[2022.04.28] How to set env ELK Stack on Ubuntu 20.04 ? (v7.x.x)

[2022.04.28] How to set env ELK Stack on Ubuntu 20.04 ? (v7.x.x)

 

 

 

elasticsearch.yml 

path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch

network.host: 0.0.0.0
http.port: 9200
discovery.type: single-node
xpack.security.enabled: true     # 실행 안된다면 7번 line 주석처리

vmadmin@vmadmin-virtual-machine:/usr/share/elasticsearch/bin$ ./elasticsearch-setup-passwords auto
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user.
The passwords will be randomly generated and printed to the console.
Please confirm that you would like to continue [y/N]y


Changed password for user apm_system
PASSWORD apm_system = 5LfAkXEFd3BRmqg3PfVj

Changed password for user kibana_system
PASSWORD kibana_system = a3m3WKCFPl0EmwylALg1

Changed password for user kibana
PASSWORD kibana = a3m3WKCFPl0EmwylALg1

Changed password for user logstash_system
PASSWORD logstash_system = EgM2lWnYEWNQ9TIxbXST

Changed password for user beats_system
PASSWORD beats_system = 9MUvDj0jsHIBhYQotLvO

Changed password for user remote_monitoring_user
PASSWORD remote_monitoring_user = gvYgYlIbbBvf5yd2YtXb

Changed password for user elastic
PASSWORD elastic = zwE6roMiRvKLL3JQG4G5

kibana.yml 수정 2가지 경로 모두 해줘야함 

sudo vi /etc/kibana/kibana.yml

server.port: 5601
server.host: 0.0.0.0
elasticsearch.hosts: ["http://localhost:9200"]


elasticsearch.username: "kibana"          # kibana_system -> kibana로 변경
elasticsearch.password: "a3m3WKCFPl0EmwylALg1"

sudo cp /etc/kibana/kibana.yml /usr/share/kibana/config/kibana.yml

 

 

logstsah 실행시 권한 부여

sudo chown -R vmadmin:vmadmin /usr/share/logstash/data/
sudo chown -R vmadmin:vmadmin /var/lib/logstash/
sudo chown -R vmadmin:vmadmin /usr/share/logstash/logstash-core/lib/logstash/settings.rb

sudo mkdir /usr/share/logstash/data/queue
sudo chown -R vmadmin:vmadmin /usr/share/logstash/data/queue
sudo chown -R vmadmin:vmadmin /var/log/logstash/