2：ELK分析syslog日志

三、ELK分析syslog

1、配置FIlebeat搜集syslog并发送至

#配置
mv /etc/filebeat/filebeat.yml  /etc/filebeat/filebeat.yml.bak
vim /etc/filebeat/filebeat.yml
filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - /var/log/messages
  fields：
    log_topics: syslog-1.202
  max_bytes: 1048576

output.logstash:
  hosts: ["127.0.0.1:5044"]

#启动
systemctl start filebeat

 

2、配置Logstash从FIlebeat输入syslog日志并输出至Elasticsearch

#配置从beat 5044端口接收日志，且根据fields建立日志索引
vim /etc/logstash/conf.d/syslog.conf
input {
   beats {
    port => 5044
  }
}

output {
 if[fields][log_topics] == "syslog-1.202" {
  elasticsearch {
    hosts => ["192.168.1.202:9200"]
    index => "syslog-1.202-%{+YYYY.MM}"
  }
 }
}

#启动服务
systemctl start logstash

 

 3、Troubleshooting

#日志排查
tailf /var/log/logstash/logstash-plain.log   
tailf /var/log/filebeat/filebeat    

#配置文件语法合规性排查
/usr/share/logstash/bin/logstash --path.settings /etc/logstash -f /etc/logstash/conf.d/syslog.conf --config.test_and_exit
/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml  

 

4、ElasticSearch查看索引

#查看索引
curl http://192.168.1.202:9200/_cat/indices?v   
health status index                uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   .kibana              sdsMVkoKQZaZncZf6OXEeg   1   0          1            0      3.7kb          3.7kb
yellow open   syslog-1.202-2018.03 0JDgsgabR16EozrEhVHosA   5   1          4            0     31.5kb         31.5kb

#清空无用索引
curl -XDELETE http://192.168.1.202:9200/+索引名         

 

5、 Kibana创建索引

6、坑

（1）：filebeat无法写入Logstash

2018-03-29T11:05:12.521+0800	ERROR	pipeline/output.go:92	Failed to publish events: write tcp 127.0.0.1:59954->127.0.0.1:5044: write: connection reset by peer