ELK 查詢資料

Reference:

[elk] 教學與介紹

Kibana Query Language

Elasticsearch query string query with not equal to?

 

安裝ELK之後，查詢log的方法。

檢查 Stack Management / Index Management 確認有收到資料。

ELK 安裝 (CentOS 7)

Reference:

[ELK教學]最新CentOS ElasticSearch、Logstash、Kibana、Filebeat ，快速安裝(照著貼上就對了)

Day 11 ELK 收集系統

【Day01】ELK環境建置與介紹

步驟：

安裝CentOS 7

1. software selection: server with GUI
2. security policy: off
3. set fix IP, auto connect
4. disable firewall
• systemctl stop firewalld
• systemctl disable firewalld
• vi /etc/selinux/config; SELINUX=disabled
• setenforce 0

Linux rsyslog server for remote hosts

Reference:

鳥哥的 Linux 私房菜 第十八章、認識與分析登錄檔

Create separated syslog file for each host with rsyslog

rsyslog relp - preventing remote logs from being written to my local /var/log

CentOS Linux 7 以 firewalld 指令設定防火牆規則教學

記錄檔管理工具 – logrotate

環境：

CentOS Linux release 7.9.2009 (Core) / Rocky Linux 9.1 (不同的部分用藍色)

Software Selection: Server with GUI

 

防火牆修改：

firewall-cmd --zone=public --permanent --add-service=syslog
firewall-cmd --reload
 

/etc/rsyslog.conf 設定：

# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# Provides UDP syslog reception
# for parameters see http://www.rsyslog.com/doc/imudp.html
module(load="imudp") # needs to be done just once
input(type="imudp" port="514")

執行 systemctl restart rsyslog