多节点openstack charms 部署指南0.0.1-39-graylog-4-filebeat

参考文档：

Compatibility with Elasticsearch (5.x, 6.x, 7.x)

Install Elasticsearch 6.x on Ubuntu 18.04 LTS (Bionic Beaver) Linux

配置rsyslog作为数据源成功后，测试了下filebeat作为数据来源，但是graylog收不到log，并且，在graylog收到的rsyslog发来的log中提示：

在这里插入图片描述

看来估计是filebeat、elasticsearch和graylog的版本匹配造成的。

看了下juju状态：

 juju status --relations
Model    Controller       Cloud/Region    Version  SLA          Timestamp
graylog  maas-controller  mymaas/default  2.8.10   unsupported  09:29:13+08:00

SAAS             Status  Store            URL
primary-rsyslog  active  maas-controller  admin/rsyslog.primary-rsyslog

App                   Version  Status   Scale  Charm                 Store       Channel  Rev  OS      Message
apache2                        unknown      1  apache2               charmstore            35  ubuntu
elasticsearch         5.6.16   active       1  elasticsearch         charmstore            49  ubuntu  Unit is ready
filebeat              6.8.16   active       1  filebeat              charmstore            33  ubuntu  Filebeat ready.
grafana                        active       1  grafana               charmstore            40  ubuntu  Started grafana-server
graylog               2.5.1    active       1  graylog               local                  0  ubuntu  Ready with: elasticsearch, mongod                                    b
mongodb               3.6.8    active       1  mongodb               charmstore            59  ubuntu  Unit is ready
prometheus2                    active       1  prometheus2           charmstore            22  ubuntu  Ready
rsyslog-forwarder-ha           unknown      1  rsyslog-forwarder-ha  charmstore            20  ubuntu
telegraf                       active       4  telegraf              charmstore            41  ubuntu  Monitoring apache2/0 (source vers                                    ion/commit dec0633)

Unit                       Workload  Agent  Machine  Public address  Ports                                    Message
apache2/0*                 unknown   idle   2        10.0.0.157      80/tcp
  telegraf/0*              active    idle            10.0.0.157      9103/tcp                                 Monitoring apache2/0 (sour                                    ce version/commit dec0633)
elasticsearch/0*           active    idle   1        10.0.9.3        9200/tcp                                 Unit is ready
grafana/0*                 active    idle   2/lxd/0  10.0.3.118      3000/tcp                                 Started grafana-server
  telegraf/1               active    idle            10.0.3.118      9103/tcp                                 Monitoring grafana/0 (sour                                    ce version/commit dec0633)
graylog/0*                 active    idle   0        10.0.9.13       9000/tcp,9001/tcp                        Ready with: elasticsearch,                                     mongodb
mongodb/0*                 active    idle   1/lxd/0  10.0.3.115      27017/tcp,27019/tcp,27021/tcp,28017/tcp  Unit is ready
  filebeat/0*              active    idle            10.0.3.115                                               Filebeat ready.
  rsyslog-forwarder-ha/0*  unknown   idle            10.0.3.115
  telegraf/2               active    idle            10.0.3.115      9103/tcp                                 Monitoring mongodb/0 (sour                                    ce version/commit dec0633)
prometheus2/0*             active    idle   2/lxd/1  10.0.3.119      9090/tcp,12321/tcp                       Ready
  telegraf/3               active    idle            10.0.3.119      9103/tcp                                 Monitoring prometheus2/0 (                                    source version/commit dec0633)

Machine  State    DNS         Inst id              Series  AZ       Message
0        started  10.0.9.13   vm-159-1             focal   default  Deployed
1        started  10.0.9.3    vm-156-1             focal   default  Deployed
1/lxd/0  started  10.0.3.115  juju-0de0d7-1-lxd-0  focal   default  Container started
2        started  10.0.0.157  node6                focal   default  Deployed
2/lxd/0  started  10.0.3.118  juju-0de0d7-2-lxd-0  focal   default  Container started
2/lxd/1  started  10.0.3.119  juju-0de0d7-2-lxd-1  focal   default  Container started

Relation provider           Requirer                        Interface            Type         Message
apache2:juju-info           telegraf:juju-info              juju-info            subordinate
elasticsearch:client        filebeat:elasticsearch          elasticsearch        regular
elasticsearch:client        graylog:elasticsearch           elasticsearch        regular
elasticsearch:peer          elasticsearch:peer              http                 peer
grafana:juju-info           telegraf:juju-info              juju-info            subordinate
graylog:website             apache2:reverseproxy            http                 regular
mongodb:database            graylog:mongodb                 mongodb              regular
mongodb:juju-info           filebeat:beats-host             juju-info            subordinate
mongodb:juju-info           rsyslog-forwarder-ha:juju-info  juju-info            subordinate
mongodb:juju-info           telegraf:juju-info              juju-info            subordinate
mongodb:replica-set         mongodb:replica-set             mongodb-replica-set  peer
primary-rsyslog:aggregator  rsyslog-forwarder-ha:syslog     syslog               regular
prometheus2:grafana-source  grafana:grafana-source          grafana-source       regular
prometheus2:juju-info       telegraf:juju-info              juju-info            subordinate
telegraf:dashboards         grafana:dashboards              grafana-dashboard    regular
telegraf:prometheus-client  prometheus2:target              http                 regular

于是在论坛提问，因为不知道怎么部署特定版本的应用。

经过同好回复，大意如下：

Elasticsearch #49

中，默认的版本为：

deb https://artifacts.elastic.co/packages/5.x/apt stable main，

（在上面的juju status 显示的版本为 5.6.16 ）

而

Filebeat #33

需要的默认版本为：

deb https://artifacts.elastic.co/packages/6.x/apt stable main，

如

Compatibility with Elasticsearch (5.x, 6.x, 7.x)

所述，filebeat和elasticsearch的版本匹配如下：

在这里插入图片描述

即：filebeat 6.8对应的elasticsearch版本应该是6.x。

并提示部署特定版本的elasticsearch命令应该类似：

juju deploy cs:elasticsearch-49 --to 6 --series focal --config apt-repository=“deb https://artifacts.elastic.co/packages/6.x/apt stable main”

根据这个建议，先删除了elasticsearch单元和应用，并重新部署：

juju remove-unit elasticsearch/0 --force --no-wait
juju remove-application elasticsearch --force --no-wait

juju deploy cs:elasticsearch-49 --to 1 --series focal --config apt-repository=“deb https://artifacts.elastic.co/packages/6.x/apt stable main”

但是输出为：

ERROR unrecognized args: [“stable” “main””]

根据

Install Elasticsearch 6.x on Ubuntu 18.04 LTS (Bionic Beaver) Linux

，试了下oss-6.x版本的elasticsearch。

juju deploy cs:elasticsearch-49 --to 1 --series focal --config apt-repository="deb https://artifacts.elastic.co/packages/oss-6.x/apt stable main"

并增加了以下关系：

 juju relate graylog:elasticsearch elasticsearch:client
 juju add-relation filebeat:logstash graylog:beats

juju config elasticsearch firewall_enabled="false"
juju config filebeat logstash_hosts="<graylog-ip>:5044"
juju config graylog elasticsearch_cluster_name="<es-cluster>"
 juju config filebeat  logpath="/var/log/*.log /var/log/containers/*.log"

其中：

： juju run –unit graylog/0 ‘unit-get private-address’

： juju config elasticsearch cluster-name

过了一会儿，在graylog的input里，filebeat的输入源可以获得log了：

在这里插入图片描述

原文链接：https://blog.csdn.net/m0_49212388/article/details/117816907

你可能也喜欢