0x00 配置FIlebeat蒐集syslog併發送至
#配置
mv /etc/filebeat/filebeat.yml /etc/filebeat/filebeat.yml.bak
vim /etc/filebeat/filebeat.yml
filebeat.prospectors:
- type: log
enabled: true
paths:
- /var/log/messages
fields:
log_topics: syslog-1.202
max_bytes: 1048576
output.logstash:
hosts: ["127.0.0.1:5044"]
#啓動
systemctl start filebea
0x01 配置Logstash從FIlebeat輸入syslog日誌並輸出至Elasticsearch
#配置從beat 5044端口接收日誌,且根據fields建立日誌索引
vim /etc/logstash/conf.d/syslog.conf
input {
beats {
port => 5044
}
}
output {
if[fields][log_topics] == "syslog-1.202" {
elasticsearch {
hosts => ["192.168.1.202:9200"]
index => "syslog-1.202-%{+YYYY.MM}"
}
}
}
#啓動服務
systemctl start logstash
0x02 Troubleshooting
#日誌排查
tailf /var/log/logstash/logstash-plain.log
tailf /var/log/filebeat/filebeat
#配置文件語法合規性排查
/usr/share/logstash/bin/logstash --path.settings /etc/logstash -f /etc/logstash/conf.d/syslog.conf --config.test_and_exit
/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml
0x03 ElasticSearch查看索引
#查看索引
curl http://192.168.1.202:9200/_cat/indices?v
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open .kibana sdsMVkoKQZaZncZf6OXEeg 1 0 1 0 3.7kb 3.7kb
yellow open syslog-1.202-2018.03 0JDgsgabR16EozrEhVHosA 5 1 4 0 31.5kb 31.5kb
#清空無用索引
curl -XDELETE http://192.168.1.202:9200/+索引名
0x04 Kibana創建索引