운영 체제 및 서버에서 실행되는 서비스에서 주기적으로 메트릭(Metric)을 수집하는 경량 수집기이다.
주로 하드웨어 위주의 수집파트를 맡는 beat로 실시간 리소스 사용량을 전달해줘 서버의 서비스 상태를 실시간으로 모니터링할 수 있다.
내가 Metricbeat를 설치하게 된 이유는 로그 수집 서버의 시스템 로그를 가져오기 위해 진행했다.
구축환경
OS: Ubiuntu 22.04
CPU: 4v Cpu
RAM: 16GB
DISK: 100GB(OS 및 프로그램 설치할 하드) + 100GB(ELK 분석/저장 파일 보관할 하드)
ETC: Openstack(IAAS)
Metricbeat 설치
root@ubuntu:/home/ubuntu# curl -L -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-8.12.0-amd64.deb
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 51.5M 100 51.5M 0 0 21.1M 0 0:00:02 0:00:02 --:--:-- 21.1M
#deb로 받기
root@ubuntu:/home/ubuntu# sudo dpkg -i metricbeat-8.12.0-amd64.deb
#설치 진행
Selecting previously unselected package metricbeat.
(Reading database ... 203190 files and directories currently installed.)
Preparing to unpack metricbeat-8.12.0-amd64.deb ...
Unpacking metricbeat (8.12.0) ...
Setting up metricbeat (8.12.0) ...
root@ubuntu:/home/ubuntu# metricbeat modules enable system
Module system is already enabled
#모듈실행(이미 실행되어 있네..)
Metricbeat 관련 설정 및 등록, 실행
root@ubuntu:/home/ubuntu# vi /etc/metricbeat/metricbeat.yml
#수정
# =================================== Kibana ===================================
# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:
# Kibana Host
# Scheme and port can be left out and will be set to the default (http and 5601)
# In case you specify and additional path, the scheme is required: http://localhost:5601/path
# IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
host: "(kibana IP):5601"
# Kibana Space ID
# ID of the Kibana Space into which the dashboards should be loaded. By default,
# the Default Space will be used.
#space.id:
#....(생략)
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["(Elasticsearch ip):9200"]
# Performance preset - one of "balanced", "throughput", "scale",
# "latency", or "custom".
preset: balanced
root@ubuntu:/home/ubuntu# metricbeat setup -e
{"log.level":"info","@timestamp":"2024-02-07T10:51:49.782+0900","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure","file.name":"instance/beat.go","file.line":811},"message":"Home path: [/usr/share/metricbeat] Config path: [/etc/metricbeat] Data path: [/var/lib/metricbeat] Logs path: [/var/log/metricbeat]","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:49.783+0900","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure","file.name":"instance/beat.go","file.line":819},"message":"Beat ID: 612a8517-1057-4460-b85f-d5550a3a41e3","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:49.960+0900","log.logger":"beat","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.logSystemInfo","file.name":"instance/beat.go","file.line":1337},"message":"Beat info","service.name":"metricbeat","system_info":{"beat":{"path":{"config":"/etc/metricbeat","data":"/var/lib/metricbeat","home":"/usr/share/metricbeat","logs":"/var/log/metricbeat"},"type":"metricbeat","uuid":"612a8517-1057-4460-b85f-d5550a3a41e3"},"ecs.version":"1.6.0"}}
{"log.level":"info","@timestamp":"2024-02-07T10:51:49.961+0900","log.logger":"beat","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.logSystemInfo","file.name":"instance/beat.go","file.line":1346},"message":"Build info","service.name":"metricbeat","system_info":{"build":{"commit":"27c592782c25906c968a41f0a6d8b1955790c8c5","libbeat":"8.12.0","time":"2024-01-10T21:09:16.000Z","version":"8.12.0"},"ecs.version":"1.6.0"}}
{"log.level":"info","@timestamp":"2024-02-07T10:51:49.961+0900","log.logger":"beat","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.logSystemInfo","file.name":"instance/beat.go","file.line":1349},"message":"Go runtime info","service.name":"metricbeat","system_info":{"go":{"os":"linux","arch":"amd64","max_procs":2,"version":"go1.20.12"},"ecs.version":"1.6.0"}}
{"log.level":"info","@timestamp":"2024-02-07T10:51:49.962+0900","log.logger":"beat","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.logSystemInfo","file.name":"instance/beat.go","file.line":1355},"message":"Host info","service.name":"metricbeat","system_info":{"host":{"architecture":"x86_64","boot_time":"2024-02-06T14:34:58+09:00","containerized":false,"name":"ubuntu","ip":["127.0.0.1","::1","10.0.0.230","fe80::f816:3eff:fe45:a062"],"kernel_version":"5.15.0-92-generic","mac":["fa:16:3e:45:a0:62"],"os":{"type":"linux","family":"debian","platform":"ubuntu","name":"Ubuntu","version":"22.04.3 LTS (Jammy Jellyfish)","major":22,"minor":4,"patch":3,"codename":"jammy"},"timezone":"KST","timezone_offset_sec":32400,"id":"d333f592b8e9d2f5a9a7c79f216c1004"},"ecs.version":"1.6.0"}}
{"log.level":"info","@timestamp":"2024-02-07T10:51:49.962+0900","log.logger":"beat","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.logSystemInfo","file.name":"instance/beat.go","file.line":1384},"message":"Process info","service.name":"metricbeat","system_info":{"process":{"capabilities":{"inheritable":null,"permitted":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read","perfmon","bpf","checkpoint_restore"],"effective":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read","perfmon","bpf","checkpoint_restore"],"bounding":["chown","dac_override","dac_read_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux_immutable","net_bind_service","net_broadcast","net_admin","net_raw","ipc_lock","ipc_owner","sys_module","sys_rawio","sys_chroot","sys_ptrace","sys_pacct","sys_admin","sys_boot","sys_nice","sys_resource","sys_time","sys_tty_config","mknod","lease","audit_write","audit_control","setfcap","mac_override","mac_admin","syslog","wake_alarm","block_suspend","audit_read","perfmon","bpf","checkpoint_restore"],"ambient":null},"cwd":"/home/ubuntu","exe":"/usr/share/metricbeat/bin/metricbeat","name":"metricbeat","pid":9487,"ppid":9337,"seccomp":{"mode":"disabled","no_new_privs":false},"start_time":"2024-02-07T10:51:48.910+0900"},"ecs.version":"1.6.0"}}
{"log.level":"info","@timestamp":"2024-02-07T10:51:49.963+0900","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).createBeater","file.name":"instance/beat.go","file.line":334},"message":"Setup Beat: metricbeat; Version: 8.12.0","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:49.968+0900","log.logger":"elasticsearch","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/outputs/elasticsearch.makeES","file.name":"elasticsearch/elasticsearch.go","file.line":63},"message":"Applying performance preset 'balanced': {\n \"bulk_max_size\": 1600,\n \"compression_level\": 1,\n \"idle_connection_timeout\": \"3s\",\n \"queue\": {\n \"mem\": {\n \"events\": 3200,\n \"flush\": {\n \"min_events\": 1600,\n \"timeout\": \"10s\"\n }\n }\n },\n \"worker\": 1\n}","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2024-02-07T10:51:49.968+0900","log.logger":"elasticsearch","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/outputs/elasticsearch.makeES","file.name":"elasticsearch/elasticsearch.go","file.line":66},"message":"Performance preset 'balanced' overrides user setting for field 'bulk_max_size'","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:49.968+0900","log.logger":"esclientleg","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.NewConnection","file.name":"eslegclient/connection.go","file.line":122},"message":"elasticsearch url: http://10.0.0.121:9200","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:49.969+0900","log.logger":"publisher","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/publisher/pipeline.LoadWithSettings","file.name":"pipeline/module.go","file.line":105},"message":"Beat name: ubuntu","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:49.992+0900","log.logger":"esclientleg","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.NewConnection","file.name":"eslegclient/connection.go","file.line":122},"message":"elasticsearch url: http://10.0.0.121:9200","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:49.999+0900","log.logger":"esclientleg","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.(*Connection).Ping","file.name":"eslegclient/connection.go","file.line":304},"message":"Attempting to connect to Elasticsearch version 8.12.0 (default)","service.name":"metricbeat","ecs.version":"1.6.0"}
Overwriting lifecycle policy is disabled. Set `setup.ilm.overwrite: true` to overwrite.
{"log.level":"info","@timestamp":"2024-02-07T10:51:49.999+0900","log.logger":"index-management","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/idxmgmt.(*indexManager).Setup","file.name":"idxmgmt/index_support.go","file.line":254},"message":"Auto lifecycle enable success.","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:50.011+0900","log.logger":"index-management.ilm","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/idxmgmt/lifecycle.(*stdManager).EnsurePolicy","file.name":"lifecycle/standard_manager.go","file.line":111},"message":"lifecycle policy metricbeat exists already.","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:50.011+0900","log.logger":"index-management","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/idxmgmt.applyLifecycleSettingsToTemplate","file.name":"idxmgmt/index_support.go","file.line":402},"message":"Set settings.index.lifecycle.name in template to metricbeat as ILM is enabled.","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:50.046+0900","log.logger":"template","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/template.(*templateBuilder).buildBody","file.name":"template/load.go","file.line":263},"message":"Existing template will be overwritten, as overwrite is enabled.","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-02-07T10:51:50.050+0900","log.logger":"add_cloud_metadata","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/processors/add_cloud_metadata.(*addCloudMetadata).fetchMetadata","file.name":"add_cloud_metadata/providers.go","file.line":173},"message":"add_cloud_metadata: received error failed with http status code 403","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-02-07T10:51:50.051+0900","log.logger":"add_cloud_metadata","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/processors/add_cloud_metadata.(*addCloudMetadata).fetchMetadata","file.name":"add_cloud_metadata/providers.go","file.line":173},"message":"add_cloud_metadata: received error failed with http status code 403","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-02-07T10:51:50.057+0900","log.logger":"add_cloud_metadata","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/processors/add_cloud_metadata.(*addCloudMetadata).fetchMetadata","file.name":"add_cloud_metadata/providers.go","file.line":173},"message":"add_cloud_metadata: received error failed with http status code 403","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-02-07T10:51:50.057+0900","log.logger":"add_cloud_metadata","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/processors/add_cloud_metadata.(*addCloudMetadata).fetchMetadata","file.name":"add_cloud_metadata/providers.go","file.line":173},"message":"add_cloud_metadata: received error failed with http status code 403","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-02-07T10:51:50.058+0900","log.logger":"add_cloud_metadata","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/processors/add_cloud_metadata.(*addCloudMetadata).fetchMetadata","file.name":"add_cloud_metadata/providers.go","file.line":173},"message":"add_cloud_metadata: received error failed with http status code 403","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-02-07T10:51:50.079+0900","log.logger":"add_cloud_metadata","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/processors/add_cloud_metadata.(*addCloudMetadata).fetchMetadata","file.name":"add_cloud_metadata/providers.go","file.line":173},"message":"add_cloud_metadata: received error failed with http status code 403","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-02-07T10:51:50.123+0900","log.logger":"add_cloud_metadata","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/processors/add_cloud_metadata.(*addCloudMetadata).fetchMetadata","file.name":"add_cloud_metadata/providers.go","file.line":173},"message":"add_cloud_metadata: received error failed fetching EC2 Identity Document: operation error ec2imds: GetInstanceIdentityDocument, http response error StatusCode: 403, request to EC2 IMDS failed","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:50.546+0900","log.logger":"template_loader","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/template.(*ESLoader).loadTemplate","file.name":"template/load.go","file.line":177},"message":"Try loading template metricbeat-8.12.0 to Elasticsearch","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:50.687+0900","log.logger":"template_loader","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/template.(*ESLoader).Load","file.name":"template/load.go","file.line":134},"message":"Template with name \"metricbeat-8.12.0\" loaded.","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:50.689+0900","log.logger":"template_loader","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/template.(*ESLoader).putDataStream","file.name":"template/load.go","file.line":202},"message":"Try loading data stream metricbeat-8.12.0 to Elasticsearch","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:51.039+0900","log.logger":"template_loader","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/template.(*ESLoader).Load","file.name":"template/load.go","file.line":168},"message":"Data stream with name \"metricbeat-8.12.0\" loaded.","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:51.039+0900","log.logger":"index-management","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/idxmgmt.(*indexManager).Setup","file.name":"idxmgmt/index_support.go","file.line":299},"message":"Loaded index template.","service.name":"metricbeat","ecs.version":"1.6.0"}
Index setup finished.
Loading dashboards (Kibana must be running and reachable)
{"log.level":"info","@timestamp":"2024-02-07T10:51:51.040+0900","log.logger":"kibana","log.origin":{"function":"github.com/elastic/elastic-agent-libs/kibana.NewClientWithConfigDefault","file.name":"kibana/client.go","file.line":182},"message":"Kibana url: http://10.0.0.121:5601","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:51.656+0900","log.logger":"kibana","log.origin":{"function":"github.com/elastic/elastic-agent-libs/kibana.NewClientWithConfigDefault","file.name":"kibana/client.go","file.line":182},"message":"Kibana url: http://10.0.0.121:5601","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:51:52.957+0900","log.logger":"add_cloud_metadata","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/processors/add_cloud_metadata.(*addCloudMetadata).init.func1","file.name":"add_cloud_metadata/add_cloud_metadata.go","file.line":100},"message":"add_cloud_metadata: hosting provider type not detected.","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-02-07T10:53:47.949+0900","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).loadDashboards","file.name":"instance/beat.go","file.line":1024},"message":"Kibana dashboards successfully loaded.","service.name":"metricbeat","ecs.version":"1.6.0"}
Loaded dashboards
root@ubuntu:/home/ubuntu# systemctl enable metricbeat
Synchronizing state of metricbeat.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable metricbeat
Created symlink /etc/systemd/system/multi-user.target.wants/metricbeat.service → /lib/systemd/system/metricbeat.service.
root@ubuntu:/home/ubuntu# systemctl restart metricbeat
root@ubuntu:/home/ubuntu# systemctl status metricbeat
● metricbeat.service - Metricbeat is a lightweight shipper for metrics.
Loaded: loaded (/lib/systemd/system/metricbeat.service; enabled; vendor preset: enabled)
Active: active (running) since Wed 2024-02-07 10:04:24 KST; 3s ago
Docs: https://www.elastic.co/beats/metricbeat
Main PID: 12142 (metricbeat)
Tasks: 9 (limit: 19140)
Memory: 50.7M
CPU: 314ms
CGroup: /system.slice/metricbeat.service
└─12142 /usr/share/metricbeat/bin/metricbeat --environment systemd -c /etc/metricbeat/metricbeat.yml --path.home /usr/share/met>
Feb 07 10:04:24 ubuntu metricbeat[12142]: {"log.level":"info","@timestamp":"2024-02-07T10:04:24.339+0900","log.logger":"system.fsstat","log.>
Feb 07 10:04:24 ubuntu metricbeat[12142]: {"log.level":"info","@timestamp":"2024-02-07T10:04:24.340+0900","log.origin":{"function":"github.c>
Feb 07 10:04:24 ubuntu metricbeat[12142]: {"log.level":"error","@timestamp":"2024-02-07T10:04:24.372+0900","log.logger":"add_cloud_metadata">
Feb 07 10:04:24 ubuntu metricbeat[12142]: {"log.level":"error","@timestamp":"2024-02-07T10:04:24.377+0900","log.logger":"add_cloud_metadata">
Feb 07 10:04:24 ubuntu metricbeat[12142]: {"log.level":"error","@timestamp":"2024-02-07T10:04:24.377+0900","log.logger":"add_cloud_metadata">
Feb 07 10:04:24 ubuntu metricbeat[12142]: {"log.level":"error","@timestamp":"2024-02-07T10:04:24.382+0900","log.logger":"add_cloud_metadata">
Feb 07 10:04:24 ubuntu metricbeat[12142]: {"log.level":"error","@timestamp":"2024-02-07T10:04:24.386+0900","log.logger":"add_cloud_metadata">
Feb 07 10:04:24 ubuntu metricbeat[12142]: {"log.level":"error","@timestamp":"2024-02-07T10:04:24.386+0900","log.logger":"add_cloud_metadata">
Feb 07 10:04:24 ubuntu metricbeat[12142]: {"log.level":"error","@timestamp":"2024-02-07T10:04:24.451+0900","log.logger":"add_cloud_metadata">
Feb 07 10:04:27 ubuntu metricbeat[12142]: {"log.level":"info","@timestamp":"2024-02-07T10:04:27.297+0900","log.logger":"add_cloud_metadata",>
