在Fedora 35 Server上安装ElastiFlow 5.2.0

ElastiFlow 5.X去掉了之前版本对logstash的依赖，独立开发了替代组件ElastiFlow™ Unified Flow Collector，解决了logstash启动、关闭、运行缓慢的问题，但许可方面进行了限制，社区版限制Unified Flow Collector使用一个CPU内核。

linux系统

禁用 selinux 。
* 需要重新启动才能使其成为永久设置。

# vi /etc/sysconfig/selinux

SELINUX=disabled 

关闭防火墙

打开firewall-cmd需要的端口

systemctl stop firewalld.service #停止firewall
systemctl disable firewalld.service #禁止firewall开机启动

OpenJDK 安装

安装 OpenJDK。

# yum install java-1.8.0-openjdk-devel

导入 GPG 密钥

参考原始手册安装 GPG KEY。

# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

创建存储库文件

参考原始手册创建 ElasticSearch、Kibana 和 Logstash 存储库文件。

vi /etc/yum.repos.d/elastic-7.x.repo

[elastic-7.x]
name=elastic repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
autorefresh=1
type=rpm-md

安装

yum install --enablerepo=elastic-7.x elasticsearch
yum install --enablerepo=elastic-7.x kibana

各种设置更改

由于除非您更改集群设置，否则 ElasticSearch 不会启动，
因此请按如下方式修改/etc/elasticsearch/elasticsearch.yml。

vi /etc/elasticsearch/elasticsearch.yml

#discovery.seed_hosts: ["host1", "host2"]
discovery.type: single-node 

从 Kibana 设置更改备用 IP 地址。

vi /etc/kibana/kibana.yml
#server.host: "localhost"
server.host: "0.0.0.0"

服务注册、自动启动和启动设置

注册 ElasticSearch、Kibana 和 Logstash 服务，并设置自动启动和启动。

# systemctl daemon-reload
# systemctl enable elasticsearch.service
# systemctl start elasticsearch.service
# systemctl status elasticsearch.service

# systemctl daemon-reload
# systemctl enable kibana.service
# systemctl start kibana.service
# systemctl status kibana.service

systemctl status 执行服务名时确认正常启动。

安装 ElastiFlow

参考Linux | ElastiFlow安装 ElastiFlow。

下载flow-collector-5.2.0-1.x86_64.rpm

wget https://elastiflow-packages.s3.amazonaws.com/flow-collector/flow-collector-5.2.0-1.x86_64.rpm

安装libpcap-devel

dnf install -y libpcap-devel

安装flow-collector-5.2.0-1.x86_64.rpm

dnf install -y flow-collector-5.2.0-1.x86_64.rpm

修改配置文件

/etc/systemd/system/flowcoll.service.d/flowcoll.conf

vi /etc/systemd/system/flowcoll.service.d/flowcoll.conf

设置EF_FLOW_OUTPUT_ELASTICSEARCH_ENABLE=true

# Elasticsearch
Environment="EF_FLOW_OUTPUT_ELASTICSEARCH_ENABLE=true"

实际使用时根据情况还需要修改监听端口

EF_FLOW_SERVER_UDP_PORT#

The UDP port(s) on which the collector will create a socket to receive incoming packets. Multiple ports may be specified, separated by a comma. For example 2055,6343,4739

• Valid Values
  • Any valid port number. Common values include:
    • 2055: the standard port for Netflow
    • 4739: the standard port for IPFIX
    • 6343: the standard port for sFlow
    • 9995-9998: commonly use port numbers
• Default
  • 9995

Environment="EF_FLOW_SERVER_UDP_PORT=9995"

使用 GitHub - nerdalert/nflow-generator: NetFlow Generator for Testing Flow Collection Apps在Linux下生成flow测试，或者使用flowalyzer.exe或NetflowGenerator.exe在 Windows下生成flow测试。

参考 Kibana | ElastiFlowKibana enables you to interactively explore, visualize, and share insights into your network flow data, as well as manage and monitor Elasticsearch.https://docs.elastiflow.com/docs/kibana

在Kibana上导入 https://raw.githubusercontent.com/elastiflow/elastiflow_for_elasticsearch/master/kibana/kibana-7.12.x-codex-light.ndjsonhttps://raw.githubusercontent.com/elastiflow/elastiflow_for_elasticsearch/master/kibana/kibana-7.12.x-codex-light.ndjson

 Elastic Stack 7免费版支持设置用户密码登录，进行如下设置：

vi /etc/elasticsearch/elasticsearch.yml

新增以下配置:

   xpack.security.enabled: true

   xpack.license.self_generated.type: basic

   xpack.security.transport.ssl.enabled: true

修改完配置后重启elasticsearch服务

systemctl restart elasticsearch

初始化密码

执行：/usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive

修改kibana.yml配置信息

vi /etc/kibana/kibana.yml

elasticsearch.username: "kibana"
elasticsearch.password: "your_password"

然后重启kibana服务

systemctl restart kibana

编辑ElastiFlow设置

vi /etc/systemd/system/flowcoll.service.d/flowcoll.conf

设置EF_FLOW_OUTPUT_ELASTICSEARCH_PASSWORD=your_password

# A comma separated list of Elasticsearch nodes to use. DO NOT include "http://" or "https://"
Environment="EF_FLOW_OUTPUT_ELASTICSEARCH_ADDRESSES=127.0.0.1:9200"
Environment="EF_FLOW_OUTPUT_ELASTICSEARCH_USERNAME=elastic"
Environment="EF_FLOW_OUTPUT_ELASTICSEARCH_PASSWORD=your_password"

重启ElastiFlow

systemctl restart flowcoll.service

访问kibana登录页面，登录账号为elastic