ES8生产实践——Fleet部署与常见日志采集

为了更加方便的实现系统和应用程序日志接入ES，官方推出了Elastic Agent应用，Elastic Agent可以实现通过更少的配置和安装来简化数据采集配置，通过Fleet可以轻松的管理整个Elastic Agent队列。Kibana为我们内置了大多数场景下日志的采集与可视化分析配置，我们仅需要在kibanaUI中点击操作便可完成复杂的日志采集。更多fleet相关内容，可参考文档：https://www.cuiliangblog.cn/detail/section/133432981

安装Fleet Server

Fleet Server可以有多台机器组成Fleet server cluster，用于集中管理 Elastic Agent。 它作为 Elastic Agent 的一部分在用作服务器的主机上启动。 一个 Fleet Server 进程可以支持多个 Elastic Agent 连接，并作为一个控制面来更新代理策略、收集状态信息和协调 Elastic Agent 的操作。

配置Fleet Server

进入fleet菜单，点击添加fleet服务器。

填写要部署fleet服务器的地址，格式为https://fleet服务器ip:8220，本实验填写地址为https://192.168.10.132:8220

生成fleet Server部署命令

部署Fleet Server

本实验中在master节点部署Fleet Server，根据kibana提示，在master节点执行命令

[root@es-master ~]# curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.8.2-linux-x86_64.tar.gz
[root@es-master ~]# tar -zxf elastic-agent-8.8.2-linux-x86_64.tar.gz
[root@es-master ~]# cd elastic-agent-8.8.2-linux-x86_64
[root@es-master elastic-agent-8.8.2-linux-x86_64]# ./elastic-agent install \
  --fleet-server-es=https://192.168.8.5:9200 \
  --fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2ODk1ODQyMDczMjc6Y2F4SXp0djdSdWFob3FiRGFXMngxQQ \
  --fleet-server-policy=fleet-server-policy \
  --fleet-server-es-ca-trusted-fingerprint=7f19df998d554c92ecb505db6dae0954d74f3c47ef56b78b46b65662558b988c \
  --fleet-server-port=8220
Elastic Agent will be installed at /opt/Elastic/Agent and will run as a service. Do you want to continue? [Y/n]:y
{"log.level":"info","@timestamp":"2023-07-17T17:28:06.353+0800","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":410},"message":"Generating self-signed certificate for Fleet Server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-07-17T17:28:10.468+0800","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":773},"message":"Waiting for Elastic Agent to start Fleet Server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-07-17T17:28:14.472+0800","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":787},"message":"Fleet Server - Running on policy with Fleet Server integration: fleet-server-policy; missing config fleet.agent.id (expected during bootstrap process)","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-07-17T17:28:14.907+0800","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":478},"message":"Starting enrollment to URL: https://es-cold:8220/","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-07-17T17:28:16.899+0800","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":276},"message":"Successfully triggered restart on running Elastic Agent.","ecs.version":"1.6.0"}
Successfully enrolled the Elastic Agent.
Elastic Agent has been successfully installed.

# 安装完成后，Fleet Server服务文件路径在/opt/Elastic/Agent

Fleet Server部署完成

fleet server部署完成后，kibana界面即可显示fleet server相关信息。

安装Elastic Agent

Elastic Agent会根据策略中的配置信息来收集和发送数据到 Elasticsearch，通常情况下同种类型的服务器使用相关的agent策略。

生成Agent安装命令

点击右侧添加代理按钮，进入配置页面

然后会为我们生成代理安装命令

安装Elastic Agent

依次在剩余的其他节点上执行生成的代理安装命令。以cold节点为例：

[root@es-cold ~]# curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.8.2-linux-x86_64.tar.gz
[root@es-cold ~]# tar -zxf elastic-agent-8.8.2-linux-x86_64.tar.gz 
[root@es-cold ~]# cd elastic-agent-8.8.2-linux-x86_64
[root@es-cold elastic-agent-8.8.2-linux-x86_64]# ./elastic-agent install --url=https://192.168.10.132:8220 --enrollment-token=bkxNVGVJa0J2SHUxWXJaMC1IVjc6S0RHMVVpc2lUa09mblJDWlpkdEN5QQ== --insecure
Elastic Agent will be installed at /opt/Elastic/Agent and will run as a service. Do you want to continue? [Y/n]:y
{"log.level":"warn","@timestamp":"2023-07-21T18:57:06.341+0800","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls_config.go","file.line":104},"message":"SSL/TLS verifications disabled.","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-07-21T18:57:06.878+0800","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":478},"message":"Starting enrollment to URL: https://192.168.10.132:8220/","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2023-07-21T18:57:07.130+0800","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls_config.go","file.line":104},"message":"SSL/TLS verifications disabled.","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-07-21T18:57:08.932+0800","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":276},"message":"Successfully triggered restart on running Elastic Agent.","ecs.version":"1.6.0"}
Successfully enrolled the Elastic Agent.
Elastic Agent has been successfully installed.

记得添加–insecure参数，否则会报x509证书错误。
执行完上述命令后，查看Kibana页面，已经成功添加了一个代理

其他节点也依次执行上述步骤，执行完成后，fleet页面信息如下所示

配置代理策略

Linux审计日志

打开kibana集成菜单

添加Linux登录审计日志

配置代理策略

点击保存并继续，提示添加完成后，在已安装集成菜单中可以看到已添加Auditd Logs

上述操作只在Agent policy中配置了代理策略，但是Fleet Server Policy策略的机器无法收集，接下来在Fleet Server Policy中也添加该策略。

Elasticsearch

在集成菜单中找到Elasticsearch并添加

与集成Linux审计日志一样，在代理策略中分别选择已有的Agent Policy和Fleet Server Policy

修改logs的默认值，指定日志路径

修改metrics的默认值，修改为https，填写账号密码与ca证书路径

certificate_authorities: ["/etc/elasticsearch/certs/http_ca.crt"]

添加完成后查看已经集成的代理，显示Elasticsearch信息。

查看数据

查看dashboard

当我们添加Elastic代理集成后，会自动为我们创建相关的dashboard，接下来以Elasticsearch为例

点击资产标签，既可查看默认的dashboard信息，点击其中一个查看详情

dashboard内容如下所示

查看数据流内容

如果我们想查看日志的详细内容，可以通过添加discover查看，以auditd.log为例。可知审计日志数据集名称为auditd.log

接下来创建kibana discover，选择菜单——>Stack Management——>kibana discover

接下来创建数据视图，填写内容如下：

打开discover菜单，选择auditd.log，即可查看详细的日志审计内容。

参考文档

Elastic Agent介绍：https://www.elastic.co/guide/en/fleet/current/beats-agent-comparison.html#supported-outputs-beats-and-agent
Fleet Server介绍：https://www.elastic.co/guide/en/fleet/8.8/fleet-server.html
Elastic Agent命令：https://www.elastic.co/guide/en/fleet/current/elastic-agent-cmd-options.html#elastic-agent-cmd-options

查看更多

微信公众号

微信公众号同步更新，欢迎关注微信公众号第一时间获取最近文章。

博客网站

崔亮的博客-专注devops自动化运维，传播优秀it运维技术文章。更多原创运维开发相关文章，欢迎访问https://www.cuiliangblog.cn