Centos7 elasticsearch-7.2.0+logstash-7.2.0+kibana-7.2.0+rsyslog 单机部署

ELKR分别指elasticsearch-7.2.0、logstash-7.2.0、kibana-7.2.0、rsyslog，用的当前官网最新版本7.2.0，这次测试用于读取操作系统登录和操作日志。

系统版本

CentOS Linux release 7.5.1804 (Core)

1、安装包下载

官方地址：https://www.elastic.co/cn/downloads/

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.2.0-linux-x86_64.tar.gz
wget https://artifacts.elastic.co/downloads/logstash/logstash-7.2.0.tar.gz
wget https://artifacts.elastic.co/downloads/kibana/kibana-7.2.0-linux-x86_64.tar.gz

2、创建elk用户
elasticsearch和kibana 必须在非root用户启动

groupadd elk
useradd elk -g elk

3、 解压

tar -xzf elasticsearch-7.2.0-linux-x86_64.tar.gz -C /home/elk/
tar -xzf logstash-7.2.0.tar.gz -C /home/elk/
tar -xzf kibana-7.2.0-linux-x86_64.tar.gz -C /home/elk/

4、赋予elk权限
chown -R elk:elk elasticsearch-7.2.0
chown -R elk:elk kibana-7.2.0-linux-x86_64

5、elasticsearch部署
5.1、创建数据和日志文件夹，并修改权限

mkdir  -p  /home/elk/es-data/logs
chown -R elk:elk /home/elk/

5.2、修改配置文件
vim elasticsearch-7.2.0/config/elasticsearch.yml

path.data: /home/elk/es-data
path.logs: /home/elk/es-data/logs
#其他项默认，可以按需求修改

5.4、启动脚本
vim /home/elk/es-start.sh

#!/bin/sh
cd  /home/elk/elasticsearch-7.2.0 
nohup bin/elasticsearch &
tail -f nohup.out

5.5、 启动

su - elk
sh es-start.sh

5.6、测试
curl 127.0.0.1:9200

{
  "name" : "study01",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "7XETJBiFRJKALJPvzhGklQ",
  "version" : {
    "number" : "7.2.0",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "508c38a",
    "build_date" : "2019-06-20T15:54:18.811730Z",
    "build_snapshot" : false,
    "lucene_version" : "8.0.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

6、logstash部署
***注：root用户操作 ***
6.1、增加配置文件
vim /home/elk/logstash-7.2.0/conf/logstash-rsyslog.conf

input {
    syslog {
        port => 514
        type => "rsyslog"
    }
}

filter {
    if [type] == 'rsyslog' {
        urldecode {  # 编码转换#
            all_fields=>true
        }
        mutate {
            split => ["message","||"]  # 拆分日志#
            add_field => {"HostName" => "%{[message][0]}"}
            add_field => {"Facility" => "%{[message][1]}"}
            add_field => {"Mes" => "%{[message][5]}"}
            remove_field => ["message","facility_label","facility","severity_label","severity","priority","timestamp","program"]
        }
        if [Facility] == "local5" {
        mutate {
            split => ["Mes",","]  # 拆分日志#
            add_field => {"ClientIp" => "%{[Mes][0]}"}
            add_field => {"LoginUserName" => "%{[Mes][1]}"}
            add_field => {"SessionId" => "%{[Mes][2]}"}
            remove_field => ["Mes"]
            }
        }
        if [Facility] == "user" {
        mutate {
            split => ["Mes",","]  # 拆分日志#
            add_field => {"Euid" => "%{[Mes][0]}"}
            add_field => {"WhoInfo" => "%{[Mes][1]}"}
            add_field => {"ExecPath" => "%{[Mes][2]}"}
            add_field => {"ExecCmd" => "%{[Mes][3]}"}
            remove_field => ["Mes"]
            }
        }
    }
}
output {
   if [type] == 'rsyslog' and [Facility] == "local5" {
             elasticsearch {
                        hosts => ["localhost:9200"]
                        index => ["logstash-login-%{+YYYY.MM.dd}"]
             }
    }else if [type] == 'rsyslog' and [Facility] == "user" {
             elasticsearch {
                        hosts => ["localhost:9200"]
                        index => ["logstash-user-%{+YYYY.MM.dd}"]
             }
    }
}

6.2 、启动

cd /home/elk/logstash-7.2.0/
nohup bin/logstash -f /home/elk/logstash-7.2.0/conf/logstash-rsyslog.conf 

7、rsyslog配置
***注：root用户操作 ***
7.1 、添加如下配置到 /etc/bashrc 文件末尾

up_client_ip=`(who am i|cut -d\( -f2|cut -d\) -f1)`
logger -p local5.info -- $up_client_ip,$(whoami),$$
export PROMPT_COMMAND='{ msg=$(history 1 | { read x y; echo $y; });logger -p user.notice "[euid=$(whoami)]",$(who am i),`pwd`",$msg"; }'
readonly PROMPT_COMMAND

7.2 、修改配置 /etc/rsyslog.conf
vim /etc/rsyslog.conf
新增文件末尾：

$template StdLOGFormat,"%fromhost%||%syslogfacility-text%||%syslogpriority-text%||%timereported:::date-mysql%||%timegenerated:::date-mysql%||%msg%||%iut%||%programname%||%syslogtag%"

*.* @@127.0.0.1:514;StdLOGFormat

7.3 、重启

service rsyslog restart

8、 kibana部署

8.1 、修改配置
vim /home/elk/kibana-7.2.0-linux-x86_64/config/kibana.yml

server.host: "0.0.0.0"
#其他项按需求自行修改

8.2、 启动脚本
vim /home/elk/kb-start.sh

#!/bin/sh
cd  /home/elk/kibana-7.2.0-linux-x86_64
nohup bin/kibana &
tail -f nohup.out

8.3 、启动

su - elk
sh kb-start.sh

8.4、 浏览器访问
在浏览器里，输入yourip:5601 访问成功即代表启动成功

8.5、 Kibana界面
启动好了之后，在浏览器里访问前端页面

点击Discover

8.6、 操作系统追加数据
创建新的测试日志

logger "跟我一起学猫叫，一起喵喵喵"
echo '测试中文' >> test.txt
cat test.txt

刷新kibana,即可看到新的日志