【Kibana】Linux部署最新版8.x

摘要

The Elastic Stack，包括Elasticsearch、Kibana、Beats和Logstash（也成为ELK Stack）

Elasticsearch：简称ES，是一个开源的高扩展的分布式全文搜索引擎，是整个Elastic Stack技术栈的核心。它可以近乎实时地存储、检索数据；本身扩展性很好，可以扩展到上百台服务器，处理PB级的数据。

本文主要讲解如何部署Kibana，使用最新版8.17.0。

官网

• 下载页面: https://www.elastic.co/cn/downloads/kibana

从Elasticsearch生成service token

运行命令

curl -ik -u elastic:$ELASTIC_PASSWORD -XPOST https://localhost:9200/_security/service/elastic/kibana/credential/token/kibana-token

返回

HTTP/1.1 200 OK
X-elastic-product: Elasticsearch
content-type: application/json
content-length: 131

{"created":true,"token":{"name":"kibana-token","value":"AAEAAWVsYXN0aWMva2liYW5hL2tpYmFuYS10b2tlbjp5SGF2dnVFV1JmdVkwTGtiR0xkSzlR"}}

验证service token

运行命令

curl -ik -H "Authorization: Bearer AAEAAWVsYXN0aWMva2liYW5hL2tpYmFuYS10b2tlbjp5SGF2dnVFV1JmdVkwTGtiR0xkSzlR" https://localhost:9200/_security/_authenticate

返回

HTTP/1.1 200 OK
X-elastic-product: Elasticsearch
content-type: application/json
content-length: 400

{"username":"elastic/kibana","roles":[],"full_name":"Service account - elastic/kibana","email":null,"token":{"name":"kibana-token","type":"_service_account_index"},"metadata":{"_elastic_service_account":true},"enabled":true,"authentication_realm":{"name":"_service_account","type":"_service_account"},"lookup_realm":{"name":"_service_account","type":"_service_account"},"authentication_type":"token"}

修改kibana.yml

server.host: "0.0.0.0"
server.ssl.enabled: true
server.ssl.certificate: "${ELK_HOME}/elasticsearch-${ELK_VERSION}/config/certs/server.crt"
server.ssl.key: "${ELK_HOME}/elasticsearch-${ELK_VERSION}/config/certs/server.key"
elasticsearch.hosts: ["https://elk1:9200","https://elk2:9200","https://elk3:9200"]
elasticsearch.serviceAccountToken: "AAEAAWVsYXN0aWMva2liYW5hL2tpYmFuYS10b2tlbjp5Q3Y0YUpsYVFXeVdjeWsxMUx0elln"
elasticsearch.ssl.certificateAuthorities: [ "${ELK_HOME}/elasticsearch-${ELK_VERSION}/config/certs/ca.crt" ]
elasticsearch.ssl.verificationMode: full
logging.appenders.default:
  type: rolling-file
  fileName: logs/kibana.log
  policy:
    type: size-limit
    size: 256mb
  strategy:
    type: numeric
    max: 10
  layout:
    type: pattern
pid.file: kibana.pid    
i18n.locale: "zh-CN"
xpack.encryptedSavedObjects.encryptionKey: 10d89f5ee638b21810c142711475c520
xpack.reporting.encryptionKey: 4d25421b901b15eb278a0c826805683a
xpack.security.encryptionKey: 89f10e520d04bae18a6eefd717e306e8
# 禁用fleet，会去请求https://epr.elastic.co
xpack.fleet.agents.enabled: false
# 不主动发送用户行为报告给elastic
telemetry.optIn: false
# 不允许修改telemetry.optIn
telemetry.allowChangingOptInStatus: false

开启告警规则功能

如果出现错误提示: 必须配置加密密钥才能使用 Alerting，按如下方法处理

• 生成加密Key，运行命令kibana-encryption-keys generate，生成如下内容

Settings:
xpack.encryptedSavedObjects.encryptionKey: 10d89f5ee638b21810c142711475c520
xpack.reporting.encryptionKey: 4d25421b901b15eb278a0c826805683a
xpack.security.encryptionKey: 89f10e520d04bae18a6eefd717e306e8

把生成的这三行配置到kibana.yml中，重启kibana服务

• 开源免费版只有2个连接器: 服务器日志、索引
  

启动

nohup ./bin/kibana >logs/kibana.log 2>&1 &
tail -fn200 logs/kibana.log

• 启动后无法通过ps -ef|grep kibana查看进程
• 需要通过端口查看pid: netstat -anp|grep 5601
• 然后再查看进程信息: ps -f -p <PID>

停止

kill `cat kibana.pid`

查看kibana状态

浏览器输入: https://localhost:5601/status

测试&验证

• 获取所有空间: curl -ik -u elastic:$ELASTIC_PASSWORD https://localhost:5601/api/spaces/space

堆栈监测截图

已完成ELK安装后的截图