ELK 8.2.1 설치 구성 (config 포함)

1. master node, data node, data node install

 

2. .yam elastic,kibana 구성 변경

 

3. useradd elastic, kibanaadmin

 

4. chown -R elastic, kibanaadmin // 폴더 전부 권한 변경

 

5. elastic node별

 

ulimit -n 65536

vi /etc/sysctl.conf

vm.max_map_count=262144

sysctl -p

 

6. master node

./bin/elasticsearch-certutil ca

./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12

Enter password for CA (elastic-stack-ca.p12) :

Please enter the desired output file [elastic-certificates.p12]:elastic-certificates.p12

Enter password for elastic-certificates.p12 :

 

생성된 elastic-certificates.p12 파일을 모든 노드의 $ES_PATH_CONF (ex. /usr/share/elasticsearch/config) 폴더로 복사 한다.

 

xpack.security.transport.ssl.enabled: true

xpack.security.transport.ssl.verification_mode: certificate

xpack.security.transport.ssl.client_authentication: required

xpack.security.transport.ssl.keystore.path: elastic-certificates.p12

xpack.security.transport.ssl.truststore.path: elastic-certificates.p12

 

노드

elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password

elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password

 

7. kibana 셋팅

elasticsearch-service-tokens create elastic/kibana devdashboard

SERVICE_TOKEN elastic/kibana/devdashboard = AAEAAWVsYXN0aWMva2liYW5hL2RldmRhc2hib2FyZDpnUkVvcjRxUVJaYVMwUnprYmllLW5B

 

추가

elasticsearch.serviceAccountToken: AAEAAWVsYXN0aWMva2liYW5hL2RldmRhc2hib2FyZDpnUkVvcjRxUVJaYVMwUnprYmllLW5B

 

 

 

 

 

 

================================================================================================

Elasticsearch.yml

 

# ======================== Elasticsearch Configuration =========================

#

# NOTE: Elasticsearch comes with reasonable defaults for most settings.

#       Before you set out to tweak and tune the configuration, make sure you

#       understand what are you trying to accomplish and the consequences.

#

# The primary way of configuring a node is via this file. This template lists

# the most important settings you may want to configure for a production cluster.

#

# Please consult the documentation for further information on configuration options:

# https://www.elastic.co/guide/en/elasticsearch/reference/index.html

#

# ---------------------------------- Cluster -----------------------------------

#

# Use a descriptive name for your cluster:

#

cluster.name: elk-cluster

#

# ------------------------------------ Node ------------------------------------

#

# Use a descriptive name for the node:

#

node.name: master1

node.roles: [ master,remote_cluster_client ]

#

# Add custom attributes to the node:

#

#node.attr.rack: r1

#

# ----------------------------------- Paths ------------------------------------

#

# Path to directory where to store the data (separate multiple locations by comma):

#

#path.data: /var/lib/elasticsearch

#

# Path to log files:

#

#path.logs: /var/log/elasticsearch

#

# ----------------------------------- Memory -----------------------------------

#

# Lock the memory on startup:

#

#bootstrap.memory_lock: true

#

# Make sure that the heap size is set to about half the memory available

# on the system and that the owner of the process is allowed to use this

# limit.

#

# Elasticsearch performs poorly when the system is swapping the memory.

#

# ---------------------------------- Network -----------------------------------

#

# By default Elasticsearch is only accessible on localhost. Set a different

# address here to expose this node on the network:

#

network.host: [_local_,_site_]

#

# By default Elasticsearch listens for HTTP traffic on the first free port it

# finds starting at 9200. Set a specific HTTP port here:

#

#http.port: 9200

#

# For more information, consult the network module documentation.

#

# --------------------------------- Discovery ----------------------------------

#

# Pass an initial list of hosts to perform discovery when this node is started:

# The default list of hosts is ["127.0.0.1", "[::1]"]

#

discovery.seed_hosts: ["192.168.122.139", "192.168.122.152", "192.168.122.153"]

#

# Bootstrap the cluster using an initial set of master-eligible nodes:

#

#cluster.initial_master_nodes: ["master1"]

#

# For more information, consult the discovery and cluster formation module documentation.

#

# --------------------------------- Readiness ----------------------------------

#

# Enable an unauthenticated TCP readiness endpoint on localhost

#

#readiness.port: 9399

#

# ---------------------------------- Various -----------------------------------

#

# Allow wildcard deletion of indices:

#

#action.destructive_requires_name: false

 

#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------

#

# The following settings, TLS certificates, and keys have been automatically     

# generated to configure Elasticsearch security features on 24-05-2022 01:43:35

#

# --------------------------------------------------------------------------------

 

# Enable security features

xpack.security.enabled: true

 

xpack.security.enrollment.enabled: true

 

# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents

xpack.security.http.ssl:

  enabled: true

  keystore.path: certs/http.p12

 

# Enable encryption and mutual authentication between cluster nodes

xpack.security.transport.ssl:

  enabled: true

  verification_mode: certificate

  keystore.path: certs/elastic-certificates.p12

  truststore.path: certs/elastic-certificates.p12

# Create a new cluster with the current node only

# Additional nodes can still join the cluster later

cluster.initial_master_nodes: ["master1"]

 

# Allow HTTP API connections from anywhere

# Connections are encrypted and require user authentication

http.host: 0.0.0.0

 

# Allow other nodes to join the cluster from anywhere

# Connections are encrypted and mutually authenticated

transport.host: 0.0.0.0

 

#----------------------- END SECURITY AUTO CONFIGURATION -------------------------

 

 

 

==========================================================================================

Kibana.yml

 

### >>>>>>> BACKUP START: Kibana interactive setup (2022-05-24T01:55:03.618Z)

 

# For more configuration options see the configuration guide for Kibana in

# https://www.elastic.co/guide/index.html

 

# =================== System: Kibana Server ===================

# Kibana is served by a back end server. This setting specifies the port to use.

#server.port: 5601

 

# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.

# The default is 'localhost', which usually means remote machines will not be able to connect.

# To allow connections from remote users, set this parameter to a non-loopback address.

#server.host: "0.0.0.0"

 

# Enables you to specify a path to mount Kibana at if you are running behind a proxy.

# Use the `server.rewriteBasePath` setting to tell Kibana if it should remove the basePath

# from requests it receives, and to prevent a deprecation warning at startup.

# This setting cannot end in a slash.

#server.basePath: ""

 

# Specifies whether Kibana should rewrite requests that are prefixed with

# `server.basePath` or require that they are rewritten by your reverse proxy.

# Defaults to `false`.

#server.rewriteBasePath: false

 

# Specifies the public URL at which Kibana is available for end users. If

# `server.basePath` is configured this URL should end with the same basePath.

#server.publicBaseUrl: ""

 

# The maximum payload size in bytes for incoming server requests.

#server.maxPayload: 1048576

 

# The Kibana server's name. This is used for display purposes.

#server.name: "kibana"

 

# =================== System: Kibana Server (Optional) ===================

# Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.

# These settings enable SSL for outgoing requests from the Kibana server to the browser.

#server.ssl.enabled: false

#server.ssl.certificate: /path/to/your/server.crt

#server.ssl.key: /path/to/your/server.key

 

# =================== System: Elasticsearch ===================

# The URLs of the Elasticsearch instances to use for all your queries.

#elasticsearch.hosts: ["http://localhost:9200"]

 

# If your Elasticsearch is protected with basic authentication, these settings provide

# the username and password that the Kibana server uses to perform maintenance on the Kibana

# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which

# is proxied through the Kibana server.

#elasticsearch.username: "elastic"

#elasticsearch.password: "dpebzh13"

 

# Kibana can also authenticate to Elasticsearch via "service account tokens".

# Service account tokens are Bearer style tokens that replace the traditional username/password based configuration.

# Use this token instead of a username/password.

#elasticsearch.serviceAccountToken: "devdashboard"

 

# Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of

# the elasticsearch.requestTimeout setting.

#elasticsearch.pingTimeout: 1500

 

# Time in milliseconds to wait for responses from the back end or Elasticsearch. This value

# must be a positive integer.

#elasticsearch.requestTimeout: 30000

 

# The maximum number of sockets that can be used for communications with elasticsearch.

# Defaults to `Infinity`.

#elasticsearch.maxSockets: 1024

 

# Specifies whether Kibana should use compression for communications with elasticsearch

# Defaults to `false`.

#elasticsearch.compression: false

 

# List of Kibana client-side headers to send to Elasticsearch. To send *no* client-side

# headers, set this value to [] (an empty list).

#elasticsearch.requestHeadersWhitelist: [ authorization ]

 

# Header names and values that are sent to Elasticsearch. Any custom headers cannot be overwritten

# by client-side headers, regardless of the elasticsearch.requestHeadersWhitelist configuration.

#elasticsearch.customHeaders: {}

 

# Time in milliseconds for Elasticsearch to wait for responses from shards. Set to 0 to disable.

#elasticsearch.shardTimeout: 30000

 

# =================== System: Elasticsearch (Optional) ===================

# These files are used to verify the identity of Kibana to Elasticsearch and are required when

# xpack.security.http.ssl.client_authentication in Elasticsearch is set to required.

#elasticsearch.ssl.certificate: /path/to/your/client.crt

#elasticsearch.ssl.key: /path/to/your/client.key

 

# Enables you to specify a path to the PEM file for the certificate

# authority for your Elasticsearch instance.

#elasticsearch.ssl.certificateAuthorities: [ "/path/to/your/CA.pem" ]

 

# To disregard the validity of SSL certificates, change this setting's value to 'none'.

#elasticsearch.ssl.verificationMode: full

 

# =================== System: Logging ===================

# Set the value of this setting to off to suppress all logging output, or to debug to log everything. Defaults to 'info'

#logging.root.level: debug

 

# Enables you to specify a file where Kibana stores log output.

#logging:

#  appenders:

#    file:

#      type: file

#      fileName: /var/log/kibana/kibana.log

#      layout:

#        type: json

#  root:

#    appenders:

#      - default

#      - file

#  layout:

#    type: json

 

# Logs queries sent to Elasticsearch.

#logging.loggers:

#  - name: elasticsearch.query

#    level: debug

 

# Logs http responses.

#logging.loggers:

#  - name: http.server.response

#    level: debug

 

# Logs system usage information.

#logging.loggers:

#  - name: metrics.ops

#    level: debug

 

# =================== System: Other ===================

# The path where Kibana stores persistent data not saved in Elasticsearch. Defaults to data

#path.data: data

 

# Specifies the path where Kibana creates the process ID file.

#pid.file: /run/kibana/kibana.pid

 

# Set the interval in milliseconds to sample system and process performance

# metrics. Minimum is 100ms. Defaults to 5000ms.

#ops.interval: 5000

 

# Specifies locale to be used for all localizable strings, dates and number formats.

# Supported languages are the following: English (default) "en", Chinese "zh-CN", Japanese "ja-JP", French "fr-FR".

#i18n.locale: "en"

 

# =================== Frequently used (Optional)===================

 

# =================== Saved Objects: Migrations ===================

# Saved object migrations run at startup. If you run into migration-related issues, you might need to adjust these settings.

 

# The number of documents migrated at a time.

# If Kibana can't start up or upgrade due to an Elasticsearch `circuit_breaking_exception`,

# use a smaller batchSize value to reduce the memory pressure. Defaults to 1000 objects per batch.

#migrations.batchSize: 1000

 

# The maximum payload size for indexing batches of upgraded saved objects.

# To avoid migrations failing due to a 413 Request Entity Too Large response from Elasticsearch.

# This value should be lower than or equal to your Elasticsearch cluster’s `http.max_content_length`

# configuration option. Default: 100mb

#migrations.maxBatchSizeBytes: 100mb

 

# The number of times to retry temporary migration failures. Increase the setting

# if migrations fail frequently with a message such as `Unable to complete the [...] step after

# 15 attempts, terminating`. Defaults to 15

#migrations.retryAttempts: 15

 

# =================== Search Autocomplete ===================

# Time in milliseconds to wait for autocomplete suggestions from Elasticsearch.

# This value must be a whole number greater than zero. Defaults to 1000ms

#data.autocomplete.valueSuggestions.timeout: 1000

 

# Maximum number of documents loaded by each shard to generate autocomplete suggestions.

# This value must be a whole number greater than zero. Defaults to 100_000

#data.autocomplete.valueSuggestions.terminateAfter: 100000

 

### >>>>>>> BACKUP END: Kibana interactive setup (2022-05-24T01:55:03.618Z)

 

# This section was automatically generated during setup.

server.host: 0.0.0.0

server.name: kibana

elasticsearch.hosts: ['https://192.168.122.139:9200']

logging.appenders.file.type: file

logging.appenders.file.fileName: /var/log/kibana/kibana.log

logging.appenders.file.layout.type: json

logging.root.appenders: [default, file]

pid.file: /run/kibana/kibana.pid

elasticsearch.serviceAccountToken: AAEAAWVsYXN0aWMva2liYW5hL2RldmRhc2hib2FyZDpjU01wdjJxMVMxaTEzV0c3RWtRX3VR

#elasticsearch.serviceAccountToken: AAEAAWVsYXN0aWMva2liYW5hL2Vucm9sbC1wcm9jZXNzLXRva2VuLTE2NTMzNTczMDI5NjI6ak4wNGlpakdSbmF6eTRmWGxBSllEZw

elasticsearch.ssl.certificateAuthorities: [/var/lib/kibana/ca_1653357303609.crt]

xpack.fleet.outputs: [{id: fleet-default-output, name: default, is_default: true, is_default_monitoring: true, type: elasticsearch, hosts: ['https://192.168.122.139:9200'], ca_trusted_fingerprint: e0d98bb0f350e7cabadb42955653520956e514d9b941f290f2e8e26ec60c68dd}]

 

======================================================================================

 

/usr/share/logstash

 

Applog.conf

 

 

input {

  beats {

    port => 5044

    # 인풋으로 beats를 통해 받을때 beats가 설정된 포트 번호 (디폴트가 5044임)

  }

}

 

filter{

  grok{

    match => {

        "message" => "%{NUMBER:number}   %{NUMBER:duration} %{IP:src_ip} → %{IP:desti_ip} %{WORD:protocol}.* %{INT:src_port} → %{INT:desti_port} %{GREEDYDATA:message}"

        # 메세지 내용을 파싱하는 룰입니다. 대부분 GROK 문법을 사용하며 관련된 내용은 자세하게 다시 포스팅 하겠습니다.

     }

  }

}

 

output {

  elasticsearch {

    hosts => ["localhost:9200"]

    index => "applog"

    ssl => true

    ssl_certificate_verification => false

    # 출력으로 나오게될 ElasticSearch의 호스트 명을 적어주면 된다.

    user => "elastic"

    password => "dpebzh13"

  }

}

 

=========================================================================================

 

/usr/share/logstash/config

 

Logstash.yml

 

# Settings file in YAML

#

# Settings can be specified either in hierarchical form, e.g.:

#

#   pipeline:

#     batch:

#       size: 125

#       delay: 5

#

# Or as flat keys:

#

#   pipeline.batch.size: 125

#   pipeline.batch.delay: 5

#

# ------------  Node identity ------------

#

# Use a descriptive name for the node:

#

# node.name: test

#

# If omitted the node name will default to the machine's host name

#

# ------------ Data path ------------------

#

# Which directory should be used by logstash and its plugins

# for any persistent needs. Defaults to LOGSTASH_HOME/data

#

path.data: /var/lib/logstash

#

# ------------ Pipeline Settings --------------

#

# The ID of the pipeline.

#

# pipeline.id: main

#

# Set the number of workers that will, in parallel, execute the filters+outputs

# stage of the pipeline.

#

# This defaults to the number of the host's CPU cores.

#

# pipeline.workers: 2

#

# How many events to retrieve from inputs before sending to filters+workers

#

# pipeline.batch.size: 125

#

# How long to wait in milliseconds while polling for the next event

# before dispatching an undersized batch to filters+outputs

#

# pipeline.batch.delay: 50

#

# Force Logstash to exit during shutdown even if there are still inflight

# events in memory. By default, logstash will refuse to quit until all

# received events have been pushed to the outputs.

#

# WARNING: Enabling this can lead to data loss during shutdown

#

# pipeline.unsafe_shutdown: false

#

# Set the pipeline event ordering. Options are "auto" (the default), "true" or "false".

# "auto" automatically enables ordering if the 'pipeline.workers' setting

# is also set to '1', and disables otherwise.

# "true" enforces ordering on the pipeline and prevent logstash from starting

# if there are multiple workers.

# "false" disables any extra processing necessary for preserving ordering.

#

# pipeline.ordered: auto

#

# Sets the pipeline's default value for `ecs_compatibility`, a setting that is

# available to plugins that implement an ECS Compatibility mode for use with

# the Elastic Common Schema.

# Possible values are:

# - disabled

# - v1

# - v8 (default)

# Pipelines defined before Logstash 8 operated without ECS in mind. To ensure a

# migrated pipeline continues to operate as it did before your upgrade, opt-OUT

# of ECS for the individual pipeline in its `pipelines.yml` definition. Setting

# it here will set the default for _all_ pipelines, including new ones.

#

# pipeline.ecs_compatibility: v8

#

# ------------ Pipeline Configuration Settings --------------

#

# Where to fetch the pipeline configuration for the main pipeline

#

# path.config:

#

# Pipeline configuration string for the main pipeline

#

# config.string:

#

# At startup, test if the configuration is valid and exit (dry run)

#

# config.test_and_exit: false

#

# Periodically check if the configuration has changed and reload the pipeline

# This can also be triggered manually through the SIGHUP signal

#

# config.reload.automatic: false

#

# How often to check if the pipeline configuration has changed (in seconds)

# Note that the unit value (s) is required. Values without a qualifier (e.g. 60)

# are treated as nanoseconds.

# Setting the interval this way is not recommended and might change in later versions.

#

# config.reload.interval: 3s

#

# Show fully compiled configuration as debug log message

# NOTE: --log.level must be 'debug'

#

# config.debug: false

#

# When enabled, process escaped characters such as \n and \" in strings in the

# pipeline configuration files.

#

# config.support_escapes: false

#

# ------------ API Settings -------------

# Define settings related to the HTTP API here.

#

# The HTTP API is enabled by default. It can be disabled, but features that rely

# on it will not work as intended.

#

# api.enabled: true

#

# By default, the HTTP API is not secured and is therefore bound to only the

# host's loopback interface, ensuring that it is not accessible to the rest of

# the network.

# When secured with SSL and Basic Auth, the API is bound to _all_ interfaces

# unless configured otherwise.

#

# api.http.host: 127.0.0.1

#

# The HTTP API web server will listen on an available port from the given range.

# Values can be specified as a single port (e.g., `9600`), or an inclusive range

# of ports (e.g., `9600-9700`).

#

# api.http.port: 9600-9700

#

# The HTTP API includes a customizable "environment" value in its response,

# which can be configured here.

#

# api.environment: "production"

#

# The HTTP API can be secured with SSL (TLS). To do so, you will need to provide

# the path to a password-protected keystore in p12 or jks format, along with credentials.

#

# api.ssl.enabled: false

# api.ssl.keystore.path: /path/to/keystore.jks

# api.ssl.keystore.password: "y0uRp4$$w0rD"

#

# The HTTP API can be configured to require authentication. Acceptable values are

#  - `none`:  no auth is required (default)

#  - `basic`: clients must authenticate with HTTP Basic auth, as configured

#             with `api.auth.basic.*` options below

# api.auth.type: none

#

# When configured with `api.auth.type` `basic`, you must provide the credentials

# that requests will be validated against. Usage of Environment or Keystore

# variable replacements is encouraged (such as the value `"${HTTP_PASS}"`, which

# resolves to the value stored in the keystore's `HTTP_PASS` variable if present

# or the same variable from the environment)

#

# api.auth.basic.username: "logstash-user"

# api.auth.basic.password: "s3cUreP4$$w0rD"

#

# ------------ Module Settings ---------------

# Define modules here.  Modules definitions must be defined as an array.

# The simple way to see this is to prepend each `name` with a `-`, and keep

# all associated variables under the `name` they are associated with, and

# above the next, like this:

#

# modules:

#   - name: MODULE_NAME

#     var.PLUGINTYPE1.PLUGINNAME1.KEY1: VALUE

#     var.PLUGINTYPE1.PLUGINNAME1.KEY2: VALUE

#     var.PLUGINTYPE2.PLUGINNAME1.KEY1: VALUE

#     var.PLUGINTYPE3.PLUGINNAME3.KEY1: VALUE

#

# Module variable names must be in the format of

#

# var.PLUGIN_TYPE.PLUGIN_NAME.KEY

#

# modules:

#

# ------------ Cloud Settings ---------------

# Define Elastic Cloud settings here.

# Format of cloud.id is a base64 value e.g. dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRub3RhcmVhbCRpZGVudGlmaWVy

# and it may have an label prefix e.g. staging:dXMtZ...

# This will overwrite 'var.elasticsearch.hosts' and 'var.kibana.host'

# cloud.id: <identifier>

#

# Format of cloud.auth is: <user>:<pass>

# This is optional

# If supplied this will overwrite 'var.elasticsearch.username' and 'var.elasticsearch.password'

# If supplied this will overwrite 'var.kibana.username' and 'var.kibana.password'

# cloud.auth: elastic:<password>

#

# ------------ Queuing Settings --------------

#

# Internal queuing model, "memory" for legacy in-memory based queuing and

# "persisted" for disk-based acked queueing. Defaults is memory

#

# queue.type: memory

#

# If using queue.type: persisted, the directory path where the data files will be stored.

# Default is path.data/queue

#

# path.queue:

#

# If using queue.type: persisted, the page data files size. The queue data consists of

# append-only data files separated into pages. Default is 64mb

#

# queue.page_capacity: 64mb

#

# If using queue.type: persisted, the maximum number of unread events in the queue.

# Default is 0 (unlimited)

#

# queue.max_events: 0

#

# If using queue.type: persisted, the total capacity of the queue in number of bytes.

# If you would like more unacked events to be buffered in Logstash, you can increase the

# capacity using this setting. Please make sure your disk drive has capacity greater than

# the size specified here. If both max_bytes and max_events are specified, Logstash will pick

# whichever criteria is reached first

# Default is 1024mb or 1gb

#

# queue.max_bytes: 1024mb

#

# If using queue.type: persisted, the maximum number of acked events before forcing a checkpoint

# Default is 1024, 0 for unlimited

#

# queue.checkpoint.acks: 1024

#

# If using queue.type: persisted, the maximum number of written events before forcing a checkpoint

# Default is 1024, 0 for unlimited

#

# queue.checkpoint.writes: 1024

#

# If using queue.type: persisted, the interval in milliseconds when a checkpoint is forced on the head page

# Default is 1000, 0 for no periodic checkpoint.

#

# queue.checkpoint.interval: 1000

#

# ------------ Dead-Letter Queue Settings --------------

# Flag to turn on dead-letter queue.

#

# dead_letter_queue.enable: false

 

# If using dead_letter_queue.enable: true, the maximum size of each dead letter queue. Entries

# will be dropped if they would increase the size of the dead letter queue beyond this setting.

# Default is 1024mb

# dead_letter_queue.max_bytes: 1024mb

 

# If using dead_letter_queue.enable: true, the interval in milliseconds where if no further events eligible for the DLQ

# have been created, a dead letter queue file will be written. A low value here will mean that more, smaller, queue files

# may be written, while a larger value will introduce more latency between items being "written" to the dead letter queue, and

# being available to be read by the dead_letter_queue input when items are are written infrequently.

# Default is 5000.

#

# dead_letter_queue.flush_interval: 5000

 

# If using dead_letter_queue.enable: true, the directory path where the data files will be stored.

# Default is path.data/dead_letter_queue

#

# path.dead_letter_queue:

#

# ------------ Debugging Settings --------------

#

# Options for log.level:

#   * fatal

#   * error

#   * warn

#   * info (default)

#   * debug

#   * trace

#

# log.level: info

path.logs: /var/log/logstash

#

# ------------ Other Settings --------------

#

# Where to find custom plugins

# path.plugins: []

#

# Flag to output log lines of each pipeline in its separate log file. Each log filename contains the pipeline.name

# Default is false

# pipeline.separate_logs: false

#

# ------------ X-Pack Settings (not applicable for OSS build)--------------

#

# X-Pack Monitoring

# https://www.elastic.co/guide/en/logstash/current/monitoring-logstash.html

xpack.monitoring.enabled: false

#xpack.monitoring.elasticsearch.url: ["http://localhost:9200"]

xpack.monitoring.elasticsearch.hosts: [ "http://192.168.122.139:9200" ]

xpack.monitoring.elasticsearch.username: logstash_system

xpack.monitoring.elasticsearch.password: dpebzh13

#xpack.monitoring.elasticsearch.proxy: ["http://proxy:port"]

#xpack.monitoring.elasticsearch.hosts: [ "http://192.168.122.139:9200" ]

# an alternative to hosts + username/password settings is to use cloud_id/cloud_auth

#xpack.monitoring.elasticsearch.cloud_id: monitoring_cluster_id:xxxxxxxxxx

#xpack.monitoring.elasticsearch.cloud_auth: logstash_system:password

# another authentication alternative is to use an Elasticsearch API key

#xpack.monitoring.elasticsearch.api_key: "id:api_key"

#xpack.monitoring.elasticsearch.ssl.certificate_authority: [ "/path/to/ca.crt" ]

#xpack.monitoring.elasticsearch.ssl.truststore.path: path/to/file

#xpack.monitoring.elasticsearch.ssl.truststore.password: password

#xpack.monitoring.elasticsearch.ssl.keystore.path: /path/to/file

#xpack.monitoring.elasticsearch.ssl.keystore.password: password

#xpack.monitoring.elasticsearch.ssl.verification_mode: certificate

#xpack.monitoring.elasticsearch.sniffing: false

#xpack.monitoring.collection.interval: 10s

#xpack.monitoring.collection.pipeline.details.enabled: true

http.host: 0.0.0.0

#

# X-Pack Management

# https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html

#xpack.management.enabled: true

#xpack.management.pipeline.id: ["main", "logs"]

#xpack.management.elasticsearch.username: logstash_writer

#xpack.management.elasticsearch.password: dpebzh13

#xpack.management.elasticsearch.proxy: ["http://proxy:port"]

#xpack.management.elasticsearch.hosts: ["https://localhost:9200"]

# an alternative to hosts + username/password settings is to use cloud_id/cloud_auth

#xpack.management.elasticsearch.cloud_id: management_cluster_id:xxxxxxxxxx

#xpack.management.elasticsearch.cloud_auth: logstash_admin_user:password

# another authentication alternative is to use an Elasticsearch API key

#xpack.management.elasticsearch.api_key: "id:api_key"

#xpack.management.elasticsearch.ssl.certificate_authority: [ "/path/to/ca.crt" ]

#xpack.management.elasticsearch.ssl.truststore.path: /path/to/file

#xpack.management.elasticsearch.ssl.truststore.password: password

#xpack.management.elasticsearch.ssl.keystore.path: /path/to/file

#xpack.management.elasticsearch.ssl.keystore.password: password

#xpack.management.elasticsearch.ssl.verification_mode: certificate

#xpack.management.elasticsearch.sniffing: false

#xpack.management.logstash.poll_interval: 5s

 

# X-Pack GeoIP plugin

# https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-manage_update

#xpack.geoip.download.endpoint: "https://geoip.elastic.co/v1/database"

 

 

========================================================================================

 

 

 

Elasticsearch 실행방법

[elastic@master1 bin]# ./elasticsearch &

 

Kibana 실행방법

[kibanaadmin@master1 bin]# nohup ./kibana &

 

Logstash 실행방법

 

 

[root@master1 logstash]# bin/logstash -f applog.conf

 

yml config는 그냥 알아서 참고 하거나 그대로 복붙하면 됨.