graylog日志平台搭建 (五) 部署graylog集群

五、部署graylog集群

1、安裝啟動

 

導入 rpm 包
rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-4.0-repository_latest.rpm

安裝
yum install graylog-server -y

啟動並加入開機啟動
systemctl enable graylog-server
systemctl start graylog-server

 

2、生成密鑰

生成兩個秘鑰，分別用於配置文件中的root_password_sha2和password_secret

# echo -n "Enter Password: " && head -1 </dev/stdin | tr -d '\n' | sha256sum | cut -d" " -f1
# pwgen -N -1 -s 40 1 #這個命令要是沒有，百度上搜索源碼下載編譯安裝一下

3、修改配置文件

# vim /etc/graylog/server/server.conf
is_master = false  #是否是主節點，如果是主節點，則設置為true, 集群中只有一個主節點
node_id_file = /etc/graylog/server/node-id
password_secret = iMh21uM57Pt2nMHDicInjPvnE8o894AIs7rJj9SW  #將上面生成的秘鑰配置到這里
plugin_dir = /usr/share/graylog-server/plugin
http_bind_address = 0.0.0.0:9000
http_publish_uri = http://192.168.1.10:9000/
web_enable = true
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
retention_strategy = delete
elasticsearch_shards = 2
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
allow_leading_wildcard_searches = false
allow_highlighting = false
elasticsearch_analyzer = standard
output_batch_size = 5000
output_flush_interval = 120
output_fault_count_threshold = 8
output_fault_penalty_seconds = 120
processbuffer_processors = 20
outputbuffer_processors = 40
processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://graylog:Graylog_123454@192.168.1.10:27017,192.168.1.11:27017,192.168.1.12:27017/graylog?replicaSet=graylog-rs
mongodb_max_connections = 1000
mongodb_threads_allowed_to_block_multiplier = 5
content_packs_dir = /usr/share/graylog-server/contentpacks
content_packs_auto_load = grok-patterns.json
proxied_requests_thread_pool_size = 32
elasticsearch_hosts = http://192.168.1.10:9200,http://192.168.1.11:9200,http://192.168.1.12:9200
elasticsearch_discovery_enabled = true

在這里要注意 mongodb 和 es 的連接方式，我這里全都是部署的集群，所以寫的是集群的連接方式，如果你是單機可以這么寫

mongodb_uri = mongodb://graylog:Graylog_123456@192.168.1.10:27017/graylog
elasticsearch_hosts = http://192.168.1.10:9200

到這里部署工作就結束了，下面是在 graylog 控制台上進行配置下，但是首先得把 graylog 給代理出來，可以通過 nginx 進行代理，nginx 配置文件參考：

 

upstream graylog {
        server 192.168.1.10:9000;
        server 192.168.1.11:9000;
        server 192.168.1.12:9000;
    }


server {
        listen  80;
        server_name  自定義域名；
        location / {
            proxy_set_header Host $http_host;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Server $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Graylog-Server-URL http://$host/;
            proxy_pass http://graylog;
        }
  }

完事后，重啟下 nginx,瀏覽器上訪問即可，用戶名是 admin，密碼是之前使用 sha25 加密方式創建的密碼

 

到此graylog集群已經部署完成了