ELK Stack 환경 구성

오픈소스 프로젝트 ElasticSearch + LogStash + Kibana의 앞 글자만 따서 만들어진 용어

LogStash: 데이터를 처리하는 파이프라인, 로그를 수집하여 ElasticSearch에 전송

ElasticSearch: LogStash를 통해서 전송받은 데이터 분석 및 저장

Kibana: ElasticSearch에 저장되어 있는 데이터를 시각화하고, 실시간으로 분석

 

위의 ELK에서 Beat까지 추가되면서 ELK Stack이라고 불림

Beat: 대상 서버에서 데이터를 수집하는 역할 담당

https://potato-yong.tistory.com/140

---

공식 설치 방법 https://www.elastic.co/guide/en/elasticsearch/reference/current/install-elasticsearch.html 

설치 방법 - OS의 종류에 따라 나뉘어져있음

1) Linux, MacOS => tar.gz

2) Windows => .zip

3) Debian-based System(Debian, Ubuntu) => deb

4) RPM-based System(RedHat, CentOS, SLES, OpenSuSE) => rpm

+) Docker

 

Support Matrix를 통한 OS 선정 https://www.elastic.co/kr/support/matrix

=> 가장 호환성이 좋은 CentOS 7 선택

 

공식 다운로드 링크 http://isoredirect.centos.org/centos/7/isos/x86_64/

여러가지 버전 존재

Minimal - 리눅스 시스템에 요구되는 최소 패키지. (GUI 미포함)

DVD - Minimal 패키지를 포함하고 몇개의 유틸리티 패키지를 포함함.(기본 개발패키지 밋 GUI 패키지)

Everything - DVD 패키지를 포함하고 향상된 유저패키지, 개발 패키지 셋 모두 포함.(Smart card support 등)

Netinstall - 네트워크 설치를 위한 최소의 CD 이미지.

 

데탑에 구성할 때는 DVD로 하고 라즈베리파이에 구성할 때 무거운 것 같으면 Minimal 하면 될듯

 

ElasticSearch

CentOS 공식 ElasticSearch 설치 방법 https://www.elastic.co/guide/en/elasticsearch/reference/current/rpm.html

중간에 sudo 명령이 안돼서 고침
루트 계정으로 전환 su - root
echo '계정명 ALL=(ALL) ALL' >> /etc/sudoers 입력
다시 su 계정명 으로 전환하여 sudo 사용하면 잘 됨

rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

# /etc/yum.repos.d/ 디렉토리에 elasticsearch.repo 작성

$ sudo vim /etc/yum.repos.d/elasticsearch.repo

[elasticsearch]
name=Elasticsearch repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
autorefresh=1
type=rpm-md

centOS이므로 yum 선택

sudo yum install --enablerepo=elasticsearch elasticsearch

sudo vim /etc/elasticsearch/elasticsearch.yml

network.host: 192.168.0.1 을 127.0.0.1로 변경 & 주석 제거

http.port:9200 주석 제거

curl http://127.0.0.1:9200

curl로 elasticsearch 통신 되는지 확인

 

처음엔 공식문서 토대로 모든 과정에 대해서 왜 그런지 적으려고 했는데

뭐가 엄청 많아서 그냥 하면서 배우기로 함

---

Kibana

https://www.elastic.co/guide/en/kibana/8.3/rpm.html#rpm-repo

# /etc/yum.repos.d/ 디렉토리에 kibana.repo 작성

$ sudo vim /etc/yum.repos.d/kibana.repo

[kibana-8.x]
name=Kibana repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

centos이므로 yum 선택

yum install kibana -y

kibana 실행

systemctl start kibana
systemctl enable kibana

외부에서 접근할  수 있도록 /etc/kibana/kibana.yml에서 server.host를 주석 해제하고 0.0.0.0 으로 변경

file:///usr/share/doc/HTML/index.html

 

ifconfig로 ip주소 확인해주고, 192.168.19.131:5601로 접속하면 된다.(또는 localhost:5601)

뭔가 kibana 설치하고부터 렉이 너무 걸려서...램 늘려줬다. (1GB -> 2GB)

sudo /usr/share/kibana/bin/kibana

---

LogStash

공식 https://www.elastic.co/guide/en/logstash/current/installing-logstash.html 

java -version 으로 깔려있는지 확인 먼저

# /etc/yum.repos.d/에 logstash.repo 작성

[logstash-8.x]
name=Elastic repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

yum install logstash -y

systemctl start logstash
systemctl enable logstash

logstash는 config 파일이 필요함(/usr/share/logstash/bin/logstash.conf)

파이프라인 3가지로 구성됨 (input/filter/output)

# 가장 간단한 형태
input {
	stdin { }
}
output {
	stdout { }
}

stdin = 키보드로 input(입력)을 받겠다

stdout = 모니터로 output(출력) 하겠다

하고 ./logstash -f logstash.conf 했더니 이딴 오류 뜸...

https://www.reddit.com/r/elasticsearch/comments/9d04av/how_do_i_solve_this_problem/

메모리 부족하다길래 2GB에서 3GB로 늘려줌.

[root@localhost bin]# ./logstash -f logstash.conf

Using bundled JDK: /usr/share/logstash/jdk
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
OpenJDK 64-Bit Server VM warning: INFO: os::commit_memory(0x00000000ca660000, 899284992, 0) failed; error='Not enough space' (errno=12)
#
# There is insufficient memory for the Java Runtime Environment to continue.
# Native memory allocation (mmap) failed to map 899284992 bytes for committing reserved memory.
# An error report file with more information is saved as:
# /usr/share/logstash/bin/hs_err_pid18636.log

다시 했더니 뭔가 성공한것같긴 함

Using bundled JDK: /usr/share/logstash/jdk
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
hello
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN ] 2022-07-16 13:43:34.801 [main] runner - NOTICE: Running Logstash as superuser is not recommended and won't be allowed in the future. Set 'allow_superuser' to 'false' to avoid startup errors in future releases.
[INFO ] 2022-07-16 13:43:34.833 [main] runner - Starting Logstash {"logstash.version"=>"8.3.2", "jruby.version"=>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.15+10 on 11.0.15+10 +indy +jit [linux-x86_64]"}
[INFO ] 2022-07-16 13:43:34.834 [main] runner - JVM bootstrap flags: [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -Djruby.jit.threshold=0, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED]
[INFO ] 2022-07-16 13:43:34.899 [main] settings - Creating directory {:setting=>"path.queue", :path=>"/usr/share/logstash/data/queue"}
[INFO ] 2022-07-16 13:43:34.906 [main] settings - Creating directory {:setting=>"path.dead_letter_queue", :path=>"/usr/share/logstash/data/dead_letter_queue"}
[WARN ] 2022-07-16 13:43:35.515 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2022-07-16 13:43:35.571 [LogStash::Runner] agent - No persistent UUID file found. Generating new UUID {:uuid=>"d7e5f1d9-778f-436b-a965-b3a32e0280d2", :path=>"/usr/share/logstash/data/uuid"}
[INFO ] 2022-07-16 13:43:37.559 [Agent thread] configpathloader - No config files found in path {:path=>"/usr/share/logstash/logstash-simple.conf"}
[ERROR] 2022-07-16 13:43:37.563 [Agent thread] sourceloader - No configuration found in the configured sources.
[INFO ] 2022-07-16 13:43:37.787 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[INFO ] 2022-07-16 13:43:37.881 [LogStash::Runner] runner - Logstash shut down.

근데 이런 과정은 못했음...

https://www.youtube.com/watch?v=FpEubrKOoVE&t=160s

# logstash script 적용

$ cd /usr/share/logstash/bin
$ ./system-install

Successfully created system startup script for Logstash 가 뜨면 성공이다