[[日志系统使用文档地址]]

站内搜索[记录日志系统的安装->部署->配置->使用文档(3)]

服务器

es, logstash, kibana

内存: 8G
磁盘: 500G
处理器: 4/8核
带宽: 2m

1
2
3
4
5
6
7
以上配置是原来写的,在之后的线上环境很快就得到了验证, 结果就是直接崩溃

建议每天产生20g到30g的起码弄个以下的配置
内存: 16G
磁盘: 500g-1t(硬盘不值钱)
处理器: 4/8核
带宽: 5m

filebeat(被抓取服务所在机器)

1
略...

端口

1
2
elk服务器对外开放5601
elk服务器对filebeat所在服务器内网开放5044

安装(单点)

安装完filebeat之后,需要给inputs下配置文件基于root权限或者go+w权限
chown root /etc/filebeat/inputs/* 或者 chown go+w /etc/filebeat/inputs/*

filebeat(基于docker)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
version: '3'
services:
  filebeat:
    image: elastic/filebeat:7.13.2
    container_name: filebeat
    environment:
      - TZ=Asia/Shanghai
    volumes:
      - /var/run/docker.sock:/host_docker/docker.sock
      - /var/lib/docker:/host_docker/var/lib/docker
      - /opt/log-server/logs:/usr/share/filebeat/logs
      - /mydata/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml
	  # filebeat注册表,记录上次扫描到哪里了
      - /mydata/filebeat/registry:/usr/share/filebeat/data/registry
    depends_on:
      - logstash
    user: root
    links:
      - logstash:logstash

filebeat(基于yum源-官网)

被采集服务所在服务器

  • To add the Beats repository for YUM:
    1
    sudo rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch
  • Create a file with a .repo extension (for example, elastic.repo) in your /etc/yum.repos.d/ directory and add the following lines:
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    cd /etc/yum.repos.d/
    vi elastic.repo


    [elastic-7.x]
    name=Elastic repository for 7.x packages
    baseurl=https://artifacts.elastic.co/packages/7.x/yum
    gpgcheck=1
    gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
    enabled=1
    autorefresh=1
    type=rpm-md
  • Your repository is ready to use. For example, you can install Filebeat by running:
    1
    sudo yum install filebeat
  • To configure Filebeat to start automatically during boot, run:
    1
    sudo systemctl enable filebeat
  • If your system does not use systemd then run:
    1
    sudo chkconfig --add filebeat
    问题: Exiting: error loading config file: config file ("/etc/filebeat/filebeat.yml") must be owned by the user identifier (uid=0) or root

解决方案见: https://www.elastic.co/guide/en/beats/libbeat/current/config-file-permissions.html

elk(基于docker)

  • docker-compose.yml
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    cd /opt/elk
    vi docker-compose.yml


    version: '3'
    services:
      elasticsearch:
        image: elasticsearch:7.14.0
        container_name: elasticsearch
        environment:
          # 建议给总内存的50%(如果是8g以下那就算了)
          - ES_JAVA_OPTS=-Xms4096m -Xmx4096m
          - TZ=Asia/Shanghai
        volumes:
          - /mydata/elasticsearch/plugins:/usr/share/elasticsearch/plugins
          - /mydata/elasticsearch/data:/usr/share/elasticsearch/data
          - /mydata/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml
        ports:
          - 9200:9200
          - 9300:9300
      kibana:
        image: kibana:7.14.0
        container_name: kibana
        links:
          - elasticsearch:es
        depends_on:
          - elasticsearch
        volumes:
          - /mydata/kibana/config/kibana.yml:/usr/share/kibana/config/kibana.yml
        environment:
          - TZ=Asia/Shanghai
        ports:
          - 5601:5601
      logstash:
        image: logstash:7.14.0
        container_name: logstash
        environment:
          - TZ=Asia/Shanghai
        volumes:
          - /mydata/logstash/conf.d:/usr/share/logstash/pipeline/conf.d
          - /mydata/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml
    #      - /mydata/logstash/logstash.template.json:/usr/share/logstash/templates/logstash.template.json
        depends_on:
          - elasticsearch
        links:
          - elasticsearch:es
        ports:
          - 5044:5044

配置(配置文件已标示注释)

filebeat && logstash && elasticserach

参考：配置文件详细介绍

配置用户

1
2
3
4
5
6
7
8
9
10
11
12
docker exec -it [es-id] bash
指定密码命令：./bin/elasticsearch-setup-passwords interactive
自动生成密码命令：./bin/elasticsearch-setup-passwords auto

# 各user
Changed password for user apm_system
Changed password for user kibana_system
Changed password for user kibana
Changed password for user logstash_system
Changed password for user beats_system
Changed password for user remote_monitoring_user
Changed password for user elastic

启动

filebeat

  • Start
    1
    sudo systemctl start filebeat
  • Status
    1
    sudo systemctl status filebeat

elk(cd到docker-compose文件所在路径)

  • docker-compose up -d

  • 验证一下(查看索引)

    1
    curl -XGET -H "Authorization:Basic base64Encode(user:password)" localhost:9200/_cat/indices

    注意的几个点

1
2
3
验证filebeat成功连接logshash:INFO [publisher_pipeline_output] pipeline/output.go:151 Connection to backoff(async(tcp://logstash:5044)) established

kibana没有数据(或是es没正确存储):8成可能是你存储的数据结构和之前配置的template.json映射关系有差,比如我将createTime设置成date时候,docker logs [logstash id]时候发现400了,提示转换失败

日志系统权限/角色配置

1
2
3
管理员-all
index-management-负责建立索引模式
log-viewer-仅可查看日志

日志系统索引配置(以及开启日志流模式查看)

es日志定期自动清除策略-Kibana Index Lifecycle Policies