ELK7.11.2版本安装部署及ElastAlert告警相关配置

[root@localhost ~]# ls -ls *.rpm
315352 -rw-r--r-- 1 root root 322917736 Mar 31 04:53 elasticsearch-7.11.2-x86_64.rpm
 33512 -rw-r--r-- 1 root root  34316071 Mar 31 05:44 filebeat-7.11.2-x86_64.rpm
249492 -rw-r--r-- 1 root root 255479673 Mar 31 04:52 kibana-7.11.2-x86_64.rpm
358580 -rw-r--r-- 1 root root 367185271 Mar 31 04:53 logstash-7.11.2-x86_64.rpm

    ##安装jdk
[root@localhost ~]# yum install -y java-11-openjdk
    ##看下java版本，没问题
[root@localhost ~]# java -version
openjdk version "11.0.10" 2021-01-19 LTS
OpenJDK Runtime Environment 18.9 (build 11.0.10+9-LTS)
OpenJDK 64-Bit Server VM 18.9 (build 11.0.10+9-LTS, mixed mode, sharing)

    ##记得同步时间
[root@localhost ~]# yum install -y ntpdate
    ##服务器没有时间同步可以加到 /etc/rc.local 中
[root@localhost ~]# /usr/sbin/ntpdate ntp.aliyun.com

    ##导入GPG密钥，如果不能在线导入，用这个http地址在浏览器把密钥下载下来，然后本地导入，URL换成路径文件即可
[root@localhost ~]# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

    ##安装rpm软件包
[root@localhost ~]# rpm -ivh elasticsearch-7.11.2-x86_64.rpm logstash-7.11.2-x86_64.rpm kibana-7.11.2-x86_64.rpm filebeat-7.11.2-x86_64.rpm 
warning: elasticsearch-7.11.2-x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY
Preparing...                          ################################# [100%]
Updating / installing...
   1:filebeat-7.11.2-1                ################################# [ 25%]
   2:kibana-7.11.2-1                  ################################# [ 50%]
Creating kibana group... OK
Creating kibana user... OK
   3:logstash-1:7.11.2-1              ################################# [ 75%]
Using bundled JDK: /usr/share/logstash/jdk
Using provided startup.options file: /etc/logstash/startup.options
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/pleaserun-0.0.31/lib/pleaserun/platform/base.rb:112: warning: constant ::Fixnum is deprecated
Successfully created system startup script for Logstash
Creating elasticsearch group... OK
Creating elasticsearch user... OK
   4:elasticsearch-0:7.11.2-1         ################################# [100%]
### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using systemd
 sudo systemctl daemon-reload
 sudo systemctl enable elasticsearch.service
### You can start elasticsearch service by executing
 sudo systemctl start elasticsearch.service
Created Kibana keystore in /etc/kibana/kibana.keystore
Created elasticsearch keystore in /etc/elasticsearch/elasticsearch.keystore

[root@localhost ~]# vim /etc/elasticsearch/elasticsearch.yml
    ##打开注释，集群名称和节点名称都是可以自己进行设定的
 17 cluster.name: my-application
 23 node.name: node-1

    ##数据文件及日志文件的路径，可以使用默认的 /var 下路径，若自己进行了其他位置的配置需要创建文件夹并正确授权，配置完配置文件，后面我有写步骤
 33 path.data: /opt/elasticsearch/date
 37 path.logs: /opt/elasticsearch/log

    ##配置绑定的网络地址，127是绑定本地，相应的，kibana和logstash是同一主机才可进行访问，若不同主机，要配置为elasticsearch自己主机的IP地址，使其他主机上的服务可以进行访问，端口默认9200
 55 network.host: 127.0.0.1
 59 http.port: 9200

    ##开启x-pack的安全功能
 89 xpack.security.enabled: true
 90 xpack.security.transport.ssl.enabled: true
 91 cluster.initial_master_nodes: ["node-1"]

    ##根据实际需要，我们创建目录，这里我就暂时放 opt 下了
[root@localhost ~]# mkdir -pv /opt/elasticsearch/date
mkdir: created directory ‘/opt/elasticsearch’
mkdir: created directory ‘/opt/elasticsearch/date’
[root@localhost ~]# mkdir -pv /opt/elasticsearch/log
mkdir: created directory ‘/opt/elasticsearch/log’

    ##目录需要有相应的权限才能正常使用，需要注意的是，目录需要有gid权限
[root@localhost ~]# cd /opt/elasticsearch/
[root@localhost elasticsearch]# chmod 750 *
[root@localhost elasticsearch]# chmod g+s *
[root@localhost elasticsearch]# chown elasticsearch:elasticsearch *
[root@localhost elasticsearch]# ll
total 0
drwxr-s--- 2 elasticsearch elasticsearch 6 Apr  3 14:12 date
drwxr-s--- 2 elasticsearch elasticsearch 6 Apr  3 14:12 log

    ##必须启动elasticsearch才能使用
[root@localhost ~]# systemctl start elasticsearch

    ##进行内置用户的密码设置，此处为了省事，我把密码设定与用户相同，实际情况根据需要来自行设定
[root@localhost ~]# /usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user.
You will be prompted to enter passwords as the process progresses.
Please confirm that you would like to continue [y/N]y


Enter password for [elastic]: 
Reenter password for [elastic]: 
Enter password for [apm_system]: 
Reenter password for [apm_system]: 
Enter password for [kibana_system]: 
Reenter password for [kibana_system]: 
Enter password for [logstash_system]: 
Reenter password for [logstash_system]: 
Enter password for [beats_system]: 
Reenter password for [beats_system]: 
Enter password for [remote_monitoring_user]: 
Reenter password for [remote_monitoring_user]: 
Changed password for user [apm_system]
Changed password for user [kibana_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]

[root@localhost ~]# vim /etc/kibana/kibana.yml

    ##端口默认5601
  2 server.port: 5601

    ##绑定地址，这里暂时用0.0.0.0，是允许所有地址进行访问的，但是目前配置我们是加了x-pack的认证登录的，若还需要nginx的代理认证，需要改为127.0.0.1，仅允许本机访问
  7 server.host: "0.0.0.0"

    ##连接的elasticsearch，本地可以localhost，对应的是elasticsearch设置了127.0.0.1，若是设定的IP地址，则这里也需要改为对应的IP地址
 32 elasticsearch.hosts: ["http://localhost:9200"]

    ##kibana索引设置
 36 kibana.index: ".kibana"

    ##之前我们设置号的kibana用户和密码
 45 elasticsearch.username: "kibana_system"
 46 elasticsearch.password: "kibana_system"

    ##界面语言改成中文，默认的en是英文
111 i18n.locale: "zh-CN"

[root@localhost ~]# vim /etc/logstash/logstash.yml

    ##默认127.0.0.1，仅允许本机访问，我们之后会有不同的主机采集日志，所以设置为0.0.0.0，允许访问
231 http.host: "0.0.0.0"

    ##端口默认即可，但是需要打开注释
236 http.port: 9600-9700

    ##复制模板
[root@localhost ~]# cp /etc/logstash/logstash-sample.conf /etc/logstash/conf.d/logstash.conf

    ##修改配置文件
[root@localhost ~]# vim /etc/logstash/conf.d/logstash.conf
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    ##下面的user和password需要打开注释，我们有x-pack认证，需要用户及密码，否则无法连接
    user => "elastic"
    password => "elastic"
  }
}

[root@localhost ~]# vim /etc/filebeat/filebeat.yml

    ##添加注释，禁用，我们不直接输出到elasticsearch
176 #output.elasticsearch:
178   #hosts: ["localhost:9200"]

    ##这里我们要设置输出到logstash，本地可以是localhost，异地则设置为IP地址
189 output.logstash:
191   hosts: ["192.168.85.10:5044"]

    ##enable为开启，disable为关闭，多个模块空格分隔，例如：system nginx apache ...
[root@localhost ~]# filebeat modules enable system
Enabled system

    ##启用设置，使之生效
[root@localhost ~]# filebeat setup
Exiting: Index management requested but the Elasticsearch output is not configured/enabled

    ##启动服务，当然，systemctl restart 也可以
[root@localhost ~]# service filebeat start
Starting filebeat (via systemctl):                         [  OK  ]

    ##下列没有涉及到的部分配置文件不做修改，下面是要进行修改的配置
[root@postgreSQL ~]# vim /etc/filebeat/filebeat.yml

filebeat.inputs:
    ##类型，默认的log即可
- type: log
    ##默认是false，不启用设置，这里设置好的一定要改成true，否则不生效
  enabled: true
    ##日志路径，绝对路径，可以使用*来做通配，但是我并没有这么做，日志索引的信息我是定期删除的，这个也要考虑一下你的日志滚动设置
  paths:
    - /var/log/messages
    ##这个是为我们采集的每条日志信息增加一个标签一样的东西，来进行标识，为啥是这个，我不知道，反正大家都这么写的，哈哈
  fields:
    index: syslog-91

- type: log
  enabled: true
  paths:
    - /var/log/nginx/access.log
  fields:
    index: nginx-access

- type: log
  enabled: true
  paths:
    - /var/log/nginx/error.log
  fields:
    index: nginx-error

# ---------------------------- Elasticsearch Output ----------------------------
    ##这个是默认开启的，我们要把采集的日志送到logstash中，所以要关闭这个，当前配置只允许开启一个output设置，不能双开
#output.elasticsearch:
    ##这个也注释上
  #hosts: ["localhost:9200"]

# ------------------------------ Logstash Output -------------------------------
    ##默认关闭的，我们使用logstash进行配置，所以去掉注释打开
output.logstash:
    ##地址要填写logstash得到主机IP地址，端口号默认是5044，但其实它是在logstash主机下的 /etc/logstash/conf.d/logstash.conf 中设置的
  hosts: ["192.168.85.10:5044"]

# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    ##格式这里，[fields] 和 [index] 分别对应 filebeat 中对日志文件设置的“标签”
    index => "%{[fields][index]}-%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    user => "elastic"
    password => "elastic"
  }
}

    ##logstash端重启服务
[root@localhost kibana]# systemctl restart logstash

    ##filebeat端，记得开启nginx，并做几次成功和失败的访问，然后去看看日志刷新情况
[root@postgreSQL ~]# systemctl status filebeat

[root@postgreSQL ~]# vim /etc/filebeat/filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/messages
    ##将fields 和 index 去掉了，使用一个 tags 的标签来标识日志文件来源
  tags: ["syslog91"]

- type: log
  enabled: true
  paths:
    - /var/log/nginx/access.log
  tags: ["nginx-access"]

- type: log
  enabled: true
  paths:
    - /var/log/nginx/error.log
  tags: ["nginx-error"]

# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  # Array of hosts to connect to.
    ##这里我们要设置连接的elasticsearch的IP地址，当然，相应的我们也需要修改elasticsearch中的配置，下面会有
  hosts: ["192.168.85.10:9200"]
  indices:
    ##索引名称
  - index: "syslog2--%{+YYYY.MM.dd}"
    ##匹配包含字段
    when.contains:   
    ##去匹配包含syslog2内容的信息
      tags: "syslog2"
  - index: "nginx-access--%{+YYYY.MM.dd}"
    when.contains:
      tags: "nginx-access"
  - index: "nginx-error--%{+YYYY.MM.dd}"
    when.contains:
      tags: "nginx-error"
    ##由于x-pack设置，我们需要添加连接到elasticsearch的认证用户及密码
  username: "elastic"
  password: "elastic"

    ##填加kibana的认证用户及密码
# =================================== Kibana ===================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:
  username: "kibana_system"
  password: "kibana_system"

    ##关闭输出到logstash
# ------------------------------ Logstash Output -------------------------------
#output.logstash:
  # The Logstash hosts
  # hosts: ["192.168.85.10:5044"]

[root@localhost ~]# vim /etc/elasticsearch/elasticsearch.yml

    ##将本地绑定的127.0.0.1改为主机的IP地址，使其他主机上的filebeat服务访问到elasticsearch
 55 network.host: 192.168.85.10

[root@localhost ~]# vim /etc/kibana/kibana.yml

    ##kibana配置文件也需要修改，否则连接不到elasticsearch
 32 elasticsearch.hosts: ["http://192.168.85.10:9200"]

    ##重启elasticsearch服务，顺便把logstash停了
[root@localhost ~]# systemctl stop logstash
[root@localhost ~]# systemctl restart elasticsearch

    ##采集日志的主机重启filebeat服务
[root@postgreSQL ~]# systemctl restart filebeat

    ##解决python3和其他一些依赖关系，当然，下面还需要git，若没有可以添加git一起安装
[root@localhost ~]# yum install -y epel-release
[root@localhost ~]# yum install -y python36 python-dev libsasl2-devel libffi-dev libffi-devel libssl-dev python36-devel libevent-devel gcc gcc-c++

    ##git下载需要带有git命令，yum可以进行安装，或者在windows主机下载压缩包拿过来，unzip解压即可
[root@localhost ~]# git clone https://github.com/Yelp/elastalert.git
[root@localhost ~]# wget https://github.com/xuyaoqiang/elastalert-dingtalk-plugin/archive/master.zip
[root@localhost ~]# unzip elastalert-dingtalk-plugin-master
    ##名字太长了，我们改一下吧
[root@localhost ~]# mv elastalert-dingtalk-plugin-master dingtalk

    ##得到两个目录，位置可以自己定，我目前测试是直接给他放root下了
[root@localhost ~]# ls -ld elastalert elastalert-dingtalk-plugin-master
drwxr-xr-x 10 root root 4096 Apr  6 21:54 elastalert
drwxr-xr-x  4 root root  123 Apr  8 07:10 dingtalk

[root@localhost ~]# cd /elastalert/
    ##安装模块
[root@localhost elastalert]# pip3 install setuptools==44.0.0
[root@localhost elastalert]# python setup.py install
    ##我们还需要一个elasticsearch-py，我们是7.11.2，但是后面创建索引的时候会提示你需要7.0.0，要不不能创建，所以这里我们安装7.0.0
[root@localhost elastalert]# pip3 install elasticsearch==7.0.0

    ##切换到dingtalk目录下
[root@localhost elastalert]# cd ../dingtalk
    ##这个安装会大量下包，不要终止它
[root@localhost ~]# pip install -r requirements.txt 

    ##然后我们需要把dingtalk的模块文件复制到elastalert目录下，否则之后我们配置的时候它会报错找不到模块
[root@localhost elastalert]# cp -r ../dingtalk/elastalert_modules .

   ##安装成功后会出现4个命令，下面的目录及其子文件可以忽略 
[root@localhost elastalert]# ls -l /usr/bin/elastalert*
-rwxr-xr-x 1 root root 316 Apr  6 21:55 /usr/bin/elastalert
-rwxr-xr-x 1 root root 342 Apr  6 21:55 /usr/bin/elastalert-create-index
-rwxr-xr-x 1 root root 350 Apr  6 21:55 /usr/bin/elastalert-rule-from-kibana
-rwxr-xr-x 1 root root 336 Apr  6 21:55 /usr/bin/elastalert-test-rule

/usr/bin/elastalert.egg-info:
total 24
-rw-r--r-- 1 root root   1 Apr  6 21:55 dependency_links.txt
-rw-r--r-- 1 root root 226 Apr  6 21:55 entry_points.txt
-rw-r--r-- 1 root root 417 Apr  6 21:55 PKG-INFO
-rw-r--r-- 1 root root 369 Apr  6 21:55 requires.txt
-rw-r--r-- 1 root root 205 Apr  6 21:55 SOURCES.txt
-rw-r--r-- 1 root root   1 Apr  6 21:55 top_level.txt

    ##dingtalk插件的目录下有安装文件和一些参考和说明文件，在编写规则时可以进行参考，但是我们能进行编写即可，一般不用
[root@localhost ~]# cd dingtalk/
[root@localhost dingtalk]# ll
total 12
-rw-r--r-- 1 root root 1762 Sep 15  2017 config.yaml
drwxr-xr-x 2 root root   50 Sep 15  2017 elastalert_modules
-rw-r--r-- 1 root root  688 Sep 15  2017 README.md
-rw-r--r-- 1 root root   92 Sep 15  2017 requirements.txt
drwxr-xr-x 2 root root   57 Sep 15  2017 rules

    ##ElastAlert目录下原本只有主配置文件模板，我们要复制创建一个主配置文件
[root@localhost ~]# cd elastalert
[root@localhost elastalert]# cp config.yaml.example config.yaml

    ##之后我们进行主配置文件的调整
[root@localhost elastalert]# vim config.yaml

    ##这个是我们配置的规则文件的目录，相对路径即可，这里我没有变动，一会规则文件都塞到这里面
  3 rules_folder: example_rules

    ##
  7 run_every:
  8   minutes: 1

    ##
 12 buffer_time:
 13   minutes: 15

    ##我们elasticsearch的地址，我这里设定的是IP
 17 es_host: 192.168.85.10

    ##端接我这里没有变化，若自行设定请修改正确
 20 es_port: 9200

    ##这里是elasticsearhc的认证用户及密码，若设定了就需要填写，没有则可以#注释，不使用
 46 es_username: elastic
 47 es_password: elastic

    ##这个是我们为ElastAlert创建的索引，默认即可，一会后面我们会进行创建，若自定义请填写正确
 59 writeback_index: elastalert_status
 60 writeback_alias: elastalert_alerts

    ##
 64 alert_time_limit:
 65   days: 2

    ##这里提醒一下，一般情况下创建 elastalert-create-index --index elastalert_status 和 elastalert-create-index 两个命令都是可以的
    ##若一个不行可以用另一个试一试，我在删除索引之后重建使用 elastalert-create-index 不能创建，后面必须加 --index elastalert_status 才可以执行成功
    ##创建成功后，在Kibana中就可以看到该条索引了
[root@localhost elastalert]# elastalert-create-index --index elastalert_status
Elastic Version: 7.11.2
Reading Elastic 6 index mappings:
Reading index mapping ‘es_mappings/6/silence.json‘
Reading index mapping ‘es_mappings/6/elastalert_status.json‘
Reading index mapping ‘es_mappings/6/elastalert.json‘
Reading index mapping ‘es_mappings/6/past_elastalert.json‘
Reading index mapping ‘es_mappings/6/elastalert_error.json‘
New index elastalert_status created
Done!

    ##到我们的规则文件目录里来
[root@localhost example_rules]# pwd
/root/elastalert/example_rules
    ##我们需要编辑一个规则文件，可以从现有的模板进行一次复制
[root@localhost example_rules]# cp example_frequency.yaml syslog10.yaml

    ##编辑规则文件
[root@localhost example_rules]# vim syslog200.yaml
# Alert when the rate of events exceeds a threshold

# (Optional)
# Elasticsearch host
    ##这里是elasticsearch的地址
es_host: 192.168.85.10

# (Optional)
# Elasticsearch port
    ##这里是elasticsearch的端口
es_port: 9200

# (OptionaL) Connect with SSL to Elasticsearch
    ##这里是设置开启ssl，注释掉，我们没有开启
#use_ssl: True

# (Optional) basic-auth username and password for Elasticsearch
    ##elasticsearch的认证账户密码，正确填写
es_username: elastic
es_password: elastic

# (Required)
# Rule name, must be unique
    ##这里是我们发送的消息的标题
name: 发送消息

# (Required)
# Type of alert.
# the frequency rule type alerts when num_events events occur with timeframe time
    ##这里是规则类型，frequency是根据我们设定的频率匹配，后面设定；
    ##详细参考：https://elastalert.readthedocs.io/en/latest/ruletypes.html#ruletypes
type: frequency

# (Required)
# Index to search, wildcard supported
    ##这里是我们要匹配的索引，可以用 * 来匹配
index: nginx*

# (Required, frequency specific)
# Alert when this many documents matching the query occur within a timeframe
    ##这里设置在我们规定的时间内出现了多少频次可匹配到的规则就需要进行报警
num_events: 1

# (Required, frequency specific)
# num_events must occur within this amount of time to trigger an alert
    ##这里接上面，规定的时间，单位有hours、minutes、seconds（时、分、秒）
timeframe:
  minutes: 1

# (Required)
# A list of Elasticsearch filters used for find events
# These filters are joined with AND and nested in a filtered query
# For more info: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl.html
    ##这里是我们重点，匹配的规则，翻译为过滤器，我们暂时设定匹配ERROR的message消息来进行测试
    ##详情参考：https://elastalert.readthedocs.io/en/latest/recipes/writing_filters.html#writingfilters
filter:
- query:
    query_string:
      query: "message: ERROR"

# (Required)
# The alert is use when a match is found
    ##这里是加载模块，注意！暂时我们要写这个样子，有的帖子只写dingtalk的，甚至插件的github页面也是这么写，可能仅代表标签，只写dingtalk写会报错
alert:
- "elastalert_modules.dingtalk_alert.DingTalkAlerter"

    ##下面是我们钉钉机器人的地址，和文档类型
dingtalk_webhook: "https://oapi.dingtalk.com/robot/send?access_token=************************************"
dingtalk_msgtype: text

    ##这下面是邮箱发送的一些配置，我们本次不使用邮箱，所以把他注释上
    ##比如我使用163邮箱发送，这个需要开通smtp服务
#smtp_host: smtp.163.com
    ##这个端口是非ssl的，若你开了ssl需要更换，163、qq的都不一样，网上可以查到
#smtp_port: 25
    ##这个是用来发送的邮箱的账号和认证密码存放文件的绝对路径，在
#smtp_auth_file: /root/elastalert/example_rules/testauth.yaml
    ##用来接收邮件的邮箱地址
#email_reply_to: *****@qq.com
    ##用来发送邮件的邮箱地址
#from_addr: *****@163.com

# (required, email specific)
# a list of email addresses to send alerts to
# email:
# - "elastalert@example.com"

[root@localhost example_rules]# vim testauth.yaml

    ##用来发邮件的邮箱地址
user: ***********@163.com
    ##这个密码是你开通smtp功能后官方给你的密码，是一串字母，可不是你自己设定的邮箱密码
password: sdgkljsklgslvgb

[root@localhost elastalert]# python3 -m elastalert.elastalert --verbose --config ./config.yaml --rule ./example_rules/syslog10.yaml 
1 rules loaded
INFO:elastalert:Starting up
INFO:elastalert:Disabled rules are: []
INFO:elastalert:Sleeping for 59.999936 seconds
INFO:elastalert:Queried rule 发送消息 from 2021-04-10 12:38 CST to 2021-04-10 12:41 CST: 0 / 0 hits
INFO:elastalert:Ran 发送消息 from 2021-04-10 12:38 CST to 2021-04-10 12:41 CST: 0 query hits (0 already seen), 0 matches, 0 alerts sent
INFO:elastalert:Background configuration change check run at 2021-04-10 12:42 CST
INFO:elastalert:Disabled rules are: []
INFO:elastalert:Sleeping for 59.999764 seconds
INFO:elastalert:Background alerts thread 0 pending alerts sent at 2021-04-10 12:42 CST
INFO:elastalert:Queried rule 发送消息 from 2021-04-10 12:38 CST to 2021-04-10 12:42 CST: 72 / 72 hits
INFO:elastalert:Ignoring match for silenced rule 发送消息
INFO:elastalert:Ignoring match for silenced rule 发送消息
INFO:elastalert:Ignoring match for silenced rule 发送消息
INFO:elastalert:Ignoring match for silenced rule 发送消息
    ......
    ......

    ##需要使用相对路径，绝对路径会报错，所以要先进入文件目录；
[root@localhost ~]# cd /root/elastalert
    ##将其放入后台
[root@localhost elastalert]# nohup python3 -m elastalert.elastalert --verbose --config ./config.yaml --rule ./example_rules/syslog10.yaml &

    ##如果有很多配置文件，那么把可以用的放到我们配置的规则文件目录下（配置不正确的规则文件会导致报错，要移出规目录），然后就不用指定参数 --rule 了，同理 --config 的参数也不是必须的，但是切到目录下是必须的
[root@localhost elastalert]# nohup python3 -m elastalert.elastalert --verbose

    ##找不到模块，下面两种都可能出现，那么我们安装相应模块即可，但是一般正确安装了elastalert和dingtalk插件的基本不会提示；
    ##但也有特殊情况，我们的安装主要以python36为主，因为我们运行需要它，常用 pip3 来确定自己是不是真的没有安装包，还是只是它找不到路径

  File "/root/elastalert/elastalert/elastalert.py", line 21, in <module>
    import pytz
ImportError: No module named pytz

ModuleNotFoundError: No module named ‘deeptools‘

    ##语法错误其实是因为你自己的配置和使用的python和pip的版本问题，本身程序的代码没有问题，但是当python3的代码放到python2中那么就是语法错误，反之一样，这里展示的是我配置文件指向错误；
    ##你可能还会遇到一个问题，就是提示你a sync= False ，这个也是python3和2的使用错误，用3就会报错，这个是安装时候的提示，那么你直接用python，或python2.7就安装成功了

    raise EAException("Error querying for dashboard: %s" % (e)), None, sys.exc_info()[2]
                                                               ^
SyntaxError: invalid syntax

    ##仔细看里面： elastalert_modules.dingtalk_alert.DingTalkAlerter 找不到，之前说了，规则文件里面 alert 一定写对，而且 elastalert_modules 一定要复制到 elastalert 目录下

  File "/root/elastalert/elastalert/loaders.py", line 126, in load
    raise EAException(‘Error loading file %s: %s‘ % (rule_file, e))
elastalert.util.EAException: Error loading file ./example_rules/syslog200.yaml: Error initia
ting alert [‘elastalert_modules.dingtalk_alert.DingTalkAlerter‘]: Could not import module el
astalert_modules.dingtalk_alert.DingTalkAlerter: No module named ‘elastalert_modules‘

[root@VM_0_7_centos elasticsearch]# pwd
/etc/elasticsearch
[root@VM_0_7_centos elasticsearch]# ll
total 76
-rw------- 1 elasticsearch root           3443 Apr  6 10:51 elastic-certificates.p12
-rw-rw---- 1 root          elasticsearch   199 Mar 29 18:04 elasticsearch.keystore
-rw-rw---- 1 root          elasticsearch  3545 Apr  6 09:14 elasticsearch.yml
-rw------- 1 elasticsearch root           2527 Apr  6 10:51 elastic-stack-ca.p12
-rw-r--r-- 1 elasticsearch root           3451 Apr  6 11:01 http.p12
-rw-rw---- 1 root          elasticsearch  3182 Mar  6 14:03 jvm.options
drwxr-s--- 2 root          elasticsearch  4096 Mar  6 14:06 jvm.options.d
-rw-r--r-- 1 root          elasticsearch  1397 Apr  6 11:36 kibana-ca.crt
-rw-rw---- 1 root          elasticsearch 18612 Mar  6 14:03 log4j2.properties
-rw-r--r-- 1 root          root           1306 Apr  6 11:01 README.txt
-rw-rw---- 1 root          elasticsearch   473 Mar  6 14:03 role_mapping.yml
-rw-rw---- 1 root          elasticsearch   197 Mar  6 14:03 roles.yml
-rw-r--r-- 1 root          root            658 Apr  6 11:01 sample-elasticsearch.yml
-rw-r--r-- 1 root          root           1057 Apr  6 11:01 sample-kibana.yml
-rw-rw---- 1 root          elasticsearch     0 Mar  6 14:03 users
-rw-rw---- 1 root          elasticsearch     0 Mar  6 14:03 users_roles

[root@VM_0_7_centos elasticsearch]# cd /etc/kibana/
[root@VM_0_7_centos kibana]# ll
total 20
-rw-r--r-- 1 kibana root   1200 Apr  6 11:08 elasticsearch-ca.pem
-rw-rw---- 1 root   kibana 5466 Apr  6 11:53 kibana.yml
-rw-r--r-- 1 root   kibana  216 Mar  6 13:11 node.options

[root@localhost ~]# /usr/share/elasticsearch/bin/elasticsearch-certutil ca
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.
　　......
　　......

be a zip file containing individual files for the CA certificate and private key

Please enter the desired output file [elastic-stack-ca.p12]:  默认即可，直接回车确定
Enter password for elastic-stack-ca.p12 : 可自行设定密码，不设定直接回车也可以

    ##查看生成文件
[root@localhost ~]# ls -l /usr/share/elasticsearch/elastic-stack-ca.p12 
-rw------- 1 root root 2527 Apr  5 13:38 /usr/share/elasticsearch/elastic-stack-ca.p12

[root@localhost ~]# /usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca /usr/share/elasticsearch/elastic-stack-ca.p12
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.
　　......
　　......

    * -keep-ca-key (retain generated CA key)
    * -multiple (generate multiple certificates)
    * -in (generate certificates from an input file)
then the output will be be a zip file containing individual certificate/key files

Enter password for CA (/usr/share/elasticsearch/elastic-stack-ca.p12) :  指定好的文件，直接回车即可
Please enter the desired output file [elastic-certificates.p12]:  直接回车
Enter password for elastic-certificates.p12 :  直接回车

Certificates written to /usr/share/elasticsearch/elastic-certificates.p12

　　......
　　......

configure the client to trust this certificate.

    ##查看生成的文件
[root@localhost ~]# ls -l /usr/share/elasticsearch/elastic-certificates.p12 
-rw------- 1 root root 3451 Apr  5 13:41 /usr/share/elasticsearch/elastic-certificates.p12

[root@localhost ~]# /usr/share/elasticsearch/bin/elasticsearch-certutil http

## Elasticsearch HTTP Certificate Utility

The ‘http‘ command guides you through the process of generating certificates
　　......
　　......
configure all your clients to trust that custom CA.

Generate a CSR? [y/N] n 输入n，选否

## Do you have an existing Certificate Authority (CA) key-pair that you wish to use to sign your certificate?

If you have an existing CA certificate and key, then you can use that CA to
sign your new http certificate. This allows you to use the same CA across
multiple Elasticsearch clusters which can make it easier to configure clients,
and may be easier for you to manage.

If you do not have an existing CA, one will be generated for you.

Use an existing CA? [y/N] y 输入y，选是

## What is the path to your CA?

Please enter the full pathname to the Certificate Authority that you wish to
use for signing your new http certificate. This can be in PKCS#12 (.p12), JKS
(.jks) or PEM (.crt, .key, .pem) format.
CA Path: /usr/share/elasticsearch/elastic-stack-ca.p12  这个是我们之前生成的文件
Reading a PKCS12 keystore requires a password.
It is possible for the keystore‘s password to be blank,
in which case you can simply press <ENTER> at the prompt
Password for elastic-stack-ca.p12: 直接回车

## How long should your certificates be valid?

Every certificate has an expiry date. When the expiry date is reached clients
will stop trusting your certificate and TLS connections will fail.

Best practice suggests that you should either:
(a) set this to a short duration (90 - 120 days) and have automatic processes
to generate a new certificate before the old one expires, or
(b) set it to a longer duration (3 - 5 years) and then perform a manual update
a few months before it expires.

You may enter the validity period in years (e.g. 3Y), months (e.g. 18M), or days (e.g. 90D)

For how long should your certificate be valid? [5y]  这里是有效时间，Y是年，M是月，D是天，根据实际情况写，默认5Y，我直接回车了

## Do you wish to generate one certificate per node?

If you have multiple nodes in your cluster, then you may choose to generate a
separate certificate for each of these nodes. Each certificate will have its
own private key, and will be issued for a specific hostname or IP address.

Alternatively, you may wish to generate a single certificate that is valid
across all the hostnames or addresses in your cluster.

If all of your nodes will be accessed through a single domain
(e.g. node01.es.example.com, node02.es.example.com, etc) then you may find it
simpler to generate one certificate with a wildcard hostname (*.es.example.com)
and use that across all of your nodes.

However, if you do not have a common domain name, and you expect to add
additional nodes to your cluster in the future, then you should generate a
certificate per node so that you can more easily generate new certificates when
you provision new nodes.

Generate a certificate per node? [y/N] n 这里我选择不为每个节点设置，因为我是单机配置，若是集群，需要每个去配置，然后分发文件

## Which hostnames will be used to connect to your nodes?

These hostnames will be added as "DNS" names in the "Subject Alternative Name"
(SAN) field in your certificate.

You should list every hostname and variant that people will use to connect to
your cluster over http.
Do not list IP addresses here, you will be asked to enter them later.

If you wish to use a wildcard certificate (for example *.es.example.com) you
can enter that here.

Enter all the hostnames that you need, one per line.
When you are done, press <ENTER> once more to move on to the next step.
这里提示我直接回车，不填写主机的hostname，因为我是单机

You did not enter any hostnames.
Clients are likely to encounter TLS hostname verification errors if they
connect to your cluster using a DNS name.

Is this correct [Y/n]y 是否使用当前配置，选择y是

## Which IP addresses will be used to connect to your nodes?

If your clients will ever connect to your nodes by numeric IP address, then you
can list these as valid IP "Subject Alternative Name" (SAN) fields in your
certificate.

If you do not have fixed IP addresses, or not wish to support direct IP access
to your cluster then you can just press <ENTER> to skip this step.

Enter all the IP addresses that you need, one per line.
When you are done, press <ENTER> once more to move on to the next step.

192.168.85.10 这里输入本机的IP地址，回车一次，输入一条，然后再点回车确定即可

You entered the following IP addresses.

 - 192.168.85.10

Is this correct [Y/n]y 是否使用当前配置，选择y是

## Other certificate options

The generated certificate will have the following additional configuration
values. These values have been selected based on a combination of the
information you have provided above and secure defaults. You should not need to
change these values unless you have specific requirements.

Key Name: elasticsearch
Subject DN: CN=elasticsearch
Key Size: 2048

Do you wish to change any of these options? [y/N]n 是否要修改之前的选择，选n否，我们配置没有问题就可以

## What password do you want for your private key(s)?

Your private key(s) will be stored in a PKCS#12 keystore file named "http.p12".
This type of keystore is always password protected, but it is possible to use a
blank password.

If you wish to use a blank password, simply press <enter> at the prompt below.
Provide a password for the "http.p12" file:  [<ENTER> for none]
根据提示，回车就可以了，我们的配置已经完成，之后只是提示和生成文件了

## Where should we save the generated files?

A number of files will be generated including your private key(s),
public certificate(s), and sample configuration options for Elastic Stack products.

These files will be included in a single zip archive.

What filename should be used for the output zip file? [/usr/share/elasticsearch/elasticsearch-ssl-http.zip] 

Zip file written to /usr/share/elasticsearch/elasticsearch-ssl-http.zip

    ##生成的文件是zip格式的，若没有unzip，请yum install -y unzip
[root@localhost ~]# unzip /usr/share/elasticsearch/elasticsearch-ssl-http.zip -d /root
Archive:  /usr/share/elasticsearch/elasticsearch-ssl-http.zip
   creating: /root/elasticsearch/
  inflating: /root/elasticsearch/README.txt  
  inflating: /root/elasticsearch/http.p12  
  inflating: /root/elasticsearch/sample-elasticsearch.yml  
   creating: /root/kibana/
  inflating: /root/kibana/README.txt  
  inflating: /root/kibana/elasticsearch-ca.pem  
  inflating: /root/kibana/sample-kibana.yml

[root@localhost ~]# vim /etc/elasticsearch/elasticsearch.yml

    ##在最后面添加即可，文件的path是相对路径，是放到了/etc/elasticsearch下才可行
 92 xpack.security.transport.ssl.verification_mode: certificate
 93 xpack.security.transport.ssl.client_authentication: required
 94 xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
 95 xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
 96 xpack.security.http.ssl.enabled: true
 97 xpack.security.http.ssl.keystore.path: http.p12

[root@localhost ~]# vim /etc/kibana/kibana.yml

    ##开启了SSL，所以elasticsearch的访问地址已经变成了https了
 32 elasticsearch.hosts: ["https://192.168.85.10:9200"]

    ##下面直接添加一个elasticsearch的ca证书，指向文件位置
 34 elasticsearch.ssl.certificateAuthorities: [ "/etc/kibana/elasticsearch-ca.pem" ]

    ##直接在结尾添加就可以，字符串是随机自定义的就可以，至少32位，下面是kibana的会话超时时间和生命周期
118 xpack.encryptedSavedObjects.encryptionKey: ‘afdjlk_@rsedfdgnfkl_asd_flkfjselj_faelikj@##‘
119 xpack.security.session.idleTimeout: "1h"
120 xpack.security.session.lifespan: "30d"

[root@postgreSQL ~]# vim /etc/filebeat/filebeat.yml
    ##Elasticsearch Output部分的hosts给地址加上https://即可
  hosts: ["https://192.168.85.10:9200"]

    ##文件是来自elasticsearch的主机的CA证书，权限root即可
  ssl.certificate_authorities: ["/etc/filebeat/elasticsearch-ca.pem"]

[root@postgreSQL ~]# vim /etc/filebeat/filebeat.yml
    ##在Elasticsearch Output部分添加这两行，使用https
  protocol: "https"
  ssl.verification_mode: none

    ##之后重启服务
[root@postgreSQL ~]# systemctl restart filebeat

    ##首先需要CA证书，这里仿照Kibana的方法可以生成p12文件
[root@localhost ~]# /usr/share/elasticsearch/bin/elasticsearch-certutil cert -ca /etc/elasticsearch/elastic-stack-ca.p12 -name logstash-client
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.
　　......
　　......

    * -multiple (generate multiple certificates)
    * -in (generate certificates from an input file)
then the output will be be a zip file containing individual certificate/key files

Enter password for CA (/etc/elasticsearch/elastic-stack-ca.p12) :  直接回车
Please enter the desired output file [logstash-client.p12]:  还是回车
Enter password for logstash-client.p12 :  依旧回车

　　......
　　......

configure the client to trust this certificate.

    ##根据生成的p12文件，生成我们需要的CA证书
[root@localhost ~]# openssl pkcs12 -in /usr/share/elasticsearch/logstash-client.p12  -cacerts -nokeys -out logstash-ca.crt
Enter Import Password:
MAC verified OK

    ##之后文件放入logstash的配置文件目录，权限原来的root即可，不用修改
[root@localhost ~]# mv logstash-ca.crt /etc/logstash/

[root@localhost ~]# vim /etc/logstash/conf.d/logstash.conf
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["https://192.168.180.200:9200"]
    ##开启ssl
    ssl => true
    ##指定刚才我们生成的CA证书文件
    cacert => "/etc/logstash/logstash-ca.crt"
    index => "%{[fields][index]}-%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    user => "elastic"
    password => "elastic"
  }
}