Graylog2.2详细部署安装

elk不是很善于处理多行日志,同样也不能保留原始日志格式,Graylog可以收集监控多种不同应用的日志,包括文件,系统日志,在客户端方面支持手工插件等,而且官网提供多种安装方式,安装便捷,部署在一台主机即可,并且他可以进行规则报警,我们来看如下:

1,一体化方案,安装方便,不像ELK有3个独立系统间的集成问题。
2,采集原始日志,并可以事后再添加字段,比如http_status_code,response_time等等。
3,自己开发采集日志的脚本,并用curl/nc发送到Graylog Server,发送格式是自定义的GELF,Flunted和Logstash都有相应的输出GELF消息的插件。自己开发带来很大的自由度。实际上只需要用inotifywait监控日志的modify事件,并把日志的新增行用curl/netcat发送到Graylog Server就可。
4,搜索结果高亮显示,就像google一样。
5,搜索语法简单,比如: source:mongo AND reponse_time_ms:>5000,避免直接输入elasticsearch搜索json语法
6,搜索条件可以导出为elasticsearch的搜索json文本,方便直接开发调用elasticsearch rest api的搜索脚本。
本次安装最新版本2.2

Graylog(和ELK)具有特殊的操作模式(日志处理固有的),定期创建新的索引。因此,由于架构已经在较高级别(跨索引)上划分,因此不需要分割每个单独的索引。保留=保留标准*群集中最大索引数。
官网:graylog.org
官网文档:http://docs.graylog.org/en/latest/index.html

mongodb安装
docker安装:

curl -Lk https://raw.githubusercontent.com/LinuxEA-Mark/docker-mongodb/master/docker_install_mongodb.sh|bask

常规安装:


[root@linuxea.com ~]# yum install java-1.8.0-openjdk-headless.x86_64 epel-release pwgen -y
[root@linuxea.com ~]# cat > /etc/yum.repos.d/mongodb-org-3.2.repo << EOF
[mongodb-org-3.2]
name = MongoDB Repository
baseurl = https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/3.2/x86_64/
gpgcheck = 1
enabled = 1
gpgkey = https://www.mongodb.org/static/pgp/server-3.2.asc
EOF
[root@linuxea.com ~]# yum install mongodb-org -y
[root@linuxea.com ~]# chkconfig --add mongod
[root@linuxea.com ~]# systemctl daemon-reload
[root@linuxea.com ~]# systemctl enable mongod.service
[root@linuxea.com ~]# systemctl start mongod.service

elasticsearch安装

[root@linuxea.com ~]# rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch
[root@linuxea.com ~]# cat > /etc/yum.repos.d/elasticsearch.repo << EOF
[elasticsearch-2.x]
name=Elasticsearch repository for 2.x packages
baseurl=https://packages.elastic.co/elasticsearch/2.x/centos
gpgcheck=1
gpgkey=https://packages.elastic.co/GPG-KEY-elasticsearch
enabled=1
EOF
[root@linuxea.com ~]# yum install elasticsearch -y

配置:

[root@linuxea.com /etc/rsyslog.d]# egrep -v "^$|^#" /etc/elasticsearch/elasticsearch.yml 
cluster.name: graylog
path.data: /data/Elasticsearch
path.logs: /data/Elasticsearch/logs
network.host: 10.10.240.117
http.port: 9200

启动:

[root@linuxea.com ~]# chkconfig --add elasticsearch
[root@linuxea.com ~]# systemctl daemon-reload
[root@linuxea.com ~]# systemctl enable elasticsearch.service
[root@linuxea.com ~]# systemctl restart elasticsearch.service

graylog-server安装:

[root@linuxea.com ~]# yum install -y java-1.8.0-openjdk-headless.x86_64
[root@linuxea.com ~]# rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-2.2-repository_latest.rpm
[root@linuxea.com ~]# yum install graylog-server -y 
[root@linuxea.com /data/mongodb]# cat /etc/graylog/server/server.conf
is_master = true
node_id_file = /etc/graylog/server/node-id
root_username = admin
root_timezone = Asia/Shanghai
password_secret = ef92b778bafe771e89245b89ecbc08a44a4e166c06659911881f383d4473e94f
root_password_sha2 = 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8
plugin_dir = /usr/share/graylog-server/plugin
rest_listen_uri = http://10.10.240.117:9000/api/
web_listen_uri = http://10.10.240.117:9000/
web_endpoint_uri = http://10.10.240.117:9000/api
web_enable = true
web_enable_cors = true
elasticsearch_discovery_zen_ping_unicast_hosts = 10.10.240.117:9300
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
retention_strategy = delete
elasticsearch_shards = 1
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
elasticsearch_cluster_name = graylog
allow_leading_wildcard_searches = false
allow_highlighting = true
elasticsearch_analyzer = standard
output_batch_size = 500
output_flush_interval = 1
output_fault_count_threshold = 5
output_fault_penalty_seconds = 30
processbuffer_processors = 5
outputbuffer_processors = 3
processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://localhost/graylog
mongodb_max_connections = 1000
mongodb_threads_allowed_to_block_multiplier = 5
content_packs_dir = /usr/share/graylog-server/contentpacks
content_packs_auto_load = grok-patterns.json
proxied_requests_thread_pool_size = 32

直接admin,password登陆

2 分享

您可以选择一种方式赞助本站

支付宝扫码赞助

支付宝扫码赞助

日期: 2017-03-29分类: ELK Stack

标签: elk

发表评论