================ 注 意 项 目 ==================

vi /etc/sysctl.conf

vm.max_map_count=655360

sysctl -p

==========================================

应用: elk -> 添加服务: elk

镜像: sebp/elk:latest

卷:

/data/file:/data/file

cd /data/file/soft/src/elk/Kibana_Hanization-master
python main.py /opt/kibana   # 汉化

cd /opt/logstash/

bin/logstash-plugin install logstash-filter-dissect
bin/logstash-plugin install logstash-output-influxdb
bin/logstash-plugin install logstash-output-opentsdb

vi /opt/logstash/patterns/nginx

WZ ([^ ]*) 
NGINXACCESS %{IP:remote_ip} \- \- \[%{HTTPDATE:timestamp}\] "%{WORD:method} %{WZ:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:status} %{NUMBER:bytes} %{QS:referer} %{QS:agent} %{QS:xforward}

vi /etc/logstash/conf.d/30-output.conf

output { 
      influxdb { 
      db => "filebeat"
          host => "209.cndo.org"
          port => "8086"
          user => "filebeat"
          password => "filebeat"
          coerce_values => { 
             "request" => "varchar"
             "status" => "varchar" 
          } 
      data_points => { 
         "request" => "%{request}" 
         "status" => "%{status}"
         "referer"=>"%{referer}"
         "agent"=>"%{agent}"
         "method"=>"%{method}"
         "remote_ip"=>"%{remote_ip}"
         "bytes"=>"%{bytes}"
         "host"=>"%{host}"
         "timestamp"=>"%{timestamp}" 
      } 
}

vi /etc/logstash/conf.d/30-output.conf.bak

output {
  elasticsearch {
    hosts => ["localhost"]
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }

vi /etc/logstash/conf.d/11-nginx.conf

filter {
  if [type] == "nginx-access" {
    grok {
      match => { "message" => "%{NGINXACCESS}" }
    }
  }
}

vi /etc/logstash/conf.d/10-syslog.conf

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    syslog_pri { }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}

vi /etc/logstash/conf.d/02-beats-input.conf

input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/pki/tls/certs/logstash-beats.crt"
    ssl_key => "/etc/pki/tls/private/logstash-beats.key"
  }
}