kibana，elasticsearch，logstash 分别装在三台不同的机器上，elasticsearch配置了安全策略，使用账号密码访问 ，kibana 和 elasticsearch 都已正常启动
logstash.yml 的配置如下
[elk@swarm18 logstash-7.16.2]$
node.name: test
path.data: /var/lib/logstash
path.config: /usr/local/logstash-7.16.2/config/etc/*.conf
config.reload.automatic: true
path.logs: /var/log/logstash
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: "logstash_system"
xpack.monitoring.elasticsearch.password: "123456"
xpack.monitoring.elasticsearch.proxy: "http://172.16.29.17:9200"
kibana.yml 的配置如下
[root@swarm16 kibana-7.16.2]#
server.port: 5601
server.host: "0.0.0.0"
server.publicBaseUrl: "http://172.16.29.16:5601"
elasticsearch.hosts: "http://172.16.29.17:9200"
elasticsearch.username: "elastic"
elasticsearch.password: "123456"
i18n.locale: "zh-CN"
elasticsearch.yml 的配置如下
[root@swarm17 elasticsearch-7.16.2]#
node.name: node-1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
bootstrap.memory_lock: false
bootstrap.system_call_filter: false
network.host: 0.0.0.0
http.port: 9200
cluster.initial_master_nodes: ["node-1"]
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12
logstash.conf 配置如下
[elk@swarm18 logstash-7.16.2]$
input {
stdin {}
}
output {
stdout {
codec => rubydebug {}
}
elasticsearch {
hosts => "172.16.29.17:9200" }
}
[elk@swarm18 logstash-7.16.2]$ /usr/local/logstash/bin/logstash -f /usr/local/logstash/config/etc/logstash.conf
Using LS_JAVA_HOME defined java: /usr/local/jdk16
WARNING: Using LS_JAVA_HOME while Logstash distribution comes with a bundled JDK
2021-12-21T17:32:55.434+08:00 [main] WARN FilenoUtil : Native subprocess control requires open access to the JDK IO subsystem
Pass '--add-opens java.base/sun.nio.ch=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED' to enable.
Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
[2021-12-21T17:33:18,484][INFO ][logstash.runner ] Log4j configuration path used is: /usr/local/logstash-7.16.2/config/log4j2.properties
[2021-12-21T17:33:18,493][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.16.2", "jruby.version"=>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 Java HotSpot(TM) 64-Bit Server VM 16.0.2+7-67 on 16.0.2+7-67 +indy +jit [linux-x86_64]"}
[2021-12-21T17:33:18,851][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2021-12-21T17:33:21,167][ERROR][logstash.monitoring.internalpipelinesource] X-Pack is installed on Logstash but not on Elasticsearch. Please install X-Pack on Elasticsearch to use the monitoring feature. Other features may be available.
[2021-12-21T17:33:21,385][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[2021-12-21T17:33:22,226][INFO ][org.reflections.Reflections] Reflections took 103 ms to scan 1 urls, producing 119 keys and 417 values
[2021-12-21T17:33:23,026][INFO ][logstash.outputs.elasticsearch][main] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//172.16.29.17:9200"]}
[2021-12-21T17:33:23,063][INFO ][logstash.outputs.elasticsearch][main] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://172.16.29.17:9200/]}}
[2021-12-21T17:33:23,083][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://172.16.29.17:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=>"Got response code '401' contacting Elasticsearch at URL 'http://172.16.29.17:9200/'"}
[2021-12-21T17:33:23,125][WARN ][logstash.outputs.elasticsearch][main] Configuration is data stream compliant but due backwards compatibility Logstash 7.x will not assume writing to a data-stream, default behavior will change on Logstash 8.0 (set `data_stream => true/false` to disable this warning)
[2021-12-21T17:33:23,195][INFO ][logstash.javapipeline ][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>250, "pipeline.sources"=>["/usr/local/logstash-7.16.2/config/etc/logstash.conf"], :thread=>"#<Thread:0x70f5145a run>"}
[2021-12-21T17:33:23,889][INFO ][logstash.javapipeline ][main] Pipeline Java execution initialization time {"seconds"=>0.69}
The stdin plugin is now waiting for input
[2021-12-21T17:33:23,972][INFO ][logstash.javapipeline ][main] Pipeline started {"pipeline.id"=>"main"}
[2021-12-21T17:33:24,024][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2021-12-21T17:33:28,106][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://172.16.29.17:9200/", :exception=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :message=>"Got response code '401' contacting Elasticsearch at URL 'http://172.16.29.17:9200/'"}
修改
xpack.monitoring.elasticsearch.username: "logstash_system"
xpack.monitoring.elasticsearch.password: "123456"
解决 Got response code '401' contacting Elasticsearch at URL http://172.16.29.17:9200 的报错