{"id":158,"date":"2020-03-14T17:02:29","date_gmt":"2020-03-14T08:02:29","guid":{"rendered":"http:\/\/www.skyer9.pe.kr\/wordpress\/?p=158"},"modified":"2020-03-28T22:07:33","modified_gmt":"2020-03-28T13:07:33","slug":"elk-%ec%8a%a4%ed%83%9d%ec%97%90-nginx-%eb%a1%9c%ea%b7%b8-%ec%a0%84%ec%86%a1%ed%95%98%ea%b8%b0","status":"publish","type":"post","link":"https:\/\/www.skyer9.pe.kr\/wordpress\/?p=158","title":{"rendered":"ELK \uc2a4\ud0dd\uc5d0 NGINX \ub85c\uadf8 \uc804\uc1a1\ud558\uae30"},"content":{"rendered":"

ELK \uc2a4\ud0dd\uc5d0 NGINX \ub85c\uadf8 \uc804\uc1a1\ud558\uae30<\/h1>\n

JAVA 8 \uc774\uc0c1\uc774 \ud544\uc694\ud569\ub2c8\ub2e4. \uc124\uce58\ub418\uc5b4 \uc788\uc9c0 \uc54a\uc73c\uba74 \uc5ec\uae30<\/a> \ub97c \ucc38\uc870\ud574\uc11c \uc124\uce58\ud569\ub2c8\ub2e4.<\/p>\n

ELK \uc2a4\ud0dd\uc774 \ud544\uc694\ud569\ub2c8\ub2e4. \uc124\uce58\ub418\uc5b4 \uc788\uc9c0 \uc54a\ub2e4\uba74 \uc5ec\uae30<\/a> \ub97c \ucc38\uc870\ud574\uc11c \uc124\uce58\ud569\ub2c8\ub2e4.<\/p>\n

Logstash \uc124\uc815\ud558\uae30<\/h1>\n

\uba54\ubaa8\ub9ac\uac00 \uc791\uc740 \uacbd\uc6b0, JVM \uba54\ubaa8\ub9ac \uc124\uc815\uc744 \ubcc0\uacbd\ud574 \uc90d\ub2c8\ub2e4.<\/p>\n

sudo vi \/etc\/logstash\/jvm.options\n......\n-Xms256m\n-Xmx256m\n......<\/code><\/pre>\n
sudo vi \/etc\/logstash\/logstash.yml\n......\npath.data: \/var\/lib\/logstash\npath.config: \/etc\/logstash\/conf.d\npath.logs: \/var\/log\/logstash\n......<\/code><\/pre>\n
sudo vi \/etc\/logstash\/conf.d\/logstash-nginx-es.conf<\/code><\/pre>\n
input {\n    beats {\n        port => 5400\n        ssl => false\n        # ssl => true\n        # ssl_certificate_authorities => ["\/etc\/elk-certs\/elk-ssl.crt"]\n        # ssl_certificate => "\/etc\/elk-certs\/elk-ssl.crt"\n        # ssl_key => "\/etc\/elk-certs\/elk-ssl.key"\n        # ssl_verify_mode => "force_peer"\n    }\n}\n\nfilter {\n    grok {\n        match => [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]\n        overwrite => [ "message" ]\n    }\n    mutate {\n        convert => ["response", "integer"]\n        convert => ["bytes", "integer"]\n        convert => ["responsetime", "float"]\n    }\n    # geoip {\n    #     source => "clientip"\n    #     target => "geoip"\n    #     add_tag => [ "nginx-geoip" ]\n    # }\n    date {\n        match => [ "timestamp" , "dd\/MMM\/YYYY:HH:mm:ss Z" ]\n        remove_field => [ "timestamp" ]\n    }\n    useragent {\n        source => "agent"\n    }\n}\n\noutput {\n    elasticsearch {\n        hosts => ["localhost:9200"]\n        index => "weblogs-%{+YYYY.MM.dd}"\n        document_type => "nginx_logs"\n    }\n    stdout { codec => rubydebug }\n}<\/code><\/pre>\n
sudo systemctl start logstash\nsudo systemctl enable logstash<\/code><\/pre>\n
\uc544\ub798 \uba85\ub839\uc73c\ub85c logstash \uac00 \uc2e4\ud589\ub418\uace0 \uc788\uc74c\uc744 \ud655\uc778\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n
netstat -tulpn | grep 5400<\/code><\/pre>\n
gpg key \ucd94\uac00<\/h2>\n
\uc6f9\uc11c\ubc84\uac00 ELK \uc11c\ubc84\uc640 \ub2e4\ub974\uba74 gpg key \ub97c \ucd94\uac00\ub85c \uc124\uce58\ud574 \uc8fc\uc5b4\uc57c \ud569\ub2c8\ub2e4.<\/p>\n
# gpg key \ucd94\uac00\nwget -qO - https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch | sudo apt-key add -\n\n# ElasticSearch 7.x \ucd94\uac00\necho "deb https:\/\/artifacts.elastic.co\/packages\/7.x\/apt stable main" | sudo tee -a \/etc\/apt\/sources.list.d\/elastic-7.x.list<\/code><\/pre>\n
Filebeat \uc124\uce58\ud558\uae30<\/h1>\n
sudo apt update\nsudo apt install filebeat<\/code><\/pre>\n
sudo mv \/etc\/filebeat\/filebeat.yml \/etc\/filebeat\/filebeat.yml.org\nsudo vi \/etc\/filebeat\/filebeat.yml<\/code><\/pre>\n
filebeat.inputs:\n- type: log\n  paths:\n    - \/var\/log\/nginx\/*.log\n  exclude_files: ['\\.gz$']\n  # scan_frequency: 10s\n\noutput.logstash:\n  hosts: ["172.31.31.196:5400"]\n  # ssl.certificate_authorities: ["\/etc\/elk-certs\/elk-ssl.crt"]\n  # ssl.certificate: "\/etc\/elk-certs\/elk-ssl.crt"\n  # ssl.key: "\/etc\/elk-certs\/elk-ssl.key"<\/code><\/pre>\n
sudo systemctl start filebeat\nsudo systemctl enable filebeat<\/code><\/pre>\n
\uc5d0\ub7ec\uac00 \ubc1c\uc0dd\ud558\uba74 \uc544\ub798\uc758 \uba85\ub839\uc73c\ub85c \ub85c\uadf8\ub97c \ud655\uc778\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n
tail -n 100 \/var\/log\/syslog<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
ELK \uc2a4\ud0dd\uc5d0 NGINX \ub85c\uadf8 \uc804\uc1a1\ud558\uae30 JAVA 8 \uc774\uc0c1\uc774 \ud544\uc694\ud569\ub2c8\ub2e4. \uc124\uce58\ub418\uc5b4 \uc788\uc9c0 \uc54a\uc73c\uba74 \uc5ec\uae30 \ub97c \ucc38\uc870\ud574\uc11c \uc124\uce58\ud569\ub2c8\ub2e4. ELK \uc2a4\ud0dd\uc774 \ud544\uc694\ud569\ub2c8\ub2e4. \uc124\uce58\ub418\uc5b4 \uc788\uc9c0 \uc54a\ub2e4\uba74 \uc5ec\uae30 \ub97c \ucc38\uc870\ud574\uc11c \uc124\uce58\ud569\ub2c8\ub2e4. Logstash \uc124\uc815\ud558\uae30 \uba54\ubaa8\ub9ac\uac00 \uc791\uc740 \uacbd\uc6b0, JVM \uba54\ubaa8\ub9ac \uc124\uc815\uc744 \ubcc0\uacbd\ud574 \uc90d\ub2c8\ub2e4. sudo vi \/etc\/logstash\/jvm.options …… -Xms256m -Xmx256m …… sudo vi \/etc\/logstash\/logstash.yml …… path.data: \/var\/lib\/logstash path.config: \/etc\/logstash\/conf.d path.logs: \/var\/log\/logstash …… sudo\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-158","post","type-post","status-publish","format-standard","hentry","category-elasticsearch"],"_links":{"self":[{"href":"https:\/\/www.skyer9.pe.kr\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/158","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.skyer9.pe.kr\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.skyer9.pe.kr\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.skyer9.pe.kr\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.skyer9.pe.kr\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=158"}],"version-history":[{"count":8,"href":"https:\/\/www.skyer9.pe.kr\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/158\/revisions"}],"predecessor-version":[{"id":349,"href":"https:\/\/www.skyer9.pe.kr\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/158\/revisions\/349"}],"wp:attachment":[{"href":"https:\/\/www.skyer9.pe.kr\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=158"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.skyer9.pe.kr\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=158"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.skyer9.pe.kr\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=158"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}