ELK（日志审计系统）

Bertha 。 2023-08-17 16:29 122阅读 0赞

## ELk简介及工作流程 ##

ELK即（Elasticsearch + Logstash + Kibana）

![1352940-20190610184523565-294847579.jpg][]

## 下载安装包 ##

*  系统环境：Contos7.0
 *  Java环境：[Portal][]（这是历史下载地址，我的是 `jdk-8u151-linux-x64.tar.gz`）
 *  Logstash/Elasticsearch/Kibana/Filebeat：[Portal][Portal 1]（我都是选的7.0版本）
 *  redis：[Portal][Portal 2]

![1352940-20190531113029702-1910000479.png][]

下载完成后传到服务器，全部解压至“/etc/elk”目录下，注意：这里使用的是单机部署（内存应不低于2G）

## Java环境配置 ##

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

tar -zvxf jdk-8u151-linux-x64.tar.gz -C /data/app/
    ln -s /data/app/jdk1.8.0_151 /data/app/jdk
    cat <<EOF >> /etc/profile   # 追加文件
    """
    export JAVA_HOME=/data/app/jdk
    PATH=$JAVA_HOME/bin:$JAVA_HOME/jre/bin:$PATH
    CLASSPATH=.$CLASSPATH:$JAVA_HOME/lib:$JAVA_HOME/jre/lib:$JAVA_HOME/lib/tools.jar
    EOF
    """
    source /etc/profile
    ln -s /data/app/jdk/bin/java /usr/bin/java 
    java -version        # 查看是否安装成功

命令

## elasticsearch部署 ##

### elasticsearch安装 ###

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

rpm -ivh elasticsearch-7.0.0-x86_64.rpm 
    # 编辑配置文件
    vim /etc/elasticsearch/elasticsearch.yml
    """
    path.logs: /var/log/elasticsearch
    cluster.name: elk01
    node.name: node-1
    path.data: /var/lib/elasticsearch
    path.logs: /var/log/elasticsearch
    network.host: 0.0.0.0
    http.port: 9200
    discovery.seed_hosts: ["10.60.53.143",]
    cluster.initial_master_nodes: ["10.60.53.143",]
    """
    # 具体作用可以看配置文件中的英文解释
    systemctl restart elasticsearch  # 启动服务

npm安装步骤

![1352940-20190608172004073-1805757231.png][]

## logstash部署 ##

rpm -ivh logstash-7.0.0.rpm

更新中..................

## kibana部署 ##

rpm -ivh kibana-7.0.0-x86_64.rpm
    # 编辑配置文件
    vim /etc/kibana/kibana.yml
    """
    server.port: 5601
    server.host: "0.0.0.0"
    elasticsearch.hosts: ["http://10.60.53.143:9200"]
    """
    # 启动
    systemctl  start kibana
    systemctl  enable  kibana

## filebeat部署 ##

### 安装 ###

rpm -ivh filebeat-7.0.0-x86_64.rpm

### 修改filebeat配置文件“filebeat.yml” and Redis配置文件"6379.conf" ###

*  filebeat没有运行日志，直接查看系统messages运行日志即可。
 *  配置好filebeat后一定要重启。
 *  重启后查看redis中是否有值，有值则正常。

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

# 注销bind字段，将protected-mode设置为no
    # bind 127.0.0.1
    protected-mode no

/etc/redis/6379.conf

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

filebeat.inputs:
    - type: log
      paths:
        - /root/channelHandle-out-2.log
      fields:
        log_file: xsj_channelhandle_out_2
        log_type: a-out-log
      fields_under_root: true
      encoding: utf-8
    processors:
      - drop_event:
          when.not.contains:
            message: "收到"
    output.redis:
      hosts: ["10.60.53.143:6379"]
      db: 0
      # password: "1234@abcd.com"
      key: "%{[log_file]:xsj}"
      timeout: 5

etc/filebeat/filebaet.yml

### 相关命令 ###

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

systemctl  start     filebeat
    systemctl  enable  filebeat
    systemctl  restart  filebeat

启动关闭重启

转载于:https://www.cnblogs.com/Dream-huang/p/10954811.html

[1352940-20190610184523565-294847579.jpg]: /images/20230810/9bd8a95581d74ee096ea28c5785fd909.png
[Portal]: https://www.oracle.com/technetwork/java/javase/archive-139210.html
[Portal 1]: https://www.elastic.co/cn/downloads/past-releases#elasticsearch
[Portal 2]: https://redis.io/download
[1352940-20190531113029702-1910000479.png]: /images/20230810/73c5ba5fc537477492068de18ca59c83.png
[ContractedBlock.gif]: https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif
[ExpandedBlockStart.gif]: /images/20230810/1220c35730c94f9e8d8822e671e149bd.png
[1352940-20190608172004073-1805757231.png]: /images/20230810/63b651c047f44d4e95bbf7c0afaed871.png