kibana.yaml将以下默认值进行修改. kibana官方配置说明
1.增加日志
# Enables you specify a file where Kibana stores log output.
#logging.dest: stdout
logging.dest: /logs-path/kibana.log
调整maxPayloadBytes
server.maxPayloadBytes:
默认值: 1048576 服务器请求的最大负载，单位字节
# The maximum payload size in bytes for incoming server requests.
#server.maxPayloadBytes: 1048576 # 默认为1M
server.maxPayloadBytes: 52428800 # 现在调整为50M
只打印错误日志
logging.quiet:
默认值: false 该值设为 true 时，禁止除错误信息除外的所有日志输出。
# Set the value of this setting to true to suppress all logging output other than error messages.
#logging.quiet: false
logging.quiet: true
增加自愈脚本
keep_kibana_online.sh
#!/bin/bash
# author: derek
KB_PORT=5601
kibana_pid_num=`lsof -i:${KB_PORT} | wc -l`
KB_BIN=/data/elk/kibana/bin
# check count of kibana pid if 0, kibana may dead;
#
if [ "${kibana_pid_num}" = 0 ]
then
echo "kibana service is down, restarting in process now..."
cd ${KB_BIN}
./kibana > /dev/null 2>&1 &
else
kb_pid=`ps -ef|netstat -anp |grep ${KB_PORT} |grep -v grep |awk '{printf $7}'|cut -d / -f 1`
echo "kibana now is alive, pid is ${kb_pid}"
fi
添加到crontab 每10分钟轮训检查一次
# cronta -e
*/10 * * * * sh /BIN_PATH/keep_kibana_online.sh
==========================================================
vi filebeat.yml
processors:
- drop_fields:
fields: ["input_type", "log.offset", "host.name", "input.type", "agent.hostname", "agent.type", "ecs.version", "agent.ephemeral_id", "agent.id", "agent.version", "fields.ics", "log.file.path", "log.flags" ,"agent.ephemeral_id","agent.id","agent.type","agent.version","agent.hostname","cloud.availability_zone","cloud.instance.id","cloud.provider","cloud.region","ecs.version","host.architecture","host.containerized","host.id","host.os.codename","host.os.family","host.os.kernel","host.os.name","host.os.platform","host.os.version"]
monitoring:
enabled: true
elasticsearch: ["http://172.16.0.11:9200"]