2018-05-21 logstatsh-forwarder 链

1、logstash服务器

    生成证书密钥并发送到forwarder服务器。

sudo openssl req -x509 -batch -nodes -newkey rsa:2048 -keyout private/logstash-forwarder.key -out certs/logstash-forwarder.crt

scp {private/logstash-forwarder.key,certs/logstash-forwarder.crt}    forwarder:

    logstash的输入数据源配置，接收forwarder服务器发送过来的日志。

input {

  lumberjack {

    port => 5000

    type => "logs"

    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"

    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"

  }

}

2、forwarder服务器

    进行以下配置并启动。

{

  "network": {

    "servers": [ "192.168.2.107:5000" ],

    "timeout": 15,

    "ssl ca": "/etc/pki/tls/certs/logstash-forwarder.crt"

    "ssl key": "/etc/pki/tls/certs/logstash-forwarder.key"

  },

  "files": [

    {

      "paths": [

        "/var/log/syslog",

        "/var/log/auth.log"

      ],

      "fields": { "type": "syslog" }

    }

  ]

}

最后出现的错误：

Jul 9 05:06:21 ubuntu logstash-forwarder[1374]: 2014/07/09 05:06:21.589762 Connecting to [192.168.2.107]:5000 (192.168.2.107)

Jul  9 05:06:21 ubuntu logstash-forwarder[1374]: 2014/07/09 05:06:21.595105 Failed to tls handshake with 192.168.2.107 x509: cannot validate certificate for 192.168.2.107 because it doesn't contain any IP SANs

Jul  9 05:06:22 ubuntu logstash-forwarder[1374]: 2014/07/09 05:06:22.595971 Connecting to [192.168.2.107]:5000 (192.168.2.107)

Jul  9 05:06:22 ubuntu logstash-forwarder[1374]: 2014/07/09 05:06:22.602024 Failed to tls handshake with 192.168.2.107 x509: cannot validate certificate for 192.168.2.107 because it doesn't contain any IP SANs

这是因为我们生成的密钥和证书没有经过ip地址认定。

    解决：

Edit your /etc/ssl/openssl.cnf on the logstash host - add subjectAltName = IP:192.168.2.107 in [v3_ca] section.

Recreate the certificate

Copy the cert and key to both hosts

有可能你的openssl配置文件不在这个路径  /etc/ssl/openssl.cnf  你可以找到他然后 add subjectAltName = IP:192.168.2.107 in [v3_ca] section.

    就解决这个问题了。