6.4.6.2 X-Pack on Logstash
最后更新于
这有帮助吗?
最后更新于
这有帮助吗?
请参考官方文档完成部署 , 部署步骤如下
Run bin/logstash-plugin install
from the Logstash installation directory.
The plugin install scripts require direct internet access to download and install X-Pack. If your server doesn’t have internet access, specify the location of the X-Pack zip file that you downloaded to a temporary directory.
Logstash needs to be able to manage index templates, create indices, and write and delete documents in the indices it creates.
Use the the Management > Roles UI in Kibana or the role
API to create a logstash_writer
role. For cluster privileges, add manage_index_templates
and monitor
. For indices privileges, add write
, create
, delete
, and create_index
.
If you plan to use index lifecycle management, also add manage_ilm
for cluster and manage
and manage_ilm
for indices.
The cluster needs the
manage_ilm
privilege if index lifecycle management is enabled.If you use a custom Logstash index pattern, specify your custom pattern instead of the default
logstash-*
pattern.If index lifecycle management is enabled, the role requires the
manage
andmanage_ilm
privileges to load index lifecycle policies, create rollover aliases, and create and manage rollover indices.
Create a logstash_internal
user and assign it the logstash_writer
role. You can create users from the Management > Users UI in Kibana or through the user
API:
Configure Logstash to authenticate as the logstash_internal
user you just created. You configure credentials separately for each of the Elasticsearch plugins in your Logstash .conf
file. For example:
xpack.monitoring.enabled
设置为true
或false
来打开或者关闭monitoing, 默认为关闭
xpack.monitoring.elasticsearch.url
接受logstash发送的metries的elasticsearch地址, ["http://es-prod-node-1:9200", "http://es-prod-node-2:9200"]
xpack.monitoring.elasticsearch.username
and xpack.monitoring.elasticsearch.password
elasticsearch开启了认证功能需要提供logstash_system
的用户名和密码,
xpack.monitoring.elasticsearch.sniffing
将嗅探设置为true
,以便发现elasticsearch集群的其他节点,默认值为false
。
xpack.monitoring.collection.interval
控制在logstash端收集和发布metries的时间, 默认为10s
编辑logstash.yml
, 添加如下内容
开启X-Pack Management功能后,启动logstash的时候就不用再配置logstash.conf文件了,启动的时候也不用再使用-f
指定这个文件进行启动了, 开启这个功能
xpack.management.enabled
设置为true
表示为Logstash开启X-Pack 集中式配置管理。
xpack.management.logstash.poll_interval
Logstash实例轮询来自Elasticsearch的管道更改的频率。默认值为5s。
xpack.management.pipeline.id
指定以逗号分隔的管道标识列表,以便为集中式管道生产管理注册。更改此设置后,您需要重新启动Logstash来使更改生效。 需要登录kibana
--> management
--> logstash
--> pipelines
创建pipeline
xpack.management.elasticsearch.url
xpack.management.elasticsearch.username
and xpack.management.elasticsearch.password
编辑logstash.yml
添加如下内容