filebeat7.10+logstash7.10+Elastic7.10+kibana7.10收集centos系统ssh日志
配置信息如下：
| IP | 系统 | JDK | Eastic | Filebeat | logstash | Kibana |
| 192.168.137.30 | Centos7 | openjdk-11 | elastic7.10 | ------ | logstash7.10 | Kibana7.10 |
| 192.168.137.26 | Centos7 | openjdk-11 | elastic7.10 | Filebeat7.10 | --------- | ----------- |
具体安装情况就不详细说了。
elastic7组建集群,使用源码包安装，JDK使用yum安装。
filebeat，logstash，kibana都是使用RPM包安装，比较简单,可以到华为云镜像网站下载安装包。
以下是filebeat的配置文件信息。
[root@centos6mini filebeat]# cat filebeat.yml
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/secure
# include_lines: ['Bad']
tags:
["secure-log"]
fields:
service: "ssh"
# - type: log
# enabled: true
# paths:
# - /www/wwwlogs/yjvps.com-ssl_access_log
# include_lines: ['sshd', 'sudo']
# tags:
# ["httpd-log"]
# fields:
# service: "httpd"
setup.template.settings:
index.number_of_shards: 1
output.logstash:
hosts: ["192.168.137.30:5043"]
其中 include_lines可以匹配相关行日志。
以下是logstash的ssh.conf 的相关配置文件内容：
[root@k8s-30 ~]# cat /etc/logstash/conf.d/ssh.conf
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.
input {
beats {
port => 5043
}
}
#filter {
# grok {
# match => {"message" => "%{MONTH:yuefen} %{MONTHDAY:riqi} %{TIME:shijian} %{HOSTNAME:zhoujiming} .* %{IPV4:remoteip} .*"}
# }
# date {
# match => ["timestamp","yyyy/MM/dd:HH:mm:ss"]
# target => ["datetime"]
# }
# geoip {
# source => "remoteip"
# }
# }
#}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "filebeat-ssh-%{+YYYY.MM.dd}"
user => "elastic"
password => "123456"
}
}
"%{MONTH:yuefen} %{MONTHDAY:riqi} %{TIME:shijian} %{HOSTNAME:zhoujiming} .* %{IPV4:remoteip} .*"
可以过滤相关日志。
相关软件启动后，可以到elastic中查看会多出一个filebeat-ssh-时间的索引并上传相关日志文件