If you are a person who is, or has been in the past, in charge of inspecting and analyzing system logs in Linux, you know what a nightmare that task can become if multiple services are being monitored simultaneously.
In days past, that task had to be done mostly manually, with each log type being handled separately. Fortunately, the combination of Elasticsearch, Logstash, and Kibana on the server side, along with Filebeat on the client side, makes that once difficult task look like a walk in the park today.
The first three components form what is called an ELK stack, whose main purpose is to collect logs from multiple servers at the same time (also known as centralized logging).
A built-in java-based web interface allows you to inspect logs quickly at a glance for easier comparison and troubleshooting. These client logs are sent to a central server by Filebeat, which can be described as a log shipping agent.
Central Server: CentOS 7 (IP address: 192.168.0.29). 2 GB of RAM. Client #1: CentOS 7 (IP address: 192.168.0.100). 1 GB of RAM. Client #2: Debian 8 (IP address: 192.168.0.101). 1 GB of RAM.Please note that the RAM values provided here are not strict prerequisites, but recommended values for successful implementation of the ELK stack on the central server. Less RAM on clients will not make much difference, if any, at all.
Installing ELK Stack on the Server
Let’s begin by installing the ELK stack on the server, along with a brief explanation on what each component does:- Elasticsearch stores the logs that are sent by the clients.
- Logstash processes those logs.
- Kibana provides the web interface that will help us to inspect and analyze the logs.
You may want to check first in the Java downloads page here to see if there is a newer update available.
# yum update # cd /opt # wget --no-cookies --no-check-certificate --header "Cookie: gpw_e24=http%3A%2F%2Fwww.oracle.com%2F; oraclelicense=accept-securebackup-cookie" "http://download.oracle.com/otn-pub/java/jdk/8u102-b14/jre-8u102-linux-x64.rpm" # rpm -Uvh jre-8u102-linux-x64.rpmTime to check whether the installation completed successfully:
# java -version
Check Java Version from Commandline
Enable Elasticsearch Repository
1. Import the Elasticsearch public GPG key to the rpm package manager:# rpm --import http://packages.elastic.co/GPG-KEY-elasticsearch2. Insert the following lines to the repository configuration file
elasticsearch.repo:
/etc/yum.repos.d/elasticsearch.repo
[elasticsearch] name=Elasticsearch repository baseurl=http://packages.elastic.co/elasticsearch/2.x/centos gpgcheck=1 gpgkey=http://packages.elastic.co/GPG-KEY-elasticsearch enabled=13. Install the Elasticsearch package.
# yum install elasticsearchWhen the installation is complete, you will be prompted to start and enable elasticsearch:
Install Elasticsearch in Linux
# systemctl daemon-reload # systemctl enable elasticsearch # systemctl start elasticsearch5. Allow traffic through TCP port 9200 in your firewall:
# firewall-cmd --add-port=9200/tcp # firewall-cmd --add-port=9200/tcp --permanent6. Check if Elasticsearch responds to simple requests over HTTP:
# curl -X GET http://localhost:9200The output of the above command should be similar to:
Verify Elasticsearch Installation
Make sure you complete the above steps and then proceed with Logstash. Since both Logstash and Kibana share the Elasticsearch GPG key, there is no need to re-import it before installing the packages.
Enable Logstash Repository
7. Insert the following lines to the repository configuration filelogstash.repo:
/etc/yum.repos.d/logstash.repo
[logstash] name=Logstash baseurl=http://packages.elasticsearch.org/logstash/2.2/centos gpgcheck=1 gpgkey=http://packages.elasticsearch.org/GPG-KEY-elasticsearch enabled=18. Install the Logstash package:
# yum install logstash9. Add a SSL certificate based on the IP address of the ELK server at the the following line below the
[ v3_ca ] section in /etc/pki/tls/openssl.cnf:[ v3_ca ] subjectAltName = IP: 192.168.0.29
Add Elasticsearch Server IP Address
# cd /etc/pki/tls # openssl req -config /etc/pki/tls/openssl.cnf -x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout private/logstash-forwarder.key -out certs/logstash-forwarder.crt11. Configure Logstash input, output, and filter files:
Input: Create
/etc/logstash/conf.d/input.conf and insert the following lines into it. This is necessary for Logstash to “learn”
how to process beats coming from clients. Make sure the path to the
certificate and key match the right paths as outlined in the previous
step:
/etc/logstash/conf.d/input.conf
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
}
}
Output (/etc/logstash/conf.d/output.conf) file:
/etc/logstash/conf.d/output.conf
output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
Filter (/etc/logstash/conf.d/filter.conf) file. We will log syslog messages for simplicity:
/etc/logstash/conf.d/filter.conf
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGLINE}" }
}
date {
match => [ "timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
12. Verify the Logstash configuration files.# service logstash configtest
Verify Logstash Configuration
# systemctl daemon-reload # systemctl start logstash # systemctl enable logstash14. Configure the firewall to allow Logstash to get the logs from the clients (TCP port 5044):
# firewall-cmd --add-port=5044/tcp # firewall-cmd --add-port=5044/tcp --permanent
Enable Kibana Repository
14. Insert the following lines to the repository configuration filekibana.repo:
/etc/yum.repos.d/kibana.repo
[kibana] name=Kibana repository baseurl=http://packages.elastic.co/kibana/4.4/centos gpgcheck=1 gpgkey=http://packages.elastic.co/GPG-KEY-elasticsearch enabled=115. Install the Kibana package:
# yum install kibana16. Start and enable Kibana.
# systemctl daemon-reload # systemctl start kibana # systemctl enable kibana17. Make sure you can access access Kibana’s web interface from another computer (allow traffic on TCP port 5601):
# firewall-cmd --add-port=5601/tcp # firewall-cmd --add-port=5601/tcp --permanent18. Launch Kibana (
http://192.168.0.29:5601) to verify that you can access the web interface:
Access Kibana Web Interface
Suggested Read: Monitor Server Logs in Real-Time with “Log.io” Tool in Linux
Install Filebeat on the Client Servers
We will show you how to do this for Client #1 (repeat for Client #2 afterwards, changing paths if applicable to your distribution).1. Copy the SSL certificate from the server to the clients:
# scp /etc/pki/tls/certs/logstash-forwarder.crt root@192.168.0.100:/etc/pki/tls/certs/2. Import the Elasticsearch public GPG key to the rpm package manager:
# rpm --import http://packages.elastic.co/GPG-KEY-elasticsearch3. Create a repository for Filebeat (
/etc/yum.repos.d/filebeat.repo) in CentOS based distributions:
/etc/yum.repos.d/filebeat.repo
[filebeat] name=Filebeat for ELK clients baseurl=https://packages.elastic.co/beats/yum/el/$basearch enabled=1 gpgkey=https://packages.elastic.co/GPG-KEY-elasticsearch gpgcheck=14. Configure the source to install Filebeat on Debian and its derivatives:
# aptitude install apt-transport-https # echo "deb https://packages.elastic.co/beats/apt stable main" > /etc/apt/sources.list.d/filebeat.list # aptitude update5. Install the Filebeat package:
# yum install filebeat [On CentOS and based Distros] # aptitude install filebeat [On Debian and its derivatives]6. Start and enable Filebeat:
# systemctl start filebeat # systemctl enable filebeat
Configure Filebeat
A word of caution here. Filebeat configuration is stored in a YAML file, which requires strict indentation. Be careful with this as you edit/etc/filebeat/filebeat.yml as follows:- Under paths, indicate which log files should be “shipped” to the ELK server.
- Under prospectors:
input_type: log document_type: syslog
- Under output:
- Uncomment the line that begins with logstash.
- Indicate the IP address of your ELK server and port where Logstash is listening in hosts.
- Make sure the path to the certificate points to the actual file you created in Step I (Logstash section) above.
Configure Filebeat in Client Servers
# systemctl restart filebeatOnce we have completed the above steps on the clients, feel free to proceed.
Testing Filebeat
In order to verify that the logs from the clients can be sent and received successfully, run the following command on the ELK server:# curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty'The output should be similar to (notice how messages from /var/log/messages and /var/log/secure are being received from client1 and client2):
Testing Filebeat
# journalctl -xeafter attempting to restart Filebeat will point you to the offending line(s).
Testing Kibana
After we have verified that logs are being shipped by the clients and received successfully on the server. The first thing that we will have to do in Kibana is configuring an index pattern and set it as default.You can describe an index as a full database in a relational database context. We will go with
filebeat-* (or you can use a more precise search criteria as explained in the official documentation).Enter
filebeat-* in the Index name or pattern field and then click Create:
Testing Kibana
Configure Default Kibana Index Pattern
Add Log Visualization Report
By default, Kibana will display the records that were processed during the last 15 minutes (see upper right corner) but you can change that behavior by selecting another time frame:
Kibana Log Reports
Summary
In this article we have explained how to set up an ELK stack to collect the system logs sent by two clients, a CentOS 7 and a Debian 8 machines.Now you can refer to the official Elasticsearch documentation and find more details on how to use this setup to inspect and analyze your logs more efficiently.
If you have any questions, don’t hesitate to ask. We look forward to hearing from you.
Comentários
Postar um comentário