Elasticsearch에 metricbeat 적용

https://www.elastic.co/guide/en/beats/metricbeat/8.12/metricbeat-installation-configuration.html

Metricbeat quick start: installation and configuration | Metricbeat Reference [8.12] | Elastic

# 다운로드 및 압축해제
curl -L -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-8.12.1-linux-x86_64.tar.gz
tar xzvf metricbeat-8.12.1-linux-x86_64.tar.gz

# 환경파일 수정
cd {압축해제 디렉토리}
vi metricbeat.yml
----------------------------
setup.kibana:
	host: "{kiban 도메인:포트}"

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["elasticsearch 도메인:포트"]

  # Performance preset - one of "balanced", "throughput", "scale",
  # "latency", or "custom".
  preset: balanced

  # Protocol - either `http` (default) or `https`.
  #protocol: "https"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: "elsticsearch 계정"
  password: "{elsticsearch 비밀번호}"
----------------------------

# 모듈 확인
# enable된 모듈 확인 가능
./metricbeat modules list

# 모듈 추가
# system은 default로 추가되어 있음
# nginx 추가
./metricbeat modules enable nginx
vi modules.d/nignix.yml
-------------------------
- module: nginx
  metricsets:
    - stubstatus
  period: 10s

  # Nginx hosts
  hosts: ["http://127.0.0.1"]

  # Path to server status. Default nginx_status
  server_status_path: "nginx_status"

  #username: "user"
  #password: "secret"
-------------------------

# elasticsearch 추가
./metricbeat modules enable elasticsearch-xpack
vi modules.d/elasticsearch-xpack.yml
-------------------------
- module: elasticsearch
  xpack.enabled: true
  period: 10s
  hosts: ["http://{elasticsearch 도메인}"]
  username: "elasticsearch 계정"
  password: "elasticsearch 비밀번호"
  #api_key: "foo:bar"
-------------------------

# 대시보드 추가(asset)
./metricbeat setup -e

# 실행
sudo chown root metricbeat.yml 
sudo chown root modules.d/system.yml 
sudo chown root modules.d/nginx.yml 
sudo chown root modules.d/elasticsearch-xpack.yml 
sudo ./metricbeat -e

# kibana 대시보드에서 확인

Trouble Shooting

• 413 payload too large

요청 Entity가 서버에 정의된 제한보다 크다는 것을 의미: 용량을 필요한 만큼 증가해줘야 함
metricbeat의 대시보드 내역을 추가하면서 발생한 에러

https://jw910911.tistory.com/125

express: 413 payload too large 에러 해결하기

https://hhhyunwoo.github.io/posts/k8s-nginx-413-error/#:~:text=Cause,%EC%BB%A4%EC%84%9C%20%EB%AA%BB%EB%B0%9B%EC%95%84%EC%A4%80%20%EA%B2%83%EC%9E%84.&text=%ED%95%B4%EB%8B%B9%20%EA%B0%92%EC%9D%84%20%EC%84%A4%EC%A0%95%ED%95%B4%EC%A3%BC%EC%A7%80%20%EC%95%8A%EC%9D%84%20%EA%B2%BD%EC%9A%B0%20Default%20%EA%B0%92%EC%9D%80%201MB%20%EC%9E%84.

[K8S] Ingress Nginx 413 http error (payload too large) 이슈 해결

# proxy nginx 수정
cd {nginx 설치 위치}
cd sites-available
sudo vi reverse-proxy.conf
-----------------------------
        client_max_body_size 10M;
-----------------------------

# nginx 재기동
sudo systemctl reload nginx

# kibana ingress 수정
-----------------------------
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {app명}
  namespace: {namespace}
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 10m
-----------------------------

# kibana ingress 재기동
kubectl apply -f {kibana ingress 정의된 파일}

• NGINX HTTP 403 Forbidden

https://discuss.elastic.co/t/metricbeat-cant-collect-nginx-metrics/76911/7

Metricbeat can't collect nginx metrics

# nginx 설정 수정
cd {nginx 설치 디렉토리}/sites-available/reverse-proxy.conf
---------------------
        location /nginx_status {
                stub_status on;
                access_log off;
                allow 127.0.0.1;
                deny all;
        }
---------------------

# nginx 재기동
sudo systemctl reload nginx