04. Ubuntu - ELK 스택에 NGINX 로그 전송하기

01) Logstash 설정

 

메모리가 적은 경우 JVM 메모리 설정을 변경

 

sudo vi /etc/logstash/jvm.options

 

 

sudo vi /etc/logstash/logstash.yml

 

path.data: /var/lib/logstash
path.config: /etc/logstash/conf.d -> 여기 밑에 logstash-nignx-es.conf 만들것
path.logs: /var/log/logstash 

 

sudo vi /etc/logstash/conf.d/logstash-nginx-es.conf

 

input {
    beats {
        port => 5400
        ssl => false
        # ssl => true
        # ssl_certificate_authorities => ["/etc/elk-certs/elk-ssl.crt"]
        # ssl_certificate => "/etc/elk-certs/elk-ssl.crt"
        # ssl_key => "/etc/elk-certs/elk-ssl.key"
        # ssl_verify_mode => "force_peer"
    }
}

filter {
    grok {
        match => [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
        overwrite => [ "message" ]
    }
    mutate {
        convert => ["response", "integer"]
        convert => ["bytes", "integer"]
        convert => ["responsetime", "float"]
    }
    # geoip {
    #     source => "clientip"
    #     target => "geoip"
    #     add_tag => [ "nginx-geoip" ]
    # }
    date {
        match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
        remove_field => [ "timestamp" ]
    }
    useragent {
        source => "agent"
    }
}

output {
    elasticsearch {
        hosts => ["localhost:9200"]
        index => "weblogs-%{+YYYY.MM.dd}"
        document_type => "nginx_logs"
    }
    stdout { codec => rubydebug }
}

작성 후 logstash 실행.

 

sudo systemctl start logstash

sudo systemctl enable logstash

 

netstat -tulpn | grep 5400으로 logstash가 실행됨을 확인 가능.

 

웹서버가 elk 서버와 다르면 gpg key를 추가로 설치해 주어야 함.

 

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

 

02) Filebeat 설치하기

 

sudo apt update

sudo apt install filebeat

 

 

sudo mv /etc/filebeat/filebeat.yml /etc/filebeat/filebeat.yml.org

sudo vi /etc/filebeat/filebeat.yml

 

filebeat.inputs:
- type: log
  paths:
    - /var/log/nginx/*.log
  exclude_files: ['\.gz$']
  # scan_frequency: 10s

output.logstash:
  hosts: ["x.x.x.x:5400"]
  # ssl.certificate_authorities: ["/etc/elk-certs/elk-ssl.crt"]
  # ssl.certificate: "/etc/elk-certs/elk-ssl.crt"
  # ssl.key: "/etc/elk-certs/elk-ssl.key"

 

작성.

 

sudo systemctl start filebeat

sudo systemctl enable filebeat

 

위 명령으로 실행하고 에러가 발생하면 아래의 명령으로 로그를 확인할 수 있음.

 

tail -n 100 /var/log/syslog