安装Nginx
使用scrt工具把kibana的rpm包上传至elk-2节点的root的目录下:
用rpm包安装(但会报错):
## [root@elk-2 ~]# rpm -ivh nginx-1.16.1-1.el7.ngx.x86_64.rpm
报错的原因是由于yum安装了旧版本的GPG keys造成的,用 rpm -ivh *.rpm --force --nodeps 来解决,nodeps的意思是忽视依赖关系,因为各个软件之间会有多多少少的联系。有了这两个设置选项就忽略了这些依赖关系,强制安装或者卸载。
[root@elk-2 ~]# rpm -ivh *.rpm --force --nodeps
warning: nginx-1.16.1-1.el7.ngx.x86_64.rpm: Header V4 RSA/SHA1 Signature, key ID 7bd9bf62: NOKEY
Preparing... ################################# [100%]
updating / installing...1:nginx-1:1.16.1-1.el7.ngx ################################# [ 33%]
----------------------------------------------------------------------
Thanks for using nginx!
Please find the official documentation for nginx here:
* http://nginx.org/en/docs/
Please subscribe to nginx-announce mailing list to get
the most important news about nginx:
* http://nginx.org/en/support.html
Commercial subscriptions for nginx are available on:
* http://nginx.com/products/
----------------------------------------------------------------------
2:logstash-1:6.0.0-1 ################################# [ 67%]
Using provided startup.options file: /etc/logstash/startup.options
Successfully created system startup script for Logstash
3:elasticsearch-0:6.0.0-1 ################################# [100%]
配置Logstash
elk-2上:编辑Nginx配置文件,加入如下内容:
[root@elk-2 ~]# vi /etc/logstash/conf.d/nginx.conf
input {
file {
path => "/tmp/elk_access.log"
start_position => "beginning"
type => "nginx"
}
}
filter {
grok {
match => { "message" => "%{IPORHOST:http_host} %{IPORHOST:clientip} - %{USERNAME:remote_user} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:http_verb} %{NOTSPACE:http_request}(?: HTTP/%{NUMBER:http_version})?|%{DATA:raw_http_request})\" %{NUMBER:response} (?:%{NUMBER:bytes_read}|-) %{QS:referrer} %{QS:agent} %{QS:xforwardedfor} %{NUMBER:request_time:float}"}
}
geoip {
source => "clientip"
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["192.168.200.12:9200"]
index => "nginx-test-%{+YYYY.MM.dd}"
}
}
使用logstash命令检查文件是否错误:
[root@elk-2 ~]# logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/nginx.conf --config.test_and_exit
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
Configuration OK
编辑监听Nginx日志配置文件,加入如下内容:
[root@elk-2 ~]# vi /etc/nginx/conf.d/elk.conf
server {
listen 80;
server_name elk.com;
location / {
proxy_pass http://192.168.200.11:5601;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
access_log /tmp/elk_access.log main2;
}
修改Nginx日志配置文件,增加如下内容(需注意Nginx配置文件格式):
[root@elk-2 ~]# vi /etc/nginx/nginx.conf
log_format main2 '$http_host $remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$upstream_addr" $request_time';
用nginx -t检测一下nginx的配置(显示没有检测到):
解决方法:
(1)使用yum安装nginx,会报错。
(2)报错,说缺少libcrypto.so.10这个包
(3)经过查询,其实是有这个包的
[root@elk-2 ~]# find / -name libcrypto.so.10
(4)查看当前库文件中的 libcrypto.so.10
[root@elk-2 ~]# rpm -q --provides openssl-libs | grep libcrypto.so.10
(5)把升级OpenSSL 1.0.1到OpenSSL 1.0.2
http://rpmfind.net/linux/rpm2html/search.php?query=libcrypto.so.10(OPENSSL_1.0.2)(64bit)&submit=Search+…&system=&arch=
在右下角找到并下载
CentOS 7.7.1908 for x86_64 openssl-libs-1.0.2k-19.el7.x86_64.rpm
上传到服务器后,使用rpm进行升级,为了防止和已经有的版本冲突,强制安装(–force)
[root@elk-2 ~]# rpm -ivh openssl-libs-1.0.2k-19.el7.x86_64.rpm --force
Preparing… ################################# [100%]
Updating / installing…
1:openssl-libs-1:1.0.2k-19.el7 ################################# [100%]
再用nginx -t检测一下nginx的配置
[root@elk-2 ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
开启nginx服务:
[root@elk-2 ~]# systemctl start nginx
检查是否有日志产生:
[root@elk-2 ~]# systemctl restart logstash
在elk-1上curl ‘localhost:9200/_cat/indices?v’
[root@elk-1 ~]# curl '192.168.200.11:9200/_cat/indices?v'
检查是否有nginx-test开头的索引生成
如果有,才能到kibana里去配置该索引
[root@elk-1 ~]# curl '192.168.200.11:9200/_cat/indices?v'
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open system-syslog-2020.11 BOkHot1WTeWbi97I-olRvw 5 1 130 0 1mb 537.2kb
green open .kibana TsKRJhC4RayBGmnMnQ6dlA 1 1 1 0 7.3kb 3.6kb
green open nginx-test-2020.11.18 micBA0ZkS9OD0DndqFNM_w 5 1 1512 0 523.8kb 272.5kb
Web界面配置
浏览器访问192.168.200.11:5601,到Kibana上配置索引:
配置完成后,选择Discover,进入“Discover”页面后,如果出现以下提示,则是代表无法查找到日志信息:
这种情况一般是时间的问题,单击右上角内容切换成查看当天的日志信息: