Question

我正在尝试使用image.image.url在RHEL7上设置我的第一个 ELK 环境，

我安装了所有必需的组件（Nginx，logstash，kibana，elasticsearch），

我还在我的客户端计算机上安装了filebeat，我正在尝试从中提取日志，但在检查安装时我得到401：

[root@myd-vm666 beats-dashboards-1.1.0]# curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty'
<html>
<head><title>401 Authorization Required</title></head>
<body bgcolor="white">
<center><h1>401 Authorization Required</h1></center>
<hr><center>nginx/1.10.2</center>
</body>
</html>

在我的文件配置中，我说明了logstash主机和证书位置，如下所示：

#================================ Outputs =====================================

# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.

#-------------------------- Elasticsearch output ------------------------------
#output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["16.XX.XXX.XXX:9200"]

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["16.XX.XXX.XXX:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

  tls:
  # List of root certificates for HTTPS server verifications
  certificate_authorities: "/etc/pki/tls/certs/logstash-forwarder.crt"

我确认 logstash-forwarder.crt 位于正确的位置。在我的服务器上，我有这个配置/etc/logstash/conf.d/02-beats-input.conf

input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
  }
}

我错过了什么？我需要在客户端上放置另一个密钥/证书吗？

在ELK ElasticSearch Logstash Kibana中从客户端Filebeat获取401授权）

0 个答案: