使用 readonly rest 插件访问 logstash

Question

elasticsearch 的只读 rest 插件存在问题：启用该插件后我们无法获得 logstash 运行。我们将 logstash 与 filebeat 一起使用。这可能是问题所在吗？ logstash 配置如下。错误信息：

[401] Forbidden {:class=>"Elasticsearch::Transport::Transport::Errors::Unauthorized", :level=>:error}

在 elasticsearch 中，我们定义了如下所示的角色。

readonlyrest:
   enable: true
   response_if_req_forbidden: <h1>Forbidden</h1>    
   access_control_rules:
    - name: Developer (reads only logstash indices, but can create new charts/dashboards)
      auth_key: dev:dev
      type: allow
      kibana_access: ro+
      indices: ["<no-index>", ".kibana*", "logstash*", "default"]
   - name: Kibana Server (we trust this server side component, full access granted via HTTP authentication)
     auth_key: admin:passwd1
     type: allow
   - name: "Logstash can write and create its own indices"
     auth_key: logstash:logstash
     type: allow
     actions: ["cluster:*", "indices:data/read/*","indices:data/write/*","indices:admin/*"]
     indices: ["logstash*", "filebeat-*", "<no_index>"]
the logstash config:

output{
    elasticsearch {      
    hosts => ["localhost:9200"]
        manage_template => true
        index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
        document_type => "%{[@metadata][type]}"
        document_id => "%{fingerprint}"
    user => ["logstash"]
    password => ["logstash"]
    }
}

Answer 1

我相信您没有赋予 logstash 使用您的设置创建索引的能力。它可以写入和读取，但我没有看到创建。

根据网站示例，您能否将您的 logstash 配置更改为：

-  name: "Logstash can write and create its own indices"
   auth_key: logstash:logstash
   type: allow
   actions: ["indices:data/read/*","indices:data/write/*","indices:admin/template/*","indices:admin/create"]
   indices: ["logstash-*", "<no_index>"]

这个设置适合我。

我认为它与 filebeat 没有任何关系，因为输出实际上不再与 filebeat 对话了吗？但话又说回来，我改用文件输入。

希望能解决问题。

亚瑟

使用 readonly rest 插件访问 logstash

logstash access with readonly rest plugin

plugins

logstash

readonly