{"id":1335,"date":"2024-09-04T08:30:51","date_gmt":"2024-09-04T00:30:51","guid":{"rendered":"http:\/\/blue.yn.cn\/?p=1335"},"modified":"2024-09-04T09:00:53","modified_gmt":"2024-09-04T01:00:53","slug":"kibana%e5%ae%89%e5%85%a8%e8%ae%bf%e9%97%ae%e6%8e%a7%e5%88%b6","status":"publish","type":"post","link":"http:\/\/blue.yn.cn\/?p=1335","title":{"rendered":"kibana\u5b89\u5168\u8bbf\u95ee\u63a7\u5236"},"content":{"rendered":"<ul>\n<li>\u9ed8\u8ba4\u60c5\u51b5\u4e0b\uff0c<code>kibana<\/code>\u53ef\u4ee5\u76f4\u63a5\u901a\u8fc7\u6d4f\u89c8\u5668\u6253\u5f00\u8fdb\u884c\u64cd\u4f5c\uff0c\u8fd9\u6837\u7684\u8bdd\u4efb\u4f55\u4eba\u90fd\u53ef\u4ee5\u901a\u8fc7\u8be5\u65b9\u5f0f\u6253\u5f00\uff0c\u53ca\u5176\u4e0d\u5b89\u5168\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7\u5982\u4e0b\u4e24\u79cd\u65b9\u5f0f\u6765\u5b9e\u73b0\u8bbf\u95ee\u63a7\u5236\uff1b\n<ul>\n<li>\u65b9\u5f0f1\uff1a<code>nginx+kibana<\/code>\u975e\u5e38\u7b80\u5355\u5b9e\u73b0\u65b9\u5f0f\uff1b<\/li>\n<li>\u65b9\u5f0f2\uff1a<code>kibana roles<\/code>\u6bd4\u8f83\u63a8\u8350\u65b9\u5f0f<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3>\u57fa\u4e8eRBAC\u8bbf\u95ee\u63a7\u5236<\/h3>\n<ul>\n<li>\u4ece<code>elastic stack6.8<\/code>\u548c<code>7.1<\/code>\u5f00\u59cb\uff0c\u5728\u9ed8\u8ba4\u5206\u53d1\u5305\u4e2d\u514d\u8d39\u63d0\u4f9b\u591a\u9879\u5b89\u5168\u529f\u80fd\uff0c\u4f8b\u5982<code>TLS<\/code>\u52a0\u5bc6\u901a\u4fe1\u3001\u57fa\u4e8e\u89d2\u8272\u7684\u8bbf\u95ee\u63a7\u5236<code>RBAC<\/code>\u7b49\u7b49\u3002<\/li>\n<\/ul>\n<h4>\u542f\u7528elastic tls<\/h4>\n<pre><code class=\"language-bash\">\/usr\/share\/elasticsearch\/bin\/elasticsearch-certutil cert -out \/etc\/elasticsearch\/elastic-certificates.p12 -pass &quot;&quot;\n\nchmod 660 \/etc\/elasticsearch\/elastic-certificates.p12<\/code><\/pre>\n<h4>\u914d\u7f6eelastic<\/h4>\n<ul>\n<li>\u7f16\u8f91<code>elastic<\/code>\u914d\u7f6e\u6587\u4ef6\uff0c\u6dfb\u52a0\u5982\u4e0b\u5185\u5bb9\uff1b\uff08\u6240\u6709\u8282\u70b9\u90fd\u9700\u8981\u6dfb\u52a0\uff09<\/li>\n<\/ul>\n<pre><code class=\"language-bash\">vim \/etc\/elasticsearch\/elasticsearch.yml\nxpack.security.enabled: true\nxpack.security.transport.ssl.enabled: true\nxpack.security.transport.ssl.verification_mode: certificate\nxpack.security.transport.ssl.keystore.path: elastic-certificates.p12\nxpack.security.transport.ssl.truststore.path: elastic-certificates.p12<\/code><\/pre>\n<h4>\u62f7\u8d1dTLS\u8bc1\u4e66<\/h4>\n<ul>\n<li>\u62f7\u8d1d<code>TLS<\/code>\u8bc1\u4e66\u81f3\u96c6\u7fa4\u7684\u6240\u6709<code>node<\/code>\u8282\u70b9\uff1b<\/li>\n<\/ul>\n<p><code>scp -rp \/etc\/elasticsearch\/elastic-certificates.p12 root@x.x.x.x:\/etc\/elasticsearch\/<\/code><\/p>\n<ul>\n<li>\u91cd\u542f\u6240\u6709<code>elastic<\/code>\u96c6\u7fa4\u8282\u70b9\uff1b<\/li>\n<\/ul>\n<p><code>systemctl restart elasticsearch.service<\/code><\/p>\n<h4>\u8bbe\u7f6eelastic\u96c6\u7fa4\u5bc6\u7801<\/h4>\n<ul>\n<li>\u4e00\u65e6\u4e3b\u8282\u70b9\u5f00\u59cb\u8fd0\u884c\uff0c\u4fbf\u53ef\u4ee5\u4e3a\u96c6\u7fa4\u8bbe\u7f6e\u5bc6\u7801\u4e86\uff1b\n<ul>\n<li><code>auto<\/code>\u4f1a\u4e3a\u4e0d\u540c\u7684\u5185\u90e8\u5806\u6808\u751f\u6210\u968f\u673a\u5bc6\u7801\uff1b<\/li>\n<li><code>interactive<\/code>\u914d\u7f6e\u53ef\u4ee5\u624b\u52a8\u5b9a\u4e49\u5bc6\u7801\uff1b<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<pre><code class=\"language-bash\">\/usr\/share\/elasticsearch\/bin\/elasticsearch-setup-passwords auto\n\nChanged password for user apm_system\nPASSWORD apm_system =\n\nChanged password for user kibana_system\nPASSWORD kibana_system =\n\nChanged password for user kibana\nPASSWORD kibana =\n\nChanged password for user logstash_system\nPASSWORD logstash_system =\n\nChanged password for user beats_system\nPASSWORD beats_system =\n\nChanged password for user remote_monitoring_user\nPASSWORD remote_monitoring_user =\n\nChanged password for user elastic\nPASSWORD elastic =<\/code><\/pre>\n<h4>\u914d\u7f6ekibana\u8ba4\u8bc1<\/h4>\n<ul>\n<li>\u5728<code>kibana<\/code>\u4e2d\u5b9e\u73b0\u5b89\u5168\u6027\uff0c\u6211\u4eec\u9700\u8981\u4e3a<code>kibana<\/code>\u7528\u6237\u6dfb\u52a0\u5bc6\u7801\u3002<\/li>\n<\/ul>\n<pre><code class=\"language-bash\">vim \/etc\/kibana\/kibana.yml\nelasticsearch.username: &quot;kibana_system&quot;\nelasticsearch.password: &quot;xxxxxx&quot;\n\nsystemctl restart kibana<\/code><\/pre>\n<h4>\u914d\u7f6elogstash<\/h4>\n<ul>\n<li><code>logstash<\/code>\u6570\u636e\u4f20\u8f93\u81f3<code>ES<\/code>\u96c6\u7fa4\uff0c\u9700\u8981\u521b\u5efa\u4e00\u4e2a<code>super<\/code>\u89d2\u8272\u7684\u7528\u6237\uff1b<\/li>\n<\/ul>\n<pre><code class=\"language-bash\">vim \/etc\/logstash\/conf.d\/network.logstash.conf\nelasticsearch {\n      index =&gt; &quot;9306-arplog-%{+YYYY.MM.dd}&quot;\n      hosts =&gt; [&quot;x.x.x.x:9200&quot;]\n      user =&gt; &quot;elastic&quot;\n      password =&gt; &quot;xxxxxx&quot;\n    }<\/code><\/pre>\n<h4>\u914d\u7f6efilebeat<\/h4>\n<pre><code class=\"language-bash\">vim \/etc\/filebeat\/filebeat.yml\noutput.elasticsearch:\n  hosts: [&quot;x.x.x.x:9200&quot;]\n  username: &quot;elastic&quot;\n  password: &quot;xxxxxx&quot;\n  index: &quot;wordpress-system-%{[agent.version]}-%{+yyyy.MM.dd}&quot;<\/code><\/pre>\n<h4>\u767b\u5f55kibana<\/h4>\n<ul>\n<li>\u6211\u4eec\u901a\u8fc7\u516d\u6d4f\u89c8\u5668\u6253\u5f00<code>http:\/\/kibana.dot.com:5601\/<\/code>\uff0c\u4f7f\u7528<code>elastic<\/code>\u8d85\u7ea7\u7528\u6237\u8fdb\u884c\u767b\u5f55\u3002<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725411471953.png\" alt=\"file\" \/><\/p>\n<h4>\u914d\u7f6eRBAC<\/h4>\n<ul>\n<li>\u5728<code>kibana<\/code>\u4e2d\u5b9e\u73b0<code>rbac<\/code>\uff0c\u70b9\u51fb \u7ba1\u7406 <code>Elastic Stack<\/code>\u7684\u5b89\u5168\u6027\u8bbe\u7f6e\uff0c\u53ef\u4ee5\u5bf9\u7528\u6237\u548c\u89d2\u8272\u8fdb\u884c\u914d\u7f6e\u3002<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725411542154.png\" alt=\"file\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2024\/09\/image-1725411630384.png\" alt=\"file\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u9ed8\u8ba4\u60c5\u51b5\u4e0b\uff0ckibana\u53ef\u4ee5\u76f4\u63a5\u901a\u8fc7\u6d4f\u89c8\u5668\u6253\u5f00\u8fdb\u884c\u64cd\u4f5c\uff0c\u8fd9\u6837\u7684\u8bdd\u4efb\u4f55\u4eba\u90fd\u53ef\u4ee5\u901a\u8fc7\u8be5\u65b9\u5f0f\u6253\u5f00\uff0c\u53ca\u5176\u4e0d\u5b89\u5168\u6211\u4eec\u53ef\u4ee5&#8230; &raquo; <a class=\"read-more-link\" href=\"http:\/\/blue.yn.cn\/?p=1335\">\u9605\u8bfb\u5168\u6587<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[],"class_list":["post-1335","post","type-post","status-publish","format-standard","hentry","category-elk"],"_links":{"self":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts\/1335","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1335"}],"version-history":[{"count":2,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts\/1335\/revisions"}],"predecessor-version":[{"id":1340,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=\/wp\/v2\/posts\/1335\/revisions\/1340"}],"wp:attachment":[{"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1335"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1335"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blue.yn.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1335"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}