使用OpenSearch、自建Filebeat和Dashboards构建网络拨测功能 给予 systemd 服务文件可执行权限 sudo chmod +x /etc/systemd/system/filebeat.service 启用并启动 Filebeat 服务 echo "Enabling and starting Filebeat service..." sudo systemctl daemonreload sudo systemctl enable filebeat sudo systemctl start filebeat echo "Filebeat service has been started." 输出 Filebeat 的进程状态 echo "Filebeat service status:" sudo systemctl status filebeat cat 2. 登录数据归集节点的ECS并部署Filebeat(与步骤2部署方式相同)数据归集节点Filebeat.yml: filebeat.inputs: type: kafka enabled: true hosts: kafka机器ip:kafka端口 topics: ["icmpprobe"] groupid: "filebeaticmpprobeopensearchtest" worker: 6 fields: type: "icmp" type: kafka enables: true hosts: kafka机器ip:kafka端口 topics: ["httpprobe"] groupid: "filebeathttpprobeopensearchtest" fields: type: "http" filebeat.config.modules: enabled: false path: /opt/filebeat/filebeat8.12.2linuxx8664/modules.d/.yml reload.enabled: false setup.template.settings: index.numberofshards: 1 setup.kibana: processors: decodejsonfields: fields: ["message"] overwritekeys: true target: "" dropfields: when: equals: fields.type: "icmp" fields: ["log","ecs","agent","host","input","kafka","Total","SourceIP","RemoteIP","JobId","message","Rtts ms"] ignoremissing: true dropfields: when: equals: fields.type: "http" fields: ["log","ecs","agent","host","input","kafka","message","JobId","SourceIP","HttpUrl"] ignoremissing: true output.elasticsearch: enabled: true hosts: [" username: "OpenSearch用户名" password: "OpenSearch密码" ssl.verificationmode: none worker: 6 indices: index: "icmpindex%{+yyyyMMdd}" when.contains: fields: type: "icmp" index: "httpindex%{+yyyyMMdd}" when.contains: fields: type: "http" logging.level: info seccomp: defaultaction: allow syscalls: action: allow names: rseq 3. 配置OpenSearch: a. 查看是否数据成功投递到了OpenSearch中。 b. 创建Visualization需要用到的indexpattern。 4. 配置Visualization: a.创建Visualization: b.配置横纵坐标。 c.展示效果图:
来自: