Filebeat 无法通过 haproxy 将日志发送到 logzio

Question

以下是我的 filebeat.yml

的输出片段

output:
  logstash:
    hosts: ['192.168.200.38:5015']

其中 192.168.200.38:5015 是以 tcp 模式侦听的 haproxy 服务器。

以下是我的 haproxy 配置：

global
  daemon
  maxconn 256

defaults
  mode tcp
  timeout connect 5000ms
  timeout client 50000ms
  timeout server 50000ms
  timeout tunnel 1h

listen stats
  bind 0.0.0.0:9999
  stats enable
  stats hide-version
  stats uri /stats

frontend proxy_in
  bind 0.0.0.0:5015

backend proxies_out
  balance roundrobin
  mode tcp
  server ip-1 listener.logz.io:5015

使用上面的配置我得到以下错误：

Jul 02 14:32:46 cust1-bast-linux-0 filebeat[83565]: 2019-07-02T14:32:46.560Z DEBUG [logstash] logstash/async.go:111 connect
Jul 02 14:32:46 cust1-bast-linux-0 filebeat[83565]: 2019-07-02T14:32:46.562Z INFO pipeline/output.go:105 Connection to backoff(async(tcp://192.168.200.38:5015)) established
Jul 02 14:32:46 cust1-bast-linux-0 filebeat[83565]: 2019-07-02T14:32:46.563Z DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host 192.168.200.38:5015. Continue sending
Jul 02 14:32:46 cust1-bast-linux-0 filebeat[83565]: 2019-07-02T14:32:46.564Z DEBUG [transport] transport/client.go:218 handle error: EOF
Jul 02 14:32:46 cust1-bast-linux-0 filebeat[83565]: 2019-07-02T14:32:46.564Z DEBUG [transport] transport/client.go:131 closing
Jul 02 14:32:46 cust1-bast-linux-0 filebeat[83565]: 2019-07-02T14:32:46.564Z ERROR logstash/async.go:256 Failed to publish events caused by: EOF
Jul 02 14:32:46 cust1-bast-linux-0 filebeat[83565]: 2019-07-02T14:32:46.565Z DEBUG [logstash] logstash/async.go:159 1 events out of 1 events sent to logstash host 192.168.200.38:5015. Continue sending
Jul 02 14:32:46 cust1-bast-linux-0 filebeat[83565]: 2019-07-02T14:32:46.565Z DEBUG [logstash] logstash/async.go:116 close connection
Jul 02 14:32:46 cust1-bast-linux-0 filebeat[83565]: 2019-07-02T14:32:46.565Z ERROR logstash/async.go:256 Failed to publish events caused by: client is not connected
Jul 02 14:32:46 cust1-bast-linux-0 filebeat[83565]: 2019-07-02T14:32:46.565Z DEBUG [logstash] logstash/async.go:116 close connection

我这里使用的是haproxy server作为代理服务器。早些时候我有 squid proxy(http)，它不能与 filebeat 一起使用。所以将其更改为 haproxy，我将 listener.logz.io:5015 作为后端。

我做错了什么？

Answer 1

已解决！

问题是 'listener.logz.io:5015' 需要证书。添加了 ssl 选项来传递证书，但是为了让 haproxy 识别证书，我不得不将主机名更改为 something.logz.io。所以我将安装 haproxy 的主机名更改为 proxy.logz.io（我知道这是一种解决方法）。

以下配置有效：

filebeat.yml

output:
  logstash:
    hosts: ['proxy.logz.io:5015']
     ssl:
      certificate_authorities:  ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']

haproxy.cfg

#Forward HAProxy Config

global
 debug
 daemon
 maxconn 10000

defaults
 mode tcp
 timeout client 200000ms
 timeout server 200000ms

#create new frontend to process 5015
frontend https_frontend
  bind *:5015
  mode tcp
  option tcplog
  default_backend logz

#Define backend for above frontend
backend logz
  mode tcp
  balance roundrobin
  server logzio listener.logz.io:5015

Filebeat 无法通过 haproxy 将日志发送到 logzio

Filebeat unable send logs to logzio via haproxy

haproxy

filebeat

logz.io