ELK-通过syslog收集haproxy日志

一 安装haproxy

[root@linux-node3 ~]# cd /usr/local/src/
[root@linux-node3 src]# tar xvf haproxy-1.7.9.tar.gz
[root@linux-node3 src]# cd haproxy-1.7.9
[root@linux-node3 haproxy-1.7.9]# make TARGET=linux2628 USE_PCRE=1 USR_OPENSSL=1 USE_ZLIB=1 PREFIX=/usr/local/haproxy —安装haproxy
[root@linux-node3 haproxy-1.7.9]# make install PREFIX=/usr/local/haproxy
[root@linux-node3 haproxy-1.7.9]# ll /usr/local/haproxy/
drwxr-xr-x 3 root root 21 Aug 24 14:50 doc
drwxr-xr-x 2 root root 21 Aug 24 14:50 sbin
drwxr-xr-x 3 root root 17 Aug 24 14:50 share
[root@linux-node3 haproxy-1.7.9]# cp haproxy /usr/sbin/
[root@linux-node3 haproxy-1.7.9]# cp haproxy-systemd-wrapper /usr/sbin/
[root@linux-node3 haproxy-1.7.9]# vim /etc/sysconfig/haproxy
OPTIONS=""

[root@linux-node3 haproxy-1.7.9]# vim /usr/lib/systemd/system/haproxy.service
[Unit]
Description=HAProxy Load Balancer
After=syslog.target network.target

[Service]
EnvironmentFile=/etc/sysconfig/haproxy
ExecStart=/usr/sbin/haproxy-systemd-wrapper -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid $OPTIONS
ExecReload=/bin/kill -USR2 $MAINPID

[Install]
WantedBy=multi-user.target

[root@linux-node3 haproxy-1.7.9]# vim /etc/haproxy/haproxy.cfg

global
maxconn 100000
chroot /usr/local/haproxy
uid 99
gid 99
daemon
nbproc 1
pidfile /usr/local/haproxy/run/haproxy.pid
log 127.0.0.1 local6 info

defaults
option http-keep-alive
option forwardfor
maxconn 100000
mode http
timeout connect 300000ms
timeout client 300000ms
timeout server 300000ms

listen stats
mode http
bind 0.0.0.0:9999
stats enable
log global
stats uri /haproxy-status
stats auth haadmin:123456

frontend kibana_web_port
bind 10.0.0.17:80
mode http
log global #必须开启日志
default_backend kibana_web_http_nodes

backend kibana_web_http_nodes
mode http
#balance source
balance roundrobin
cookie SESSION_COOKIE insert indirect nocache
#option httpchk GET /XXX/XXX.
server 10.0.0.17 10.0.0.17:5601 cookie kibana-web1 check inter 2000 fall 3 rise 5

[root@linux-node3 haproxy-1.7.9]# systemctl restart haproxy

看一下80端口是否起来

直接访问10.0.0.17不用加端口 就可以到kibana的页面了

[root@linux-node3 kibana]# vim /etc/rsyslog.conf
14 # Provides UDP syslog reception
15 $ModLoad imudp
16 $UDPServerRun 514
17
18 # Provides TCP syslog reception
19 $ModLoad imtcp
20 $InputTCPServerRun 514
92 local6.* /var/log/haproxy.log
local6.* @@10.0.0.18:1514

[root@linux-node3 kibana]# systemctl restart rsyslog
访问
http://10.0.0.17:9999/haproxy-status

远程把日志发到18的配置
[root@linux-node4 ~]# cd /etc/logstash/conf.d/
[root@linux-node4 conf.d]# ls
tcp.conf
[root@linux-node4 conf.d]# cp tcp.conf rsyslog.conf
[root@linux-node4 conf.d]# vim rsyslog.conf

input {
  syslog {
     port => "1514"
     type => "rslog-17"
  }
}


output {
  elasticsearch {
    hosts => ["10.0.0.17:9200"]
    index => "rsyslog-18-%{+YYYY.MM.dd}"
  }
}
~

然后在kibana页面加入进去就可以了