Windows ELK8 测试: filebeat8+Metricbeat8+Packetbeat8+Winlogbeat8+Auditbeat8+Heartbeat8搭建日志系统（三）之beats

Windows ELK8 测试: filebeat8+Metricbeat8+Packetbeat8+Winlogbeat8+Auditbeat8+Heartbeat8搭建日志系统（三）之beats

下载地址：

Filebeat：主要用于收集和转发日志文件。它可以监控指定的日志目录或文件，当日志更新时，Filebeat 就会读取更新的内容并发送到 Elasticsearch 或 Logstash。使用场景包括日志分析、故障排查等。

Metricbeat：用于收集系统和服务的运行指标，如 CPU 使用率、内存使用量、网络流量、磁盘 I/O 等。它可以定期收集这些指标并发送到 Elasticsearch 或 Logstash。使用场景包括系统监控、性能分析等。

Packetbeat：用于收集网络流量数据。它可以实时捕获网络流量，然后解析出各种协议的信息（如 HTTP、MySQL、Redis 等），并将这些信息发送到 Elasticsearch 或 Logstash。使用场景包括网络监控、安全分析等。

Winlogbeat：专门用于收集 Windows 事件日志。它可以读取 Windows 事件日志，然后将日志数据发送到 Elasticsearch 或 Logstash。使用场景包括 Windows 系统监控、安全分析等。

Auditbeat：用于收集 Linux 审计框架的数据，以及文件的改变数据。它可以帮助你了解在系统上发生了什么，包括哪些文件被改变，以及系统调用等。使用场景包括系统审计、文件完整性检查等。

Heartbeat：用于定期检查你的服务是否可用。它可以定期发送请求到你的服务，然后收集响应时间等信息，并将这些信息发送到 Elasticsearch 或 Logstash。使用场景包括服务监控、可用性检查等。

1、Filebeat 部署【不再重复】

Windows ELK8 测试: filebeat8+kakfa+logstash8+elasticsearch8+kibana8 搭建日志系统（一）

2、Metricbeat 部署

因为前面文章我们配置了kibana、Elasticsearch 的安全认证，并且生成好了证书，所以我们现在直接配置Metricbeat
编辑配置文件：metricbeat-8.14.3\metricbeat.yml

metricbeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: true

setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
  #_source.enabled: false

# =================================== Kibana ===================================
setup.kibana:
  host: "https://localhost:5601"
  ssl.enabled: true
  ssl.certificate_authorities: ["ELK\\kibana-8.14.3\\config\\certs\\ca.pem"]
  ssl.certificate: "ELK\\kibana-8.14.3\\config\\certs\\client.crt"
  ssl.key: "ELK\\kibana-8.14.3\\config\\certs\\client.key"
  # 因为前面我们生成证书没有填：
  # Common Name (eg, your name or your server's hostname) []:
  # 此处应该填setup.kibana.host的ip或者hostName
  ssl.verification_mode: none

# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  hosts: ["127.0.0.1:9200"]
  # Protocol - either `http` (default) or `https`.
  protocol: "https"
  username: "elastic"
  password: "123456"
  # api_key: sFizXYoBxPLM4LwrKywe:NMOjRbUvT7ykunWDsVG4uQ
  ssl.certificate_authorities: ["ELK\\elasticsearch-8.14.3\\config\\certs\\http_ca.crt"]
  # ssl.ca_trusted_fingerprint: "633bf7f6e4bf264e6a05d488af3c686b858fa63592dc83999a0d77f7e9fe5940"

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

测试配置文件是否有语法错误

ELK\beats\metricbeat-8.14.3>metricbeat.exe test config
Config OK

测试是否能正确连接到Elasticsearch

ELK\beats\metricbeat-8.14.3>metricbeat.exe test output

elasticsearch: https://127.0.0.1:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 127.0.0.1
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.3
    dial up... OK
  talk to server... OK
  version: 8.14.3

查看模块

ELK\beats\metricbeat-8.14.3>metricbeat modules list
Enabled:
system

Disabled:
activemq
aerospike
airflow
apache
aws
awsfargate
azure
beat
beat-xpack
ceph
ceph-mgr
cloudfoundry
cockroachdb
consul
containerd
coredns
couchbase
couchdb
docker
dropwizard
elasticsearch
elasticsearch-xpack
enterprisesearch
enterprisesearch-xpack
envoyproxy
etcd
gcp
golang
graphite
haproxy
http
ibmmq
iis
istio
jolokia
kafka
kibana
kibana-xpack
kubernetes
kvm
linux
logstash
logstash-xpack
memcached
mongodb
mssql
munin
mysql
nats
nginx
openmetrics
oracle
php_fpm
postgresql
prometheus
rabbitmq
redis
redisenterprise
sql
stan
statsd
syncgateway
tomcat
traefik
uwsgi
vsphere
windows
zookeeper

禁用模块：metricbeat modules disable system
启用模块：metricbeat modules enable system

# 初始化metricbeat 运行一次就行，-e 的含义：日志直接命令行输出，而非日志
./metricbeat setup -e

# 启动
./metricbeat -e

打开kibana进入仪表板界面可以看到多了很多模板

查看系统监控（因为我们目前只启用了system模块）

3、Packetbeat 部署

注意：Packetbeat 运行前要先安装 npcap

packetbeat-8.14.3>packetbeat.exe
Exiting: npcap: failed to start Npcap installer: fork/exec C:\Users\admin\AppData\Local\Temp\2458729910\npcap.exe: The requested operation requires elevation.

安装npcap，下载地址

配置：ELK\beats\packetbeat-8.14.3\packetbeat.yml

#################### Packetbeat Configuration Example #########################

# This file is an example configuration file highlighting only the most common
# options. The packetbeat.reference.yml file from the same directory contains all the
# supported options with more comments. You can use it as a reference.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/packetbeat/index.html

# =============================== Network device ===============================

# Select the network interface to sniff the data. On Linux, you can use the
# "any" keyword to sniff on all connected interfaces. On all platforms, you
# can use "default_route", "default_route_ipv4" or "default_route_ipv6"
# to sniff on the device carrying the default route. If you wish to sniff
# on multiple network interfaces you may specify an array of distinct interfaces
# as a YAML array with each device's configuration specified individually.
# Each device may only appear once in the array of interfaces.
#
# packetbeat.interfaces:
# - device: en0
#   internal_networks:
#   - private
# - device: en1
#   internal_networks:
#   - private
#
packetbeat.interfaces.device: default_route

# Specify the amount of time between polling for changes in the default
# route. This option is only used when one of the default route devices
# is specified.
packetbeat.interfaces.poll_default_route: 1m

# The network CIDR blocks that are considered "internal" networks for
# the purpose of network perimeter boundary classification. The valid
# values for internal_networks are the same as those that can be used
# with processor network conditions.
#
# For a list of available values see:
# https://www.elastic.co/guide/en/beats/packetbeat/current/defining-processors.html#condition-network
packetbeat.interfaces.internal_networks:
  - private

# ==================== Windows Npcap installation settings =====================

# Windows Npcap installation options. These options specify how the Npcap packet
# capture library for Windows should be obtained and installed.
#
#packetbeat.npcap:
#  # If a specific local version of Npcap is required, installation by packetbeat
#  # can be blocked by setting never_install to true. No action is taken if this
#  # option is set to true unless no Npcap is already installed.
#  never_install