Filebeat在CentOS上如何配置SSL加密 - 问答

在CentOS上配置Filebeat以使用SSL加密涉及几个步骤。以下是一个基本的指南，帮助你设置Filebeat以通过SSL/TLS加密传输数据。

前提条件

Filebeat已安装：确保你已经在CentOS上安装了Filebeat。
Elasticsearch和Kibana已配置SSL：确保你的Elasticsearch和Kibana实例已经配置了SSL/TLS。

步骤

1. 配置Filebeat输出到Elasticsearch

编辑Filebeat的配置文件/etc/filebeat/filebeat.yml，添加或修改输出部分以使用SSL连接到Elasticsearch。

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/*.log

output.elasticsearch:
  hosts: ["https://your_elasticsearch_host:9200"]
  ssl.verification_mode: certificate
  ssl.certificate_authorities: ["/etc/filebeat/certs/ca.crt"]
  ssl.certificate: "/etc/filebeat/certs/filebeat.crt"
  ssl.key: "/etc/filebeat/certs/filebeat.key"

2. 生成SSL证书

如果你还没有SSL证书，可以使用OpenSSL生成自签名证书。

# 创建CA目录和文件
mkdir -p /etc/filebeat/certs
touch /etc/filebeat/certs/ca.crt

# 生成CA私钥
openssl genrsa -out /etc/filebeat/certs/ca.key 2048

# 生成CA证书
openssl req -new -x509 -days 3650 -key /etc/filebeat/certs/ca.key -out /etc/filebeat/certs/ca.crt -subj "/C=US/ST=YourState/L=YourCity/O=YourOrganization/CN=YourCA"

# 生成Filebeat服务器证书和密钥
openssl req -newkey rsa:2048 -nodes -keyout /etc/filebeat/certs/filebeat.key -out /etc/filebeat/certs/filebeat.csr -subj "/C=US/ST=YourState/L=YourCity/O=YourOrganization/CN=your_elasticsearch_host"

# 使用CA证书签名Filebeat证书
openssl x509 -req -in /etc/filebeat/certs/filebeat.csr -CA /etc/filebeat/certs/ca.crt -CAkey /etc/filebeat/certs/ca.key -CAcreateserial -out /etc/filebeat/certs/filebeat.crt -days 3650

3. 配置Elasticsearch信任Filebeat证书

编辑Elasticsearch的配置文件/etc/elasticsearch/elasticsearch.yml，添加以下内容以信任Filebeat的证书。

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12

# 添加Filebeat证书到信任库
bin/elasticsearch-certutil cert -out /etc/elasticsearch/certs/filebeat.crt -pass ""
bin/elasticsearch-certutil csr -in /etc/filebeat/certs/filebeat.csr -pass "" | bin/elasticsearch-certutil cert -add -ca /etc/elasticsearch/certs/ca.crt -out /etc/elasticsearch/certs/filebeat.crt -pass ""

4. 重启服务

重启Filebeat和Elasticsearch服务以应用更改。

sudo systemctl restart filebeat
sudo systemctl restart elasticsearch

验证配置

确保Filebeat能够成功连接到Elasticsearch并传输数据。你可以查看Filebeat和Elasticsearch的日志文件以确认连接状态。

sudo tail -f /var/log/filebeat/filebeat
sudo tail -f /var/log/elasticsearch/elasticsearch.log

通过以上步骤，你应该能够在CentOS上成功配置Filebeat以使用SSL加密传输数据到Elasticsearch。

0 赞

0 踩