是否有人找到了自动创建Graylog2输入的便捷方法?
FROM graylog2/server:latest
COPY udp-input-graylog.json /usr/share/graylog/data/contentpacks
ENV GRAYLOG_CONTENT_PACKS_AUTO_INSTALL udp-input-graylog.json
ENV GRAYLOG_CONTENT_PACKS_LOADER_ENABLED true
ENV GRAYLOG_CONTENT_PACKS_DIR data/contentpacks
FROM graylog2/server:latest
COPY udp-input-graylog.json /usr/share/graylog/data/contentpacks
ENV GRAYLOG_CONTENT_PACKS_AUTO_LOAD udp-input-graylog.json
ENV GRAYLOG_CONTENT_PACKS_LOADER_ENABLED true
ENV GRAYLOG_CONTENT_PACKS_DIR data/contentpacks
udp-input-graylog.json (3.0 之前版本):
{
"name":"UDP GELF input on 12201",
"description":"Adds a global UDP GELF input on port 12201",
"category":"Inputs",
"inputs":[
{
"title":"udp input",
"configuration":{
"override_source":null,
"recv_buffer_size":262144,
"bind_address":"0.0.0.0",
"port":12201,
"decompress_size_limit":8388608
},
"static_fields":{},
"type":"org.graylog2.inputs.gelf.udp.GELFUDPInput",
"global":true,
"extractors":[]
}
],
"streams":[],
"outputs":[],
"dashboards":[],
"grok_patterns":[]
}
使用 contentpack 创建多个输入的步骤:
Write them into a file with json format (e.g.)
{"id" : null,
"name":" Inputs",
"description":"Contentpack that adds global inputs",
"category":"Inputs",
"inputs":[
{
"title":"udp input",
"configuration":{
"override_source":null,
"recv_buffer_size":262144,
"bind_address":"0.0.0.0",
"port":12201,
"decompress_size_limit":8388608
},
"static_fields":{},
"type":"org.graylog2.inputs.gelf.udp.GELFUDPInput",
"global":true,
"extractors":[]
},
{
"title":"tcp input",
"configuration":{
"override_source":null,
"recv_buffer_size":262144,
"bind_address":"0.0.0.0",
"port":12202,
"decompress_size_limit":8388608
},
"static_fields":{},
"type":"org.graylog2.inputs.gelf.tcp.GELFTCPInput",
"global":true,
"extractors":[]
}]
}
copy the contentpack to the contentpacks directory in graylog using ansible
- name: create graylog inputs for receiving logs
shell: cp .templates/inputs.json /usr/share/graylog-server/contentpacks/inputs.json
Set contentpacks autoload to True
in graylog.conf
or via ansible
graylog_content_packs_loader_enabled: true
Set contentpacks autoload to load inputs.json
(e.g. via ansible)
graylog_content_packs_auto_load: inputs.json
我使用ansible在容器中启动和准备graylog2。在graylog2的自动配置完成后,我通过调用graylog2 rest api创建全局udp输入:
- name: create graylog global udp input for receiving logs
uri:
url: http://{{ ipv4_address }}:9000/api/system/inputs
method: POST
user: "{{ graylog_admin }}"
password: "{{ graylog_pwd }}"
body: '{"title":"xxx global input","type":"org.graylog2.inputs.gelf.udp.GELFUDPInput","configuration":{"bind_address":"0.0.0.0","port":12201,"recv_buffer_size":262144,"override_source":null,"decompress_size_limit":8388608},"global":true}'
force_basic_auth: yes
status_code: 201
body_format: json
[ansible] [docker] [graylog2]
#!/bin/bash
if [ `curl -s -u admin:admin -H 'Content-Type: application/json' -X GET 'http://graylog:9000/api/system/inputs' | grep -c 'Standard GELF UDP input'` == 0 ]
then
curl -u admin:admin -H 'Content-Type: application/json' -X POST 'http://graylog:9000/api/system/inputs' -d '{
"title": "Standard GELF UDP input",
"type": "org.graylog2.inputs.gelf.udp.GELFUDPInput",
"global": true,
"configuration": {
"recv_buffer_size": 1048576,
"tcp_keepalive": false,
"use_null_delimiter": true,
"number_worker_threads": 2,
"tls_client_auth_cert_file": "",
"bind_address": "0.0.0.0",
"tls_cert_file": "",
"decompress_size_limit": 8388608,
"port": 12201,
"tls_key_file": "",
"tls_enable": false,
"tls_key_password": "",
"max_message_size": 2097152,
"tls_client_auth": "disabled",
"override_source": null
},
"node": null
}' -H 'X-Requested-By: cli'
else
echo "Standard GELF UDP input exists already"
fi
在折腾了一段时间后,我想出了一个权宜之计。这可能不是最好的解决方法,但是文件很少,而且似乎可以工作(但是请参见本帖子末尾的注意事项)。
问题在于每次重新启动Graylog2容器时,服务器都会生成一个新的唯一节点ID。通过Web界面定义的输入与特定节点ID相关联。因此,每当节点ID更改时,您定义的输入就变得无用了。
解决方案有两个部分:
确保MongoDB将其数据存储在某个持久位置 - 要么是数据容器,要么是从主机文件系统挂载的目录。
强制容器每次使用相同的节点ID。我通过扩展sjoerdmulder/graylog2映像来实现这一点:
这是Dockerfile:
FROM sjoerdmulder/graylog2
# set a Graylog2 node ID
#
RUN echo "mynodeid" > /opt/graylog2-server/server-node-id
RUN chmod 0444 /opt/graylog2-server/server-node-id
这将把“mynodeid”写入适当的文件并通过更改权限来进行写保护。然后服务器正常启动并加载适当的节点ID。现在您可以进入Web界面,创建您的输入,并确信下次启动容器时它仍将存在。
我没有使用集群。我只运行一个Graylog2实例,接受来自单个Web应用程序的输入。我不知道在集群的一部分时会发生什么。
答案中提供的内容包 json 对我无效。 我遇到了一个错误:
ERROR:org.graylog2.periodical.ContentPackLoaderPeriodical - 周期性未捕获的异常java.lang.IllegalArgumentException: 不支持的内容包版本:0
然而,结果证明创建内容包本身是一个简单且直接的过程。