Centos7 之安装Logstash ELK stack 日志管理系统

一、介绍

　　

[root@nginx filebeat]# cat conf.d/syslogs.yml
filebeat:
prospectors:
- paths:
- /var/log/messages
encoding: plain
fields_under_root: false
input_type: log
ignore_older: 24h
document_type: syslog-beat
scan_frequency: 10s
harvester_buffer_size: 16384
tail_files: false
force_close_files: false
backoff: 1s
max_backoff: 1s
backoff_factor: 2
partial_line_waiting: 5s
max_bytes: 10485760

[root@nginx filebeat]# cat conf.d/nginx.yml
filebeat:
prospectors:
- paths:
- /var/log/nginx/access.log
encoding: plain
fields_under_root: false
input_type: log
ignore_older: 24h
document_type: syslog-beat
scan_frequency: 10s
harvester_buffer_size: 16384
tail_files: false
force_close_files: false
backoff: 1s
max_backoff: 1s
backoff_factor: 2
partial_line_waiting: 5s
max_bytes: 10485760

View Code
修改完成后，启动filebeat服务，并检查filebeat进程

[root@nginx filebeat]# service filebeat start
Starting filebeat:                                         [  OK  ]
[root@nginx filebeat]# chkconfig filebeat on

[root@nginx filebeat]# netstat -aulpt
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 *:ssh                       *:*                         LISTEN      1076/sshd
tcp        0      0 localhost:smtp              *:*                         LISTEN      1155/master
tcp        0      0 *:http                      *:*                         LISTEN      1446/nginx
tcp        0     52 nginx.test.com:ssh          192.168.30.65:11690         ESTABLISHED 1313/sshd
tcp        0      0 nginx.test.com:49500        elk.test.com:commplex-main  ESTABLISHED 1515/filebeat
tcp        0      0 nginx.test.com:ssh          192.168.30.65:6215          ESTABLISHED 1196/sshd
tcp        0      0 nginx.test.com:ssh          192.168.30.65:6216          ESTABLISHED 1200/sshd
tcp        0      0 *:ssh                       *:*                         LISTEN      1076/sshd

通过上面可以看出，客户端filebeat进程已经和 elk 服务器连接了。下面去验证。

五、验证，访问kibana http://192.168.30.67
5.1 设置下



查看下两台机器的系统日志：node1的



node2的nginx 访问日志



六、体验

　　之前在学习rsyslog +LogAnalyzer，然后又学了这个之后，发现elk 不管从整体系统，还是体验都是不错的，而且更新快。后续会继续学习，更新相关的监控过滤日志方法，日志分析，以及使用kafka 来进行存储的架构。

本文章属于原创，如果觉得有价值，转载时请注明出处。谢谢

参考网站：https://www.elastic.co/products/elasticsearch