logstash 和 filebeat 连接有用户名密码的elasticsearch

数据流程

[图片上传失败...(image-61c09e-1619429119566)]

文件夹创建整体架构图

参考资料

设置java环境

vi ~/.bash_profile

export JAVA_HOME=/usr/local/apps/jdk1.8.0_261

export PATH= $PATH:$ JAVA_HOME/bin

export CLASSPATH=.: $JAVA_HOME/jre/lib/rt.jar:$ JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar

source ~/.bash_profile

可以访问jdk

chmod -r 755 jdk1.8.0_261

https://blog.csdn.net/ubuntutouch/article/details/100675502

[图片上传失败...(image-af15e0-1619429119566)]

安装logstash

文件夹创建

<pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="" cid="n438" mdtype="fences" style="box-sizing: border-box; overflow: visible; font-family: var(--monospace); font-size: 0.9em; display: block; break-inside: avoid; text-align: left; white-space: normal; background-image: inherit; background-position: inherit; background-size: inherit; background-repeat: inherit; background-attachment: inherit; background-origin: inherit; background-clip: inherit; background-color: rgb(248, 248, 248); position: relative !important; border: 1px solid rgb(231, 234, 237); border-radius: 3px; padding: 8px 4px 6px; margin-bottom: 15px; margin-top: 15px; width: inherit;">mkdir /usr/local/apps/logstash

chmod 775 /usr/local/apps/logstash

mkdir /usr/local/apps/filebeat

chmod 775 /usr/local/apps/filebeat

mkdir /srv/logstash/log

mkdir /srv/logstash/data

chmod -R 775 /srv/logstash

mkdir /srv/filebeat/log

mkdir /srv/filebeat/data

chmod -R 775 /srv/filebeat

cd /usr/local/apps/logstash</pre>

wget https://artifacts.elastic.co/downloads/logstash/logstash-7.11.2-linux-x86_64.tar.gz

解压程序 tar -xvf logstash-7.11.2-linux-x86_64.tar.gz

在config下创建 mylogstash-filebeat.conf文件

<pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="" cid="n58" mdtype="fences" style="box-sizing: border-box; overflow: visible; font-family: var(--monospace); font-size: 0.9em; display: block; break-inside: avoid; text-align: left; white-space: normal; background-image: inherit; background-position: inherit; background-size: inherit; background-repeat: inherit; background-attachment: inherit; background-origin: inherit; background-clip: inherit; background-color: rgb(248, 248, 248); position: relative !important; border: 1px solid rgb(231, 234, 237); border-radius: 3px; padding: 8px 4px 6px; margin-bottom: 15px; margin-top: 15px; width: inherit;">input {

beats {
port => 5044

ssl => true

ssl_certificate_authorities => "/usr/local/apps/logstach/pki/tls/certs/logstash-forwarder.crt"

ssl_certificate => "/usr/local/apps/logstach/pki/tls/certs/logstash-forwarder.crt"

ssl_key => "/usr/local/apps/logstach/pki/tls/certs/logstash-forwarder.key"

ssl_verify_mode => "peer"

}
}

output {
elasticsearch {
hosts => ["http://172.20.3.12:9200","http://172.20.3.35:9200","http://172.20.3.36:9200"]

cluster => "search-center-es-cluster"

user => "logstash_system"

password => "TCaCkoju3F3iOm7W0sjH"

user => "elastic"
password => "gVZNqhqu636wm13h8npd"

index => "activecard-performance-%{+YYYY.MM.dd}"

index => "logstash"

}
}</pre>

配置日志目录

vi config/logstash.yml

path.data: /srv/data/logstash

但是好像没有生效

启动bin下的logstash

nohup ./logstash -f ../config/mylogstash-kafka.conf &

#查看启动日志

ps -ef | grep logstash

tail -100f nohup.out

日志报错

:error=>"Got response code '401' contacting Elasticsearch at UR

可能是你没有配置用户名密码

获取logstash的基本信息。

curl -XGET 'localhost:9600/?pretty'

安装 filebeat

安装

cd /usr/local/apps/filebeat

wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.3.1-linux-x86_64.tar.gz

tar xzvf filebeat-7.3.1-linux-x86_64.tar.gz

cd ilebeat-7.3.1-linux-x86_64

mv * ../

修改配置文件

filebeat 日志目录配置

抓取扫描文件配置

vi /usr/local/apps/filebeat/filebeat.yml

<pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="" cid="n340" mdtype="fences" style="box-sizing: border-box; overflow: visible; font-family: var(--monospace); font-size: 0.9em; display: block; break-inside: avoid; text-align: left; white-space: normal; background-image: inherit; background-position: inherit; background-size: inherit; background-repeat: inherit; background-attachment: inherit; background-origin: inherit; background-clip: inherit; background-color: rgb(248, 248, 248); position: relative !important; border: 1px solid rgb(231, 234, 237); border-radius: 3px; padding: 8px 4px 6px; margin-bottom: 15px; margin-top: 15px; width: inherit;">打开以下内容

打开使能

#抓取日志的配置

enabled: true

paths:

• - /srv/filebeat/log/*.log

• - /usr/local/apps/filebeat/test.log

#logstash的配置

output.logstash:

# The Logstash hosts

hosts: ["localhost:5044"]

#日志路径配置

logging.to_files: true

logging.files:

path: /srv/filebeat/log

name: filebeat

keepfiles: 7

permissions: 0644

</pre>

权限控制

<pre mdtype="fences" cid="n108" lang="" class="md-fences md-end-block ty-contain-cm modeLoaded" spellcheck="false" style="box-sizing: border-box; overflow: visible; font-family: var(--monospace); font-size: 0.9em; display: block; break-inside: avoid; text-align: left; white-space: normal; background-image: inherit; background-position: inherit; background-size: inherit; background-repeat: inherit; background-attachment: inherit; background-origin: inherit; background-clip: inherit; background-color: rgb(248, 248, 248); position: relative !important; border: 1px solid rgb(231, 234, 237); border-radius: 3px; padding: 8px 4px 6px; margin-bottom: 15px; margin-top: 15px; width: inherit;">把文件加权限赋予rd账户

chown -R rd:rd /usr/local/apps/filebeat

后面的切换到rd账户执行

su rd

chmod go-w /usr/local/apps/filebeat/filebeat.yml

touch /usr/local/apps/filebeat/test.log

echo "asdfasdfasdf" >>/usr/local/apps/filebeat/test.log

nohup ./filebeat &

tail -fn 200 nohup.out</pre>

filebeat 测试

./filebeat test output 测试运行状态

<pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="" cid="n387" mdtype="fences" style="box-sizing: border-box; overflow: visible; font-family: var(--monospace); font-size: 0.9em; display: block; break-inside: avoid; text-align: left; white-space: normal; background-image: inherit; background-position: inherit; background-size: inherit; background-repeat: inherit; background-attachment: inherit; background-origin: inherit; background-clip: inherit; background-color: rgb(248, 248, 248); position: relative !important; border: 1px solid rgb(231, 234, 237); border-radius: 3px; padding: 8px 4px 6px; margin-bottom: 15px; margin-top: 15px; width: inherit;">rd@localhost filebeat]$ ./filebeat test output

logstash: localhost:5044...

connection...

• parse host... OK

• dns lookup... OK

• addresses: ::1, 127.0.0.1

• dial up... OK

TLS... WARN secure connection disabled

talk to server... OK</pre>

说明是正常的

查询es

curl -XGET --user elastic:gVZNqhqu636wm13h8npd 'http://172.20.3.35:9200/logstash/_search'

<pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="" cid="n415" mdtype="fences" style="box-sizing: border-box; overflow: visible; font-family: var(--monospace); font-size: 0.9em; display: block; break-inside: avoid; text-align: left; white-space: normal; background-image: inherit; background-position: inherit; background-size: inherit; background-repeat: inherit; background-attachment: inherit; background-origin: inherit; background-clip: inherit; background-color: rgb(248, 248, 248); position: relative !important; border: 1px solid rgb(231, 234, 237); border-radius: 3px; padding: 8px 4px 6px; margin-bottom: 15px; margin-top: 15px; width: inherit;">{"_index":"logstash","_type":"_doc","_id":"HtlkDXkBEawMgE7wuu-Z","_score":1.0,"_source":{"offset":135,"source":"/usr/local/apps/filebeat/test.log","prospector":{"type":"log"},"message":"123123123123123","@version":"1","beat":{"version":"6.2.4","name":"localhost.localdomain","hostname":"localhost.localdomain"},"@timestamp":"2021-04-26T08:56:14.094Z","tags":["beats_input_codec_plain_applied"]}},{"_index":"logstash","_type":"_doc","_id":"yjhkDXkBo6lKLCg_uhM3","_score":1.0,"_source":{"offset":151,"source":"/usr/local/apps/filebeat/test.log","prospector":{"type":"log"},"message":"123123123123123","@version":"1","beat":{"version":"6.2.4","name":"localhost.localdomain","hostname":"localhost.localdomain"},"@timestamp":"2021-04-26T08:56:14.094Z","tags":["beats_input_codec_plain_applied"]}},{"_index":"logstash","_type":"_doc","_id":"yzhkDXkBo6lKLCg_uhM3","_score":1.0,"_source":{"offset":503,"source":"/usr/local/apps/filebeat/test.log","prospector":{"type":"log"},"message":"123123123123123","@version":"1","beat":{"version":"6.2.4","name":"localhost.localdomain","hostname":"localhost.localdomain"},"@timestamp":"2021-04-26T08:56:14.096Z","tags":["beats_input_codec_plain_applied"]}},{"_index":"logstash","_type":"_doc","_id":"yDhkDXkBo6lKLCg_uhM0","_score":1.0,"_source":{"offset":711,"source":"/usr/local/apps/filebeat/test.log","prospector":{"type":"log"},"message":"123123123123123","@version":"1","beat":{"version":"6.2.4","name":"localhost.localdomain","hostname":"localhost.localdomain"},"@timestamp":"2021-04-26T08:56:14.097Z","tags":["beats_input_codec_plain_applied"]}},{"_index":"logstash","_type":"_doc","_id":"wDhkDXkBo6lKLCg_uhM0","_score":1.0,"_source":{"offset":169,"source":"/srv/filebeat/log/a.log","prospector":{"type":"log"},"message":"asdfasdfasdf","@version":"1","beat":{"version":"6.2.4","name":"localhost.localdomain","hostname":"localhost.localdomain"},"@timestamp":"2021-04-26T08:56:14.093Z","tags":["beats_input_codec_plain_applied"]}},{"_index":"logstash","_type":"_doc","_id":"wThkDXkBo6lKLCg_uhM0","_score":1.0,"_source":{"offset":279,"source":"/usr/local/apps/filebeat/test.log","prospector":{"type":"log"},"message":"123123123123123","@version":"1","beat":{"version":"6.2.4","name":"localhost.localdomain","hostname":"localhost.localdomain"},"@timestamp":"2021-04-26T08:56:14.095Z","tags":["beats_input_codec_plain_applied"]}},{"_index":"logstash","_type":"_doc","_id":"HdlkDXkBEawMgE7wuu-V","_score":1.0,"_source":{"offset":423,"source":"/usr/local/apps/filebeat/test.log","prospector":{"type":"log"},"message":"123123123123123","@version":"1","beat":{"version":"6.2.4","name":"localhost.localdomain","hostname":"localhost.localdomain"},"@timestamp":"2021-04-26T08:56:14.096Z","tags":["beats_input_codec_plain_applied"]}},{"_index":"logstash","_type":"_doc","_id":"wjhkDXkBo6lKLCg_uhM0","_score":1.0,"_source":{"offset":743,"prospector":{"type":"log"},"source":"/usr/local/apps/filebeat/test.log","message":"123123123123123","@version":"1","beat":{"version":"6.2.4","name":"localhost.localdomain","hostname":"localhost.localdomain"},"@timestamp":"2021-04-26T08:56:14.097Z","tags":["beats_input_codec_plain_applied"]}},{"_index":"logstash","_type":"_doc","_id":"DdlkDXkBEawMgE7wuu-O","_score":1.0,"_source":{"offset":39,"prospector":{"type":"log"},"source":"/usr/local/apps/filebeat/test.log","message":"asdfasdfasdf","@version":"1","beat":{"version":"6.2.4","name":"localhost.localdomain","hostname":"localhost.localdomain"},"@timestamp":"2021-04-26T08:56:14.094Z","tags":["beats_input_codec_plain_applied"]}}]}}</pre>

参考:

https://www.cnblogs.com/xiaobaozi-95/p/9214307.html

https://blog.csdn.net/zjcjava/article/details/99258682

//www.greatytc.com/p/4aa3a8b70bfa

https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html

常见问题

配置里抓取的日志但是感觉filebeat 没有抓取日志

可能是配置文件里 enable 没有打开

模拟产生日志

echo "asdfasdfasdfasdf" >> /srv/filebeat/log/test.log

http://172.20.3.35:9200/activecard-performance-2021.04.26/_search

查询日志

curl -XGET --user logstash_system:TCaCkoju3F3iOm7W0sjH 'http://172.20.3.35:9200/activecard-performance-2021.04.26/_search'

不行那个用户只能查询

elasticsearch 多个用户权限问题

curl -XGET --user elastic:gVZNqhqu636wm13h8npd 'http://172.20.3.35:9200/activecard-performance-2021.04.26/_search'

curl -XGET --user elastic:gVZNqhqu636wm13h8npd 'http://172.20.3.35:9200/logstash/_search'

这个可以的

测试logstash 有没有写入权限

curl -XGET --user elastic:gVZNqhqu636wm13h8npd 'http://172.20.3.35:9200/logstash/_doc/4'

curl -XPOST --user elastic:gVZNqhqu636wm13h8npd 'http://172.20.3.35:9200/logstash/_doc/4' --header 'Content-Type: application/json' \

--data '{

"id":"4" ,

"title":"标题" ,

"category":"分类",

"browserUrl":"http://api.51awifi.com/api/doc/123" ,

"content":"文档内容" ,

"author":"张三"

}'

curl -XPOST --user logstash_system:TCaCkoju3F3iOm7W0sjH 'http://172.20.3.35:9200/logstash/_doc/4' --header 'Content-Type: application/json' \

--data '{

"id":"4" ,

"title":"标题" ,

"category":"分类",

"browserUrl":"http://api.51awifi.com/api/doc/123" ,

"content":"文档内容" ,

"author":"张三"

}'

人面猴
序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
沈念sama阅读 214,837评论 6赞 496
死咒
序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
沈念sama阅读 91,551评论 3赞 389
救了他两次的神仙让他今天三更去死
文/潘晓璐我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
开封第一讲书人阅读 160,417评论 0赞 350
道士缉凶录：失踪的卖姜人
文/不坏的土叔我叫张陵，是天一观的道长。经常有香客问我，道长，这世上最难降的妖魔是什么？我笑而不...
开封第一讲书人阅读 57,448评论 1赞 288
港岛之恋（遗憾婚礼）
正文为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
茶点故事阅读 66,524评论 6赞 386
恶毒庶女顶嫁案：这布局不是一般人想出来的
文/花漫我一把揭开白布。她就那样静静地躺着，像睡着了一般。火红的嫁衣衬着肌肤如雪。梳的纹丝不乱的头发上，一...
开封第一讲书人阅读 50,554评论 1赞 293
城市分裂传说
那天，我揣着相机与录音，去河边找鬼。笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。我是一名探鬼主播，决...
沈念sama阅读 39,569评论 3赞 414
双鸳鸯连环套：你想象不到人心有多黑
文/苍兰香墨我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
开封第一讲书人阅读 38,316评论 0赞 270
万荣杀人案实录
序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
沈念sama阅读 44,766评论 1赞 307
护林员之死
正文独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋以下内容为张勋视角年9月15日...
茶点故事阅读 37,077评论 2赞 330
白月光启示录
正文我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
茶点故事阅读 39,240评论 1赞 343
活死人
序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
沈念sama阅读 34,912评论 5赞 338
日本核电站爆炸内幕
正文年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
茶点故事阅读 40,560评论 3赞 322
男人毒药：我在死后第九天来索命
文/蒙蒙一、第九天我趴在偏房一处隐蔽的房顶上张望。院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
开封第一讲书人阅读 31,176评论 0赞 21
一桩弑父案，背后竟有这般阴谋
文/苍兰香墨我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。一阵脚步声响...
开封第一讲书人阅读 32,425评论 1赞 268
情欲美人皮
我被黑心中介骗来泰国打工，没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。一个月前我还...
沈念sama阅读 47,114评论 2赞 366
代替公主和亲
正文我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
茶点故事阅读 44,114评论 2赞 352