Using Packetbeat to capture MySQL data

Lab Environment: CentOS 6.7 x86_64

ELK version: 5.6.0

Lab Machines ip:10.0.20.25

most operations and ELK I have omitted the syntax here.

build ELK

For the sake of experiment convenience, I only use one host demo, so it is a single node es.

download directly to the official website rpm The package is then uploaded to the server, Yum installation can

Yum Install elasticsearch-5.6.0.rpm kibana-5.6.0-x86_64.rpm logstash-5.6.0.rpm

vim/etc/elasticsearch/elasticsearch.yml the following modifications (not listed in the unmodified places):

Cluster.name:my-application

network.host:10.0.20.25

http.port:9200

## in CENTOS6 series installation elk5.6 need to add the following 2 line code, otherwise es startup fails

Bootstrap.system_call_filter:false

Bootstrap.memory_lock:false

vim/etc/logstash/logstash.yml here the experimental environment, I did not make any changes, using the default configuration parameters.

Path.data:/var/lib/logstash

Path.config:/ETC/LOGSTASH/CONF.D

Path.logs:/var/log/logstash

vim/etc/kibana/kibana.yml the following modifications (not listed in the unmodified places):

server.port:5601

Server.host: "10.0.20.25"

Elasticsearch.url: "http://10.0.20.25:9200"

In addition, the actual production environment ES and Logstash Best Modified under JVM configuration of the parameters.

installing packetbeat

RPM-IVH packetbeat-5.6.0-x86_64.rpm

Vim/etc/packetbeat/packetbeat.yml

Packetbeat.interfaces.device:any

Packetbeat.protocols.mysql:

Ports: [3306]

Send_request:true

transaction_timeout:30s

Output.elasticsearch:

Hosts: ["10.0.20.25:9200"]

Work:1

Bulk_max_size:50

Timeout:90

Flush_interval:1s

Template.enabled:true

Template.name: "Packetbeat.template"

Template.overwrite:false

Index:test-mysql-%{+yyyy. MM.DD}

Then execute:

Curl-xput ' http://10.0.20.25:9200/_template/packetbeat ' [email Protected]/etc/packetbeat/packetbeat.template.json

upload the template to ES inside.

!! If you forget this step, go first to es index delete (curl-xdelete '/HTTP/ 10.0.20.25:9200/test-mysql-2017.09.23 '? pretty) beat !!

!! If you have customized the index name, you need to modify the name of the last line in the/etc/packetbeat/packetbeat.template.json and then Post start:

you can then use the command curl-xget ' http://10.0.20.25:9200/_template/packetbeat '? Pretty Check the current ES what templates exist in the

/etc/init.d/packetbeat Start Start packetbeat Grab Bag Tool

Wait a moment, you can use curl-xget ' Http://10.0.20.25:9200/test-mysql-2017.09.23/_search?pretty ' View ES whether there is data collected in it.

to the http://10.0.20.25:5601 inside, add an index with the name test-mysql-*

You can see that the data has been collected, such as:

650) this.width=650; "src=" Https://s3.51cto.com/wyfs02/M02/07/45/wKiom1nGRnzCa3W-AADDBoHQDBo389.png "title=" 11111.png "alt=" Wkiom1ngrnzca3w-aaddbohqdbo389.png "/>

This article is from the "notes of a Chicken" blog, please be sure to keep this source http://lee90.blog.51cto.com/10414478/1968035

Using Packetbeat to capture MySQL data