ELK学习笔记之ELK分析syslog日志

0x00 配置FIlebeat搜集syslog并发送至

#配置

mv /etc/filebeat/filebeat.yml  /etc/filebeat/filebeat.yml.bak

vim /etc/filebeat/filebeat.yml

filebeat.prospectors:

- type: log

  enabled: true

  paths:

    - /var/log/messages

  fields：

    log_topics: syslog-1.202

  max_bytes: 1048576

output.logstash:

  hosts: ["127.0.0.1:5044"]

#启动

systemctl start filebea

0x01 配置Logstash从FIlebeat输入syslog日志并输出至Elasticsearch

#配置从beat 5044端口接收日志，且根据fields建立日志索引

vim /etc/logstash/conf.d/syslog.conf

input {

   beats {

    port => 5044

  }

}

output {

 if[fields][log_topics] == "syslog-1.202" {

  elasticsearch {

    hosts => ["192.168.1.202:9200"]

    index => "syslog-1.202-%{+YYYY.MM}"

  }

 }

}

#启动服务

systemctl start logstash

0x02 Troubleshooting

#日志排查

tailf /var/log/logstash/logstash-plain.log

tailf /var/log/filebeat/filebeat

#配置文件语法合规性排查

/usr/share/logstash/bin/logstash --path.settings /etc/logstash -f /etc/logstash/conf.d/syslog.conf --config.test_and_exit

/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml 

0x03 ElasticSearch查看索引

#查看索引

curl http://192.168.1.202:9200/_cat/indices?v

health status index                uuid                   pri rep docs.count docs.deleted store.size pri.store.size

green  open   .kibana              sdsMVkoKQZaZncZf6OXEeg   1   0          1            0      3.7kb          3.7kb

yellow open   syslog-1.202-2018.03 0JDgsgabR16EozrEhVHosA   5   1          4            0     31.5kb         31.5kb

#清空无用索引

curl -XDELETE http://192.168.1.202:9200/+索引名

0x04 Kibana创建索引