标签:isa play 服务安装 cti 信息 process sha 技术 ret
3、Kibana的简介
Kibana 让您能够自由地选择如何呈现自己的数据。Kibana 核心产品搭载了一批经典功能:柱状图、线状图、饼图、旭日图等等。
3.1、软件包下载地址:https://www.elastic.co/cn/downloads/kibana
3.1.1 软件包tar压缩包,解压到/application目录中,并创建链接文件。
ln -s /application/kibana-7.3.2-linux-x86_64 /application/kibana
3.2、配置Kibana服务的配置文件/application/kibana/config/kibana.yml
# Kibana is served by a back end server. This setting specifies the port to use. server.port: 5601 #kibana端口 # Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values. # The default is ‘localhost‘, which usually means remote machines will not be able to connect. # To allow connections from remote users, set this parameter to a non-loopback address. server.host: "10.0.0.169" #绑定的主机IP地址 # Enables you to specify a path to mount Kibana at if you are running behind a proxy. # Use the `server.rewriteBasePath` setting to tell Kibana if it should remove the basePath # from requests it receives, and to prevent a deprecation warning at startup. # This setting cannot end in a slash. #server.basePath: "" # Specifies whether Kibana should rewrite requests that are prefixed with # `server.basePath` or require that they are rewritten by your reverse proxy. # This setting was effectively always `false` before Kibana 6.3 and will # default to `true` starting in Kibana 7.0. #server.rewriteBasePath: false # The maximum payload size in bytes for incoming server requests. #server.maxPayloadBytes: 1048576 # The Kibana server‘s name. This is used for display purposes. #server.name: "your-hostname" # The URLs of the Elasticsearch instances to use for all your queries. elasticsearch.hosts: ["http://10.0.0.169:9200"] #elasticsearch的主机IP # When this setting‘s value is true Kibana uses the hostname specified in the server.host # setting. When the value of this setting is false, Kibana uses the hostname of the host # that connects to this Kibana instance. #elasticsearch.preserveHost: true # Kibana uses an index in Elasticsearch to store saved searches, visualizations and # dashboards. Kibana creates a new index if the index doesn‘t already exist. kibana.index: ".kibana" #开启此选项 # The default application to load. #kibana.defaultAppId: "home" # If your Elasticsearch is protected with basic authentication, these settings provide # the username and password that the Kibana server uses to perform maintenance on the Kibana # index at startup. Your Kibana users still need to authenticate with Elasticsearch, which # is proxied through the Kibana server. #elasticsearch.username: "kibana" #elasticsearch.password: "pass" # Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively. # These settings enable SSL for outgoing requests from the Kibana server to the browser. #server.ssl.enabled: false #server.ssl.certificate: /path/to/your/server.crt #server.ssl.key: /path/to/your/server.key # Optional settings that provide the paths to the PEM-format SSL certificate and key files. # These files validate that your Elasticsearch backend uses the same key files. #elasticsearch.ssl.certificate: /path/to/your/client.crt #elasticsearch.ssl.key: /path/to/your/client.key # Optional setting that enables you to specify a path to the PEM file for the certificate # authority for your Elasticsearch instance. #elasticsearch.ssl.certificateAuthorities: [ "/path/to/your/CA.pem" ] # To disregard the validity of SSL certificates, change this setting‘s value to ‘none‘. #elasticsearch.ssl.verificationMode: full # Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of # the elasticsearch.requestTimeout setting. #elasticsearch.pingTimeout: 1500 # Time in milliseconds to wait for responses from the back end or Elasticsearch. This value # must be a positive integer. #elasticsearch.requestTimeout: 30000 # List of Kibana client-side headers to send to Elasticsearch. To send *no* client-side # headers, set this value to [] (an empty list). #elasticsearch.requestHeadersWhitelist: [ authorization ] # Header names and values that are sent to Elasticsearch. Any custom headers cannot be overwritten # by client-side headers, regardless of the elasticsearch.requestHeadersWhitelist configuration. #elasticsearch.customHeaders: {} # Time in milliseconds for Elasticsearch to wait for responses from shards. Set to 0 to disable. #elasticsearch.shardTimeout: 30000 # Time in milliseconds to wait for Elasticsearch at Kibana startup before retrying. #elasticsearch.startupTimeout: 5000 # Logs queries sent to Elasticsearch. Requires logging.verbose set to true. #elasticsearch.logQueries: false # Specifies the path where Kibana creates the process ID file. #pid.file: /var/run/kibana.pid # Enables you specify a file where Kibana stores log output. #logging.dest: stdout # Set the value of this setting to true to suppress all logging output. #logging.silent: false # Set the value of this setting to true to suppress all logging output other than error messages. #logging.quiet: false # Set the value of this setting to true to log all events, including system usage information # and all requests. #logging.verbose: false # Set the interval in milliseconds to sample system and process performance # metrics. Minimum is 100ms. Defaults to 5000. #ops.interval: 5000 # Specifies locale to be used for all localizable strings, dates and number formats. # Supported languages are the following: English - en , by default , Chinese - zh-CN . i18n.locale: "zh-CN" #kibana默认文字是英文,变更成中文
3.3、启动kibana
如果使用root用户启动服务,后面必须加--allow-root选项。
[root@harlan_ansible ~]# /application/kibana/bin/kibana --allow-root
3.4、通过浏览器访问地址:http://10.0.0.169:5601
由上述可知,kibana服务安装和配置成功。
3.5、通过访问kibana浏览器,我们可以直接在需要收集日志的主机上安装Beats软件,不需要安装Logstash软件包。
通过配置Beats服务的配置文件,来收集不同服务的日志。
3.5.1、例收集本机的系统日志文件
下载并安装 Filebeat
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.3.2-x86_64.rpm sudo rpm -vi filebeat-7.3.2-x86_64.rpm
编辑配置
修改 /etc/filebeat/filebeat.yml
以设置连接信息:
output.elasticsearch: hosts: ["<es_url>"] username: "elastic" password: "<password>" setup.kibana: host: "<kibana_url>"
其中,<password>
是 elastic
用户的密码,<es_url>
是 Elasticsearch 的 URL,<kibana_url>
是 Kibana 的 URL。
启用和配置 system 模块
sudo filebeat modules enable system
在 /etc/filebeat/modules.d/system.yml
文件中修改设置。
启动 Filebeat
setup
命令加载 Kibana 仪表板。如果仪表板已设置,请省略此命令。
sudo filebeat setup
sudo service filebeat start
模块状态
确认已从 Filebeat system
模块成功收到数据
完成所有步骤后,您便可以随时浏览自己的数据。
标签:isa play 服务安装 cti 信息 process sha 技术 ret
原文地址:https://www.cnblogs.com/eeexu123/p/11608669.html