User Tools
сервисы_elk
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Last revision Both sides next revision | ||
|
сервисы_elk [2022/03/03 16:55] val [filebeat netflow module] |
сервисы_elk [2024/02/19 12:08] val [Сервисы ELK] |
||
|---|---|---|---|
| Line 2: | Line 2: | ||
| - | * [[https://system-admins.ru/elk-o-chem-i-zachem/|ELK. О чем и зачем?]] | + | * [[https://habr.com/ru/news/t/657169/|Elastic NV — американо-голландская компания, основанная в 2012 году в Амстердаме, Нидерланды, ранее известная как Elasticsearch, прекратила продажи ПО в РФ]] [update 24.03.22] |
| + | |||
| + | * [[https://aws.amazon.com/ru/what-is/elk-stack/|Что такое стек ELK?]] | ||
| + | * [[https://serveradmin.ru/ustanovka-i-nastroyka-elasticsearch-logstash-kibana-elk-stack/Как установить и настроить Elasticsearch, Logstash, Kibana (ELK Stack) на Ubuntu, Debian, Centos]] | ||
| * [[https://codedzen.ru/category/uroki/elasticsearch/|Уроки по Elasticsearch]] | * [[https://codedzen.ru/category/uroki/elasticsearch/|Уроки по Elasticsearch]] | ||
| * [[https://habr.com/ru/sandbox/115014/|Глоссарий ElasticSearch]] | * [[https://habr.com/ru/sandbox/115014/|Глоссарий ElasticSearch]] | ||
| - | * [[https://www.elastic.co/what-is/elk-stack|What is the ELK Stack? Why, it’s the Elastic Stack.]] | + | |
| - | * [[https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl.html|Elasticsearch provides a full Query DSL (Domain Specific Language) based on JSON]] | + | * [[https://vk.com/wall-95686747_13620|Для установки Elasticsearch и остальных продуктов Elastic, можно использовать репозиторий https://mirror.yandex.ru/mirrors.]] |
| * !!! От 8-x GB (8192 MB) и 2-х CPU на VM !!! | * !!! От 8-x GB (8192 MB) и 2-х CPU на VM !!! | ||
| Line 14: | Line 17: | ||
| ==== Установка пакета из репозитория ==== | ==== Установка пакета из репозитория ==== | ||
| - | * [[https://www.elastic.co/guide/en/elasticsearch/reference/current/deb.html|Install Elasticsearch with Debian Packageedit]] | + | * [[Переменные окружения]] (для установки через proxy) |
| + | * [[https://www.elastic.co/guide/en/elasticsearch/reference/current/deb.html|Install Elasticsearch with Debian Packageedit]] any Debian-based system such as Debian and Ubuntu. | ||
| + | * [[Управление ПО в Linux#Подключение сторонних репозиториев]] | ||
| + | |||
| + | <code> | ||
| + | # apt install elasticsearch | ||
| + | </code> | ||
| ==== Запуск и проверка работоспособности ==== | ==== Запуск и проверка работоспособности ==== | ||
| Line 49: | Line 58: | ||
| # systemctl status elasticsearch | # systemctl status elasticsearch | ||
| - | # curl -X GET 'http://localhost:9200' | + | |
| - | или | + | |
| # curl --noproxy localhost -X GET 'http://localhost:9200' | # curl --noproxy localhost -X GET 'http://localhost:9200' | ||
| + | или | ||
| + | # curl -X GET 'http://localhost:9200' | ||
| </code> | </code> | ||
| Line 114: | Line 124: | ||
| * [[https://www.elastic.co/guide/en/kibana/current/deb.html|Install Kibana with Debian package]] | * [[https://www.elastic.co/guide/en/kibana/current/deb.html|Install Kibana with Debian package]] | ||
| + | |||
| + | * [[Управление ПО в Linux#Подключение сторонних репозиториев]] | ||
| + | |||
| + | <code> | ||
| + | # apt install kibana | ||
| + | </code> | ||
| ==== Настройка и запуск ==== | ==== Настройка и запуск ==== | ||
| Line 134: | Line 150: | ||
| ==== Подключение ==== | ==== Подключение ==== | ||
| - | * http://192.168.X.10:5601/status | + | Задержка 2-3 минуты |
| + | * http://192.168.X.10:5601/status | ||
| * http://192.168.X.10:5601/ | * http://192.168.X.10:5601/ | ||
| ==== Примеры запросов ==== | ==== Примеры запросов ==== | ||
| + | |||
| + | * Management - Dev Tools | ||
| + | |||
| <code> | <code> | ||
| GET _search | GET _search | ||
| Line 192: | Line 212: | ||
| === Filebeat Netflow Top-N === | === Filebeat Netflow Top-N === | ||
| - | Elasticsearch Query DSL | + | Network Direction -> Inbound |
| + | |||
| + | или | ||
| + | |||
| + | Add filter -> Edit as Query DSL -> Elasticsearch Query DSL | ||
| <code> | <code> | ||
| { | { | ||
| Line 236: | Line 260: | ||
| } | } | ||
| } | } | ||
| - | </code><code> | + | </code> |
| + | |||
| + | Длится 3-4 минуты | ||
| + | |||
| + | <code> | ||
| # /usr/share/logstash/bin/logstash-plugin install logstash-output-exec | # /usr/share/logstash/bin/logstash-plugin install logstash-output-exec | ||
| </code> | </code> | ||
| Line 278: | Line 306: | ||
| </code><code> | </code><code> | ||
| #!/bin/sh | #!/bin/sh | ||
| - | |||
| - | #echo $1 >> /tmp/cisco-backup-config-logstash.log | ||
| #ip=$1 | #ip=$1 | ||
| ip=`echo $1 | cut -d: -f2 | cut -d'}' -f1` | ip=`echo $1 | cut -d: -f2 | cut -d'}' -f1` | ||
| - | #cisco_name=`getent hosts $1 | awk '{ print $NF }'` | + | #cisco_name=`host $ip | awk '{ print $NF }' | cut -d. -f1` |
| - | cisco_name=`host $ip | awk '{ print $NF }' | cut -d. -f1` | + | cisco_name=`getent hosts $ip | awk '{ print $NF }'` |
| + | #echo $1 $ip $cisco_name >> /tmp/cisco-backup-config-logstash.log | ||
| /usr/bin/sshpass -p cisco /usr/bin/scp ${cisco_name}:running-config /srv/tftp/${cisco_name}-running-config | /usr/bin/sshpass -p cisco /usr/bin/scp ${cisco_name}:running-config /srv/tftp/${cisco_name}-running-config | ||
| Line 331: | Line 358: | ||
| </code><code> | </code><code> | ||
| # filebeat test config -e -c /etc/filebeat/filebeat.yml | # filebeat test config -e -c /etc/filebeat/filebeat.yml | ||
| + | ... | ||
| + | Config OK | ||
| systemctl enable filebeat | systemctl enable filebeat | ||
| Line 359: | Line 388: | ||
| # filebeat setup -e | # filebeat setup -e | ||
| + | 2 минуты | ||
| # cat /etc/filebeat/modules.d/netflow.yml | # cat /etc/filebeat/modules.d/netflow.yml | ||
сервисы_elk.txt · Last modified: 2024/02/19 12:13 by val
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
