Openstack配置手册-结合ELK

1. 安装ELK服务[详细步骤参看HandBook HandBooks]在指定设备上。本例的ELK服务器主机名为:elk.1000y.cloud
2. 可不需要ELK集群
3. 确认ELK服务器上ES、Kibana等服务运行良好

1) 在控制节点准备Java环境
[root@srv1 ~(keystone)]# yum install java-11-openjdk java-11-openjdk-devel -y

[root@srv1 ~(keystone)]# cat > /etc/profile.d/java11.sh << EOF
export JAVA_HOME=$(dirname $(dirname $(readlink $(readlink $(which javac)))))
export ES_JAVA_HOME=$(dirname $(dirname $(readlink $(readlink $(which javac)))))
export PATH=\$PATH:\$ES_JAVA_HOME/bin
EOF

[root@srv1 ~(keystone)]# source /etc/profile.d/java11.sh

[root@srv1 ~(keystone)]# java --version
openjdk 11.0.11 2021-04-20 LTS
OpenJDK Runtime Environment 18.9 (build 11.0.11+9-LTS)
OpenJDK 64-Bit Server VM 18.9 (build 11.0.11+9-LTS, mixed mode, sharing)

2) 在控制节点安装Logstash
[root@srv1 ~(keystone)]# cat > /etc/yum.repos.d/elasticsearch.repo << EOF
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://mirrors.tuna.tsinghua.edu.cn/elasticstack/7.x/yum/
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF

[root@srv1 ~(keystone)]# yum install logstash -y

3) 收集控制节点上的各Openstack服务日志---[创建相关的logstash的各openstack服务的配置文件]
[root@srv1 ~(keystone)]# cd /etc/logstash/conf.d/
[root@srv1 conf.d(keystone)]# vim keystone.conf
input {
  file{
  type => "keystone"
  path => ["/var/log/keystone/keystone.log"]
  }
}

[root@srv1 conf.d(keystone)]# vim glance.conf
input {
  file{
    type => "cinder"
    path => ["/var/log/glance/api.log",
             "/var/log/glance/registry.log"]
  }
}

[root@srv1 conf.d(keystone)]# vim nova.conf
input {
file{
  type => "nova"
  path => ["/var/log/nova/nova-scheduler.log",
           "/var/log/nova/nova-consoleauth.log",
           "/var/log/nova/nova-conductor.log",
           "/var/log/nova/nova-manage.log",
           "/var/log/nova/nova-placement-api.log",
           "/var/log/nova/nova-compute.log",
           "/var/log/nova/nova-api.log"]
  }
}

[root@srv1 conf.d(keystone)]# vim neutron.conf 
input {
  file{
  type => "neutron"
  path => ["/var/log/neutron/server.log",
           "/var/log/neutron/openvswitch-agent.log",
           "/var/log/neutron/metadata-agent.log"]
  }
}

[root@srv1 conf.d(keystone)]# vim output.conf 
output {
  elasticsearch{
    hosts=> ["elk.1000y.cloud:9200"]
    index => "%{type}-index"
  }
}

4) 授权logstash允许读取各openstack服务日志,并启动logstash服务---[将logstash账户加入至指定组中]
[root@srv1 ~(keystone)]# usermod -a -G keystone logstash
[root@srv1 ~(keystone)]# usermod -a -G glance logstash
[root@srv1 ~(keystone)]# usermod -a -G nova logstash
[root@srv1 ~(keystone)]# usermod -a -G neutron logstash
[root@srv1 ~(keystone)]# usermod -a -G cinder logstash

[root@srv1 ~(keystone)]# systemctl enable --now logstash

5) 在ELK服务器上确认服务索引生成
[root@elk ~]# curl elk.1000y.cloud:9200/_cat/indices?v
......
......
green  open   neutron-index        Dure4sqRR3Wfb3KVEaMMMA   1   1          17            0     36.7kb       36.7kb

6) 在Kibana上创建索引---[详细步骤参看HandBook HandBooks]