页面“Zabbix 5 4 and 3 LTS安装入门教程”与“Filebeat nginx log”之间的差异

来自linux中国网wiki
(页面间的差异)
跳到导航 跳到搜索
 
 
第1行: 第1行:
==站内资源==
+
[[category:ops]]
[[Zabbix 调用API 批量添加主机]]
 
== zabbix server ==
 
===pre ===
 
这些是官网官方安装文档,记得一定要看
 
  
https://www.zabbix.com/documentation/3.0/manual/installation/install
+
=ins and config=
 +
==Download and install Filebeat==
 +
<pre>
  
https://www.zabbix.org/wiki/InstallOnCentOS_RHEL
 
  
<pre>wget -c https://jaist.dl.sourceforge.net/project/zabbix/ZABBIX%20Latest%20Stable/3.0.8/zabbix-3.0.8.tar.gz
+
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.12.0-amd64.deb
wget -c http://tenet.dl.sourceforge.net/project/zabbix/ZABBIX%20Latest%20Stable/2.2.13/zabbix-2.2.13.tar.gz</pre>
+
sudo dpkg -i filebeat-7.12.0-amd64.deb
 
 
===#配置php变量===
 
<pre>vi /etc/php.ini
 
date.timezone = Asia/Shanghai
 
post_max_size = 32M
 
max_execution_time = 300
 
max_input_time = 300
 
注:更改完之后需要重启nginx和php</pre>
 
 
 
===#安装zabbix所需的组件 ===
 
<pre>yum -y install net-snmp-devel curl-devel
 
#yum -y install curl curl-devel net-snmp net-snmp-devel perl-DBI php-gd php-xml php-bcmath
 
groupadd zabbix && useradd -g zabbix zabbix
 
tar xvf zabbix-3.0.8.tar.gz && cd zabbix-3.0.8
 
#tar xvf zabbix-2.2.13.tar.gz && cd zabbix-2.2.13
 
 
 
#./configure –enable-server –enable-agent –with-mysql –enable-ipv6 –with-net-snmp –with-libcurl –with-libxml2
 
 
 
##或者默认安装路径 make是不用的
 
./configure --sysconfdir=/etc/zabbix --enable-server --enable-proxy --enable-agent --with-mysql=/usr/local/mysql/bin/mysql_config --with-net-snmp --with-libcurl --with-libxml2 && make install
 
 
</pre>
 
</pre>
===添加zabbix服务对应的端口(可以省略,但是官方建议有)===
+
==Edit the configuration ==
<pre>cat >>/etc/services<< EOF
 
zabbix-agent 10050/tcp #Zabbix Agent
 
zabbix-agent 10050/udp #Zabbix Agent
 
zabbix-trapper 10051/tcp #Zabbix Trapper
 
zabbix-trapper 10051/udp #Zabbix Trapper
 
EOF</pre>
 
 
 
===配置文件===
 
<pre>##好像是这个起效果的呢 –sysconfdir=/etc/zabbix 有这个,不用下面的命令了
 
#vim /usr/local/etc/zabbix_server.conf
 
#cd zabbix-2.0.7
 
 
 
#mkdir /etc/zabbix
 
#cp conf/*.conf /etc/zabbix
 
 
 
mkdir /var/log/zabbix ;chown zabbix:zabbix /var/log/zabbix;
 
 
 
 
 
#zabbix web代码
 
mkdir -p /data/www/zabbix;
 
cp -r frontends/php/* /data/www/zabbix
 
 
 
修改zabbix连接的数据库的用户名和密码
 
vi /etc/zabbix/zabbix_server.conf
 
 
 
DBHost=127.0.0.1
 
DBName=zabbix
 
DBUser=zabbix
 
DBPassword='123'
 
DBPort=3306 #如果数据库是用sock文件的方式,这里可以是sock文件的路径
 
 
 
添加数据库Lib文件位置到/etc/ld.so.conf中,并使其生效
 
echo ‘/usr/local/mysql/lib/mysql/’ >> /etc/ld.so.conf
 
 
 
ldconfig
 
 
 
为zabbix的启动、关闭和重启的脚本文件做链接,方便系统可以找得到
 
 
 
给zabbix服务端程序做软链接 我用默认的config 应该是不用的
 
cd /usr/local/zabbix/bin/
 
for i in *;do ln -s /usr/local/zabbix/bin/${i} /usr/bin/${i};done
 
cd /usr/local/zabbix/sbin/
 
for i in *;do ln -s /usr/local/zabbix/sbin/${i} /usr/sbin/${i};done
 
 
 
拷贝zabbix服务端和客户端启动脚本到/etc/init.d目录下.
 
cd misc/init.d/
 
cp fedora/core/zabbix_server /etc/init.d/
 
cp fedora/core/zabbix_agentd /etc/init.d/
 
chmod +x /etc/init.d/zabbix_agentd
 
chmod +x /etc/init.d/zabbix_server</pre>
 
 
 
===3 Create Zabbix database===
 
<pre>SQL scripts are provided for creating database schema and inserting the dataset
 
#https://www.zabbix.com/documentation/3.0/manual/appendix/install/db_scripts
 
#https://www.zabbix.com/documentation/2.2/manual/appendix/install/db_scripts
 
 
 
mysql>create database zabbix character set utf8 collate utf8_bin;;grant all on zabbix.* to zabbix@localhost identified by '123';flush privileges;
 
 
 
将zabbix源码包中的数据导入到新建的zabbix数据库
 
##这个和老的版本有点不同 第一个是zabbix的数据库表结构,要先导入。
 
 
 
. /etc/profile
 
cd ../..
 
mysql -uroot -p'evan' zabbix< database/mysql/schema.sql
 
mysql -uroot -p'evan' zabbix< database/mysql/images.sql
 
mysql -uroot -p'evan' zabbix< database/mysql/data.sql
 
 
 
vi /etc/init.d/zabbix_server # 的可以不改,修改一下变量的值 因为我是默认用 configure
 
# base zabbix dir
 
BASEDIR=/usr/local
 
# binary file
 
ZABBIX_SUCKERD=$BASEDIR/sbin/zabbix_server<pre>
 
 
 
===fping的安装和使用详解===
 
<pre>http://rickie622.blog.163.com/blog/static/2123881120121121111720941/
 
http://netsecurity.51cto.com/art/201101/242200.htm
 
#当然 下载zip包也是可以的
 
git clone https://github.com/schweikert/fping.git
 
cd fping
 
./autogen.sh
 
./configure
 
make -j2 && make install
 
 
 
#修改一下配置文件
 
vim /etc/zabbix_server.conf
 
#vim /usr/local/etc/zabbix_server.conf
 
FpingLocation=/usr/local/sbin/fping</pre>
 
 
 
===启动zabbix,并且添加开机自启动===
 
<pre>service zabbix_server start
 
service zabbix_agentd start #启动服务
 
 
 
chkconfig zabbix_server on
 
chkconfig zabbix_agentd on #开机自启动
 
 
 
在Nginx服务中添加zabbix虚拟主机
 
#vim /usr/local/nginx/conf/vhosts/monitor.conf
 
 
 
这些都不要,不然没有web安装向导的
 
#cd zabbix/conf
 
#cp zabbix.conf.php.example zabbix.conf.php ;
 
#chmod 777 zabbix.conf.php
 
 
 
iptables -I INPUT -p tcp –dport 80 -j ACCEPT
 
 
 
zabbix server is not running
 
Zabbix Server is not running: the information displayed may not be current
 
http://song49.blog.51cto.com/4480450/1200151</pre>
 
 
 
===(4)设置zabbix服务IP和端口,name可以忽略===
 
<pre>
 
ps:
 
post_max_size = 16M
 
PHP option “max_execution_time” 30 300 Fail
 
PHP option “max_input_time” 60 300 Fail
 
PHP option “date.timezone” unknown Fai
 
date.timezone = Asia/Shanghai
 
 
 
PHP option “always_populate_raw_post_data” must be set to “-1”
 
 
 
port 10051
 
 
 
Zabbix frontend is ready! The default user name is Admin, password zabbix.</pre>
 
===超级用户密码修改 ===
 
<pre>
 
2.2 用户名第一个字母要大写 也就是Admin
 
默认的用户名:admin 密码:zabbix
 
 
 
哪里改登录用户和密码呢
 
use zabbix;
 
select userid,alias,passwd from users; #查看
 
 
 
+--------+------------+----------------------------------+
 
| userid | alias      | passwd                          |
 
+--------+------------+----------------------------------+
 
|      1 | Admin      | 5fce1b3e34b520afeffb37ce08c7cd66 |
 
 
 
 
 
#如果为zabbix 3.0  直接这样就行了
 
update users set passwd=MD5('12345') where userid=1;
 
 
 
 
 
#zabbix 2.x
 
重新开个终端,生成一个MD5加密的密码,这里密码设置的是redhat
 
 
 
[root@localhost ~]# echo -n 12345678 |openssl md5 #-n就表示不输入回车符,不加-n,否则就不是这个结果了。
 
(stdin)= 25d55ad283aa400af464c76d713c07ad
 
 
 
接着上面的为admin用户设定一个密码
 
 
 
mysql> update users set passwd='25d55ad283aa400af464c76d713c07ad' where userid = '1';
 
#或者直接使用update users set passwd=md5(“12345678”) where userid=’1′;
 
Query OK, 1 row affected (0.01 sec)
 
Rows matched: 1 Changed: 1 Warnings: 0
 
 
 
mysql> flush privileges;
 
Query OK, 0 rows affected (0.01 sec)
 
 
 
mysql> quit
 
Bye
 
 
 
zabbix登陆账户admin密码修改
 
http://pvbutler.blog.51cto.com/7662323/1734003
 
 
 
yum install ntp ntpdate -y
 
chkconfig ntpd on
 
/etc/init.d/ntpd start
 
 
 
*/30 * * * * /usr/sbin/ntpdate pool.ntp.org
 
 
 
在29行这后添加
 
sed -i ’29a user=mysql’ /etc/my.cnf
 
sed -i ’29a character-set-server=utf8′ /etc/my.cnf
 
sed -i ’29ainnodb_file_per_table=1′ /etc/my.cnf
 
重启mysqld</pre>
 
 
 
===防火墙设置 ===
 
<pre>这个要看一下先,尽量用严格些的防火墙设置
 
 
 
#on zabbix-agent
 
 
 
iptables -A INPUT -s zabbixserverip  -p tcp -m tcp --dport 10050 -m comment --comment "zabbix_server listen " -j ACCEPT
 
#iptables -A INPUT -s zabbixserverip  -p tcp -m tcp --dport 10050 -m comment --comment "zabbix_agentd listen " -j ACCEPT
 
 
 
#这下面的防火墙rule 不要用
 
vi /etc/sysconfig/iptables
 
-A INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT
 
-A INPUT -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPT
 
-A INPUT -m state –state NEW -m tcp -p tcp –dport 10050 -j ACCEPT
 
-A INPUT -m state –state NEW -m tcp -p tcp –dport 10051 -j ACCEPT
 
 
 
/etc/init.d/iptables restart
 
 
 
中文在右上角的用户里面哦
 
 
 
Starting php_fpm /usr/local/php/bin/php-cgi: error while loading shared libraries: libiconv.so.2: cannot open shared object file: No such file or directory
 
failed
 
 
 
by default install the daemon binaries (zabbix_server, zabbix_agentd, zabbix_proxy) in /usr/local/sbin and the client binaries (zabbix_get, zabbix_sender) in /usr/local/bin.</pre>
 
 
 
===4.0 5.2 图像显示字体乱码的解决方法===
 
 
<pre>
 
<pre>
 +
Modify /etc/filebeat/filebeat.yml to set the connection information:
  
1.替换支持中文的字体
+
output.elasticsearch:
#传输字体
+
  hosts: ["<es_url>"]
#50fbe46d4c5c        zabbix/zabbix-web-nginx-pgsql:alpine-5.2-latest
+
   username: "elastic"
docker cp simkai.ttf 50fbe46d4c5c:/usr/share/zabbix/assets/fonts
+
   password: "<password>"
 
+
setup.kibana:
cp  /root/STKAITI.TTF  /usr/share/zabbix/assets/fonts
+
  host: "<kibana_url>"
    
 
2.修改字体配置 php文件
 
#修改 指定的字体 或者直接把你的家体改成和默认同名,而默认的那个先删除 连重启都不用 反正在docker
 
   grep  -rn  BX_GRAPH_FONT_NAM  /usr/share/zabbix/include/defines.inc.php
 
67:define('ZBX_GRAPH_FONT_NAME', 'DejaVuSans'); // font file name
 
 
 
修改
 
sed  -i  's!DejaVuSans!simkai!' include/defines.inc.php
 
define('ZBX_GRAPH_FONT_NAME',          'simkai'); 
 
</pre>
 
 
 
===zabbix-get===
 
<pre>
 
root@zabbix-server ~]#zabbix_get  -s 10.3.10.139 -k "system.hostname"
 
dev-hello-market
 
  
 +
Where <password> is the password of the elastic user, <es_url> is the URL of Elasticsearch, and <kibana_url> is the URL of Kibana.
  
不过使用zabbix_get时必须开启客户端被动模式,要求暴露客户端监听端口。
 
 
</pre>
 
</pre>
[https://blog.csdn.net/cx55887/article/details/83818696 自动化监控--zabbix-get安装使用详解]
 
 
==第二 agent==
 
<pre>
 
 
#4.0 #centos7 快速安装和自动配置 2019年 8月23日 星期五 11时45分01秒 CST
 
 
#国外
 
rpm -ivh http://repo.zabbix.com/zabbix/4.0/rhel/7/x86_64/zabbix-release-4.0-1.el7.noarch.rpm
 
 
#国内
 
https://mirrors.aliyun.com/zabbix/zabbix/4.0/rhel/7/x86_64/zabbix-release-4.0-1.el7.noarch.rpm
 
 
手工直接添加  repo文件 ,如果有时 不小心 像上次删除了 reop文件 一样 ,搞半天
 
 
cat <<EOF > /etc/yum.repos.d/zabbix.repo
 
[zabbix]
 
name=Zabbix Official Repository - \$basearch
 
baseurl=https://mirrors.aliyun.com/zabbix/zabbix/4.0/rhel/7/\$basearch/
 
enabled=1
 
gpgcheck=1
 
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ZABBIX-A14FE591
 
 
[zabbix-non-supported]
 
name=Zabbix Official Repository non-supported - \$basearch
 
baseurl=https://mirrors.aliyun.com/zabbix/non-supported/rhel/7/\$basearch/
 
enabled=1
 
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-ZABBIX
 
gpgcheck=1
 
EOF
 
 
curl https://mirrors.aliyun.com/zabbix/RPM-GPG-KEY-ZABBIX-A14FE591 \
 
-o /etc/pki/rpm-gpg/RPM-GPG-KEY-ZABBIX-A14FE591
 
 
curl https://mirrors.aliyun.com/zabbix/RPM-GPG-KEY-ZABBIX \
 
-o /etc/pki/rpm-gpg/RPM-GPG-KEY-ZABBIX
 
 
 
 
yum install zabbix-agent -y
 
 
yum install ntp  -y
 
timedatectl set-ntp true
 
 
HOSTNAME=prod-java-02
 
 
#config
 
sed -i "s/^Server=127.0.0.1/Server=172.16.1.9/ " /etc/zabbix/zabbix_agentd.conf
 
 
sed -i "s/^ServerActive=127.0.0.1/ServerActive=172.16.1.9/"  /etc/zabbix/zabbix_agentd.conf
 
sed  -i "s/^Hostname=Zabbix server/Hostname=test-market/"  /etc/zabbix/zabbix_agentd.conf
 
 
 
 
#这个用了HOSTNAME 变量  而上面的要指定hostname
 
sed  -i 's/127.0.0.1/23.67.81.95/g'  /etc/zabbix/zabbix_agentd.conf
 
sed  -i "s/Hostname=Zabbix server/Hostname=${HOSTNAME}/g"  /etc/zabbix/zabbix_agentd.conf
 
grep "^\s*[^# \t].*$" /etc/zabbix/zabbix_agentd.conf
 
 
systemctl  enable  zabbix-agent.service
 
systemctl restart zabbix-agent
 
 
 
下面是老的信息 和解说
 
 
cat /etc/zabbix/zabbix_agentd.conf
 
Hostname=主机名
 
Server=zabbix server ip
 
LogFile= 可以不改
 
 
##最好这样3个
 
Server=10.6.1.181
 
ServerActive=10.6.1.181
 
Hostname=zabbix-client-1
 
 
 
#rpm -ivh http://repo.zabbix.com/zabbix/3.0/rhel/6/x86_64/zabbix-release-3.0-1.el6.noarch.rpm
 
#rpm -ivh http://repo.zabbix.com/zabbix/2.2/rhel/6/x86_64/zabbix-release-2.2-1.el6.noarch.rpm
 
#http://repo.zabbix.com/zabbix/2.0/rhel/5/x86_64/zabbix-release-2.0-1.el5.noarch.rpm
 
 
  
rpm -ivh http://repo.zabbix.com/zabbix/3.0/rhel/7/x86_64/zabbix-release-3.0-1.el7.noarch.rpm
+
==Enable and configure the nginx module ==
  
</pre>
 
===agent on debian===
 
 
<pre>
 
<pre>
#用系统的源
+
sudo filebeat modules enable nginx
apt-get install zabbix-agent
 
  
 +
Modify the settings in the /etc/filebeat/modules.d/nginx.yml file.
  
#config 其实和yum的也一样 只是启动不一样而已
 
HOSTNAME=wiki
 
sed -i "s/^Server=127.0.0.1/Server=207.148.106.229/ " /etc/zabbix/zabbix_agentd.conf
 
 
sed -i "s/^ServerActive=127.0.0.1/ServerActive=207.148.106.229/"  /etc/zabbix/zabbix_agentd.conf
 
sed  -i "s/^Hostname=Zabbix server/Hostname=wiki/"  /etc/zabbix/zabbix_agentd.conf
 
 
grep "^\s*[^# \t].*$" /etc/zabbix/zabbix_agentd.conf
 
 
service zabbix-agent start
 
 
 
zabbix_get -s 138.68.59.0 -k "system.hostname"
 
 
 
#用zbx的源
 
  https://repo.zabbix.com/zabbix/4.0/debian/pool/main/z/zabbix-release/zabbix-release_4.0-3+buster_all.deb       
 
dpkg -i zabbix-release_stretch_all.deb
 
# apt-get update
 
 
</pre>
 
</pre>
https://www.zabbix.com/documentation/3.2/manual/installation/install_from_packages/repository_installation
 
 
https://www.zabbix.com/documentation/4.0/zh/manual/installation/install_from_packages/rhel_centos#%E5%AE%89%E8%A3%85_agent
 
 
 
国内zabbix源总结
 
 
https://www.cnblogs.com/caidingyu/p/11423089.html
 
 
https://blog.cactifans.com/2019/01/21/Zabbix%E5%9B%BD%E5%86%85%E6%BA%90%E4%BD%BF%E7%94%A8/
 
 
==docker zabbix 5.0==
 
 
[https://juejin.im/entry/57be598d0a2b58006cd17c0f 用 Zabbix 和 Docker 搭建监控平台]
 
 
我的没有 zabbix web ui 明天搞一下
 
暴露端口 8888 用于访问页面,10051 用于和 Zabbix-agent 通信;
 
 
[https://www.zabbix.com/cn/whats_new_5_0 Zabbix 5.0 LTS新功能]
 
 
[https://www.cnblogs.com/itzgr/p/9963156.html  011.Docker Compose部署Zabbix实战 ]
 
 
==Usage==
 
添加主机要添加 模板  不然 在监控--主机那 图形没东西
 
https://www.zabbix.com/documentation/current/manual/quickstart/host
 
  
==添加用户 和用户组==
+
== Start Filebeat==
  
添加用户前 要添加用户组 然后在里面指定用户是哪个组 看到哪些项目
 
 
[https://www.cnblogs.com/fanlong0212/p/12248049.html  zabbix4.4新建用户组和用户权限设置 ]
 
 
[https://www.zabbix.com/documentation/4.0/zh/manual/quickstart/login 登陆和配置用户]
 
 
 
=Zabbix配置Telegram告警=
 
 
<pre>
 
<pre>
 +
The setup command loads the Kibana dashboards. If the dashboards are already set up, omit this command.
  
 
+
sudo filebeat setup
 +
sudo service filebeat start
 
</pre>
 
</pre>
  
https://www.zabbix.com/cn/integrations/telegram#tab:official1
+
== Module status==
 
 
[https://blog.csdn.net/weixin_33699914/article/details/92336106  配置zabbix+telegram告警]
 
 
 
[https://www.cnblogs.com/yeyu1314/p/10071279.html  zabbix+telegram的API接口(告警) ]
 
 
 
[https://blog.51cto.com/13555423/2469571 Zabbix配置Telegram告警(无坑文档)]
 
 
 
[https://my.oschina.net/u/4302302/blog/3830481 zabbix 用Telegram报警!!!]
 
 
 
[https://www.cnblogs.com/yeyu1314/p/10071279.html  zabbix+telegram的API接口(告警) ]
 
 
 
= 故障及回顾=
 
<pre>
 
问题1.  zabbix server 没有打开 10051端口 前端图形没显示
 
 
 
版本zabbix 2.2
 
 
 
 
 
 
 
没有看到 10051 是因为 
 
 
 
DBPassword=‘123’ 改为 DBPassword=123
 
 
 
 
 
日志查看
 
tail  /tmp/zabbix_server.log
 
 
 
14659:20170525:171042.257 [Z3001] connection to database 'zabbix' failed: [1045] Access denied for user 'zabbix'@'localhost' (using password: YES)
 
 
 
 
 
正确如下
 
[root@ zabbix]# netstat  -nlpt
 
Active Internet connections (only servers)
 
Proto Recv-Q Send-Q Local Address              Foreign Address            State      PID/Program name 
 
tcp        0      0 0.0.0.0:10051
 
</pre>
 
=== 经常报Zabbix agent on Zabbix server is unreachable for 5 minutes ===
 
 
<pre>
 
<pre>
 
+
Module status  右边的 check data 按键  -- > Nginx logs dashboard
我上次的处理是 重启 zbx server 就好了
 
  
 
</pre>
 
</pre>
 +
systemctl daemon-reload
  
[https://blog.csdn.net/weixin_34226706/article/details/85080769 解决Zabbix使用一段时间后总报Zabbix Agent不可到达的问题]
+
=see also=
 
 
[https://blog.csdn.net/weixin_33721344/article/details/92968417 防火墙导致 zabbix监控大批量报警zabbix agent on **** unreachable for 5 minute]
 
 
 
==参考==
 
 
 
[https://www.howtoforge.com/tutorial/install-zabbix-monitoring-server-and-agent-on-debian-9/ Install Zabbix Monitoring Server and Agent on Debian]
 
 
 
[https://www.cnblogs.com/yanjieli/p/13651859.html  zabbix--5.0.2部署使用手册 ]
 
 
 
[https://blog.csdn.net/weixin_42743410/article/details/81482728  zabbix 3.0使用教程]
 
 
 
[http://blog.51cto.com/guoxh/2089204 Zabbix 3.0 详解:从添加主机到发送报警通知]
 
 
 
[https://my.oschina.net/zhouyuntai/blog/1788830 Zabbix监控系统 (3) 之 添加自定义监控项目、配置邮件告警、测试告警]
 
 
 
http://blog.linuxchina.net/?p=1711
 
 
 
[https://www.cnblogs.com/enjoycode/p/zabbix_3_installation_on_centos_7.html  Zabbix 3.0  with apache安装笔记]
 
 
 
[https://www.cnblogs.com/zhenglisai/p/6547402.html 【zabbix】自定义监控项key值]
 
 
 
  
[https://blog.csdn.net/zhengchaooo/article/details/79499991 zabbix添加自定义py脚本]
+
https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-nginx.html
  
[https://juejin.cn/entry/6844903442452856845 用 Zabbix 和 Docker 搭建监控平台]
 
  
 [[category:zabbix]]
+
[https://www.cnblogs.com/kuku0223/p/8317965.html ELK--filebeat nginx模块]

2021年4月27日 (二) 09:25的版本


ins and config

Download and install Filebeat



curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.12.0-amd64.deb
sudo dpkg -i filebeat-7.12.0-amd64.deb

Edit the configuration

Modify /etc/filebeat/filebeat.yml to set the connection information:

output.elasticsearch:
  hosts: ["<es_url>"]
  username: "elastic"
  password: "<password>"
setup.kibana:
  host: "<kibana_url>"

Where <password> is the password of the elastic user, <es_url> is the URL of Elasticsearch, and <kibana_url> is the URL of Kibana.

Enable and configure the nginx module

sudo filebeat modules enable nginx

Modify the settings in the /etc/filebeat/modules.d/nginx.yml file.

Start Filebeat

The setup command loads the Kibana dashboards. If the dashboards are already set up, omit this command.

sudo filebeat setup
sudo service filebeat start

Module status

Module status  右边的 check data 按键  -- > Nginx logs dashboard

systemctl daemon-reload

see also

https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-nginx.html


ELK--filebeat nginx模块