graylog日志平台搭建 (五) 部署graylog集群

五、部署graylog集群

1、安装启动

 

导入 rpm 包
rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-4.0-repository_latest.rpm

安装
yum install graylog-server -y

启动并加入开机启动
systemctl enable graylog-server
systemctl start graylog-server

 

2、生成密钥

生成两个秘钥，分别用于配置文件中的root_password_sha2和password_secret

# echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1
# pwgen -N -1 -s 40 1 #这个命令要是没有，百度上搜索源码下载编译安装一下

3、修改配置文件

# vim /etc/graylog/server/server.conf
is_master = false  #是否是主节点，如果是主节点，则设置为true, 集群中只有一个主节点
node_id_file = /etc/graylog/server/node-id
password_secret = iMh21uM57Pt2nMHDicInjPvnE8o894AIs7rJj9SW  #将上面生成的秘钥配置到这里
plugin_dir = /usr/share/graylog-server/plugin
http_bind_address = 0.0.0.0:9000
http_publish_uri = http://192.168.1.10:9000/
web_enable = true
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
retention_strategy = delete
elasticsearch_shards = 2
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
allow_leading_wildcard_searches = false
allow_highlighting = false
elasticsearch_analyzer = standard
output_batch_size = 5000
output_flush_interval = 120
output_fault_count_threshold = 8
output_fault_penalty_seconds = 120
processbuffer_processors = 20
outputbuffer_processors = 40
processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://graylog:Graylog_123454@192.168.1.10:27017,192.168.1.11:27017,192.168.1.12:27017/graylog?replicaSet=graylog-rs
mongodb_max_connections = 1000
mongodb_threads_allowed_to_block_multiplier = 5
content_packs_dir = /usr/share/graylog-server/contentpacks
content_packs_auto_load = grok-patterns.json
proxied_requests_thread_pool_size = 32
elasticsearch_hosts = http://192.168.1.10:9200,http://192.168.1.11:9200,http://192.168.1.12:9200
elasticsearch_discovery_enabled = true

在这里要注意 mongodb 和 es 的连接方式，我这里全都是部署的集群，所以写的是集群的连接方式，如果你是单机可以这么写

mongodb_uri = mongodb://graylog:Graylog_123456@192.168.1.10:27017/graylog
elasticsearch_hosts = http://192.168.1.10:9200

到这里部署工作就结束了，下面是在 graylog 控制台上进行配置下，但是首先得把 graylog 给代理出来，可以通过 nginx 进行代理，nginx 配置文件参考：

 

upstream graylog {
        server 192.168.1.10:9000;
        server 192.168.1.11:9000;
        server 192.168.1.12:9000;
    }


server {
        listen  80;
        server_name  自定义域名；
        location / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Server $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Graylog-Server-URL http://$host/;
            proxy_pass http://graylog;
        }
  }

完事后，重启下 nginx,浏览器上访问即可，用户名是 admin，密码是之前使用 sha25 加密方式创建的密码

 

到此graylog集群已经部署完成了