docker搭建ELK日志采集系统（五）
环境：
| 服务器 | 系统 | IP | 掩码 |
| elk | centos 7 | 10.99.101.232 | 255.255.255.0 |
| USG2210 | 防火墙 | 10.99.101.204 | 255.255.255.0 |
| S6720 | 交换机 | 10.77.0.2 | 255.255.255.0 |
五、华为交换机、USG日志上报logstash并输出到elasticsearch
USG、S6720与ELK已路由可达
过程如下：
华为交换机、USG info-center >> ELK 514/UDP >> ELK514UDP映射到logstash容器 51400 >> logstash input UDP51400 端口 > elasticsearch
交换机配置：
<S6720-30C-EI-24S-AC>dis current-configuration !Software Version V200R008C00SPC500 # sysname S6720-30C-EI-24S-AC # info-center loghost source Vlanif99 info-center loghost 10.99.101.232
USG配置
<USG_2210>dis current-configuration 10:16:46 2021/01/11 # sysname USG_2210 # l2tp domain suffix-separator @ # info-center loghost source 10.99.101.204 info-center loghost 10.99.101.232 514
#ELK开放514UDP firewall-cmd --add-port=514/udp --permanent firewall-cmd --reload
为docker容器 logstash追加51400端口映射ELK514 UDP
docker ps -a
systemctl stop docker
cd /var/lib/docker/containers/3bb8f7947327287a940d8c58db36f87b3f99b04bdec742074d974528f50a4d4a/
vim hostconfig.json
PortBindings":{"51400/udp":[{"HostIp":"","HostPort":"514"}]},
vim config.v2.json
ExposedPorts":{"51400/udp":{},
systemctl start docker
docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
3bb8f7947327 logstash:7.6.0 "/usr/local/bin/do..." 5 days ago Up 2 hours 0.0.0.0:5044->5044/tcp, 0.0.0.0:9600->9600/tcp, 0.0.0.0:514->51400/udp logstash
1f1a5822d724 kibana:7.6.0 "/usr/local/bin/du..." 5 days ago Up 2 hours 0.0.0.0:5601->5601/tcp kibana
372aefc050e5 elasticsearch:7.6.0 "/usr/local/bin/do..." 5 days ago Up 2 hours 0.0.0.0:9200->9200/tcp, 0.0.0.0:9300->9300/tcp elasticsearch
##514端口已映射#logstash 51400端口监听
vi /home/elk/elasticsearchconfig/elasticsearch.yml
input {
...
udp {
port => "51400"
}
...
}#ELK开放514UDP firewall-cmd --add-port=514/udp --permanent firewall-cmd --reload
#ELK抓包514端口，确认有数据包送过来 [root@ELK ~]# tcpdump -i ens192 port 514 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ens192, link-type EN10MB (Ethernet), capture size 262144 bytes 09:55:44.785527 IP 10.99.101.204.vat > ELK.yimitest.com.syslog: SYSLOG local7.info, length: 122 09:55:49.785550 IP 10.99.101.204.vat > ELK.yimitest.com.syslog: SYSLOG local7.info, length: 122
kibana 查询数据
