]# vi /etc/profile
  2. export PATH=$PATH:/usr/local/logstash-7.5.0/bin
  3. [root@localhost ~]# source /etc/profile

三、logstash7.5配置

1、关闭rsyslog服务，因为这个会占用514端口

  1. [root@localhost ~]# systemctl stop rsyslog

watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Y-L5Lq6YeeslOiusA_size_20_color_FFFFFF_t_70_g_se_x_16

2、添加logstash配置文件，根据监听交换机端口区分不通网络设备型号(直接复制可用，修改下IP地址)

  1. [root@localhost ~]# vi  /usr/local/logstash-7.5.0/config/switch.conf 
  2. [root@localhost ~]# cat /usr/local/logstash-7.5.0/config/switch.conf 
  3. input{
  4.     tcp { port => 5002 
  5.     type => "Cisco"}
  6.     udp { port => 514
  7.     type => "HUAWEI"}
  8.     udp { port => 5002
  9.     type => "Cisco"}
  10.     udp { port => 5003
  11.     type => "H3C"}
  12. }
  13. filter {
  14.     if [type] == "Cisco" {
  15.     grok {
  16.     match => { "message" => "<%{BASE10NUM:syslog_pri}>%{NUMBER:log_sequence}: .%{SYSLOGTIMESTAMP:timestamp}: %%{DATA:facility}-%{POSINT:severity}-%{CISCO_REASON:mnemonic}: %{GREEDYDATA:message}" }
  17.     match => { "message" => "<%{BASE10NUM:syslog_pri}>%{NUMBER:log_sequence}: %{SYSLOGTIMESTAMP:timestamp}: %%{DATA:facility}-%{POSINT:severity}-%{CISCO_REASON:mnemonic}: %{GREEDYDATA:message}" }
  18.     add_field => {"severity_code" => "%{severity}"}
  19.     overwrite => ["message"]
  20.     }
  21. }
  22.     elseif [type] == "H3C" {
  23.     grok {
  24.     match => { "message" => "<%{BASE10NUM:syslog_pri}>%{SYSLOGTIMESTAMP:timestamp} %{YEAR:year} %{DATA:hostname} %%%{DATA:vvmodule}/%{POSINT:severity}/%{DATA:digest}: %{GREEDYDATA:message}" }
  25.     remove_field => [ "year" ]
  26.     add_field => {"severity_code" => "%{severity}"}
  27.     overwrite => ["message"]
  28.     }
  29. }
  30.     elseif [type] == "HUAWEI" {
  31.     grok {
  32.        match => { "message" => "<%{BASE10NUM:syslog_pri}>%{SYSLOGTIMESTAMP:timestamp} %{DATA:hostname} %%%{DATA:ddModuleName}/%{POSINT:severity}/%{DATA:Brief}:%{GREEDYDATA:message}"}
  33.        match => { "message" => "<%{BASE10NUM:syslog_pri}>%{SYSLOGTIMESTAMP:timestamp} %{DATA:hostname} %{DATA:ddModuleName}/%{POSINT:severity}/%{DATA:Brief}:%{GREEDYDATA:message}"}
  34.        remove_field => [ "timestamp" ]
  35.     add_field => {"severity_code" => "%{severity}"}
  36.     overwrite => ["message"]
  37.     }
  38. }
  39. #mutate {
  40. #        gsub => [
  41. #        "severity", "0", "Emergency",
  42. #        "severity", "1", "Alert",
  43. #        "severity", "2", "Critical",
  44. #        "severity", "3", "Error",
  45. #        "severity", "4", "Warning",
  46. #        "severity", "5", "Notice",
  47. #        "severity", "6", "Informational",
  48. #        "severity", "7", "Debug"    
  49. #        ]
  50. #    }
  51. }
  52. output{
  53.     stdout {
  54.        codec => rubydebug
  55. }
  56.     elasticsearch {
  57.         index =>
  58.         "syslog-%{+YYYY.MM.dd}"
  59.         hosts => ["192.168.14.211:9200"]
  60.         user => "elastic"
  61.         password => "password"
  62.     }
  63. }

这里为了方便查看，直接输出到终端显示了，工作环境可以删除stdout的配置。并且添加了用户名和密码认证

3、启动，在终端可以查看到数据

  1. [root@localhost ~]# logstash -f /usr/local/logstash-7.5.0/config/switch.conf

watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Y-L5Lq6YeeslOiusA_size_20_color_FFFFFF_t_70_g_se_x_16 1

四、kibana查看交换机日志

1、打开Management

watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Y-L5Lq6YeeslOiusA_size_20_color_FFFFFF_t_70_g_se_x_16 2

2、添加索引

watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Y-L5Lq6YeeslOiusA_size_20_color_FFFFFF_t_70_g_se_x_16 3

3、搜索在配置文件里面自定义的索引名称

watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Y-L5Lq6YeeslOiusA_size_20_color_FFFFFF_t_70_g_se_x_16 4

4、点击创建

watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Y-L5Lq6YeeslOiusA_size_20_color_FFFFFF_t_70_g_se_x_16 5

5、回到首页查看日志

watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Y-L5Lq6YeeslOiusA_size_20_color_FFFFFF_t_70_g_se_x_16 6

五、错误记录

1、因为elk7的elasticsearch增加了认证功能，如果logstash配置文件没有添加用户名和密码就有如下连接错误提示

watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Y-L5Lq6YeeslOiusA_size_20_color_FFFFFF_t_70_g_se_x_16 7

发表评论

表情：
评论列表 （有 0 条评论，401人围观）

还没有评论，来说两句吧...

相关阅读