elk stack apache log 수집 테스트

 

install jdk

$ sudo add-apt-repository ppa:webupd8team/java

$ sudo apt-get update

$ sudo apt-get -y install oracle-java8-installer

 

install elasticsearch

$ sudo dpkg -i elasticsearch-6.6.2.deb

$ sudo systemctl enable elasticsearch.service

start

$ sudo service elasticsearch start

test

$ curl -XGET 'localhost:9200'

 

apache

/etc/apache2/apache2.conf 에 LogFormat이 있는 부분에 아래 내용 추가

 

LogFormat "{ \"time\":\"%t\", \"clientip\":\"%a\",\"host\":\"%V\", \"request\":\"%U\", \"query\":\"%q\", \"method\":\"%m\", \"status\":\"%>s\", \"userAgent\":\"%{User-agent}i\", \"referer\":\"%{Referer}i\" }" json_format

 

/etc/apache2/sites-enabled/000-defualt.conf 에 아래 내용 추가

CustomLog ${APACHE_LOG_DIR}/jsonaccess.log json_format

 

install logstash

$ sudo dpkg -i logstash-6.6.2.deb

start

$ sudo /usr/share/logstash/bin/logstash -f apache.conf

apache.conf 내용

 

input{ 

     file{ 

         path=>"/var/log/apache2/jsonaccess.log" 

         type=>apache 

         codec=>json 

         start_position=>beginning 

      } 

} 

filter{ 

     geoip{source=>"clientip"} 

} 

output{ 

     elasticsearch{ 

         hosts=>"192.168.56.102:9200" 

         index=>"apache" 

      } 

     stdout { codec => rubydebug } 

}

 

install kibana

$ sudo dpkg -i kibana-6.6.2-amd64.deb

setting

/etc/kibana/kibana.yml

elasticsearch.url: http://{YOUR HOST NAME (default : localhost)}:9200

server.host: {YOUR HOST NAME (default : localhost)}

start

$ /usr/share/kibana/bin/kibana

$ sudo service kibana start

http://{YOUR HOST NAME}:5601

 

 

참고: https://jtoday.tistory.com/51?category=714806

https://teamlab.github.io/jekyllDecent/blog/tutorials/How-To-Install-ELK-Stack-on-Ubuntu