日志搜集平台ELK-packetbeat-安装说明

环境：

业务机器安装packetbeat客户端

ES、kibana服务端需要保证启动（本次环境的ES和kibana服务跑在172.16.82.165上）

业务机器端执行安装：

1、下载包

yum install libpcap

curl -L -O https://artifacts.elastic.co/downloads/beats/packetbeat/packetbeat-6.3.2-x86_64.rpm

rpm -vi packetbeat-6.3.2-x86_64.rpm

配置文件如下

[ packetbeat]# cat /etc/packetbeat/packetbeat.yml|egrep -v "^#|^$"              

packetbeat.interfaces.device: any

packetbeat.flows:

  timeout: 30s

  period: 10s

packetbeat.protocols:

- type: icmp

  enabled: true

- type: amqp

  ports: [5672]

- type: cassandra

  ports: [9042]

- type: dns

  ports: [53]

  include_authorities: true

  include_additionals: true

- type: http

  ports: [80, 8080, 8000, 5000, 8002]

- type: memcache

  ports: [11211]

- type: mysql

  ports: [3306]

- type: pgsql

  ports: [5432]

- type: redis

  ports: [6379]

- type: thrift

  ports: [9090]

- type: mongodb

  ports: [27017]

- type: nfs

  ports: [2049]

- type: tls

  ports: [443]

setup.template.settings:

  index.number_of_shards: 3

  #_source.enabled: false

setup.kibana:

  host: "172.16.82.165:5601"

output.elasticsearch:

  hosts: ["172.16.82.165:9200"]

2、kibana导入图

packetbeat setup --dashboards

 packetbeat setup -e \

  -E output.logstash.enabled=false \
  -E output.elasticsearch.hosts=[‘172.16.82.165:9200‘] \
  -E output.elasticsearch.username=packetbeat_internal \
  -E output.elasticsearch.password=YOUR_PASSWORD \
  -E setup.kibana.host=172.16.82.165:5601

备注：

-E output.elasticsearch.username=packetbeat_internal \
-E output.elasticsearch.password=YOUR_PASSWORD \
这两行涉及用户密码，如果我们e没有用户密码配置，可以先不执行这两行

启动packetbeat服务

/etc/init.d/packetbeat start 

然后执行这个测试数据：

curl -XGET ‘http://172.16.82.165:9200/packetbeat-*/_search?pretty‘

之后进入kibana，创新packetbeat-*的索引

会有数据显示展示