writeback_index: elastalert_status # elastalert2가 데이터를 저장할 index
alert_time_limit: # 실패한 경고에 대한 재시도 기간
days: 2' > config.yaml
pip 명령어가 없는 경우
[root@tmplogsvr opt]# pip3 install --upgrade pip
WARNING: Running pip install with root privileges is generally not a good idea. Try `pip3 install --user` instead.
Collecting pip
Downloading https://files.pythonhosted.org/packages/a4/6d/6463d49a933f547439d6b5b98b46af8742cc03ae83543e4d7688c2420f8b/pip-21.3.1-py3-none-any.whl (1.7MB)
100% |████████████████████████████████| 1.7MB 1.2MB/s
Installing collected packages: pip
Successfully installed pip-21.3.1
You are using pip version 21.3.1, however version 23.0.1 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
[root@tmplogsvr opt]#
elastalert 설치
- 오류발생: ModuleNotFoundError: No module named 'setuptools_rust'
[root@tmplogsvr opt]# pip3 install setuptools-rust
WARNING: Running pip install with root privileges is generally not a good idea. Try `pip3 install --user` instead.
Collecting setuptools-rust
Downloading https://files.pythonhosted.org/packages/66/ca/66bdf8f326977098eff28c314c8f825bc28d6986944c590e40ad0f74c5f0/setuptools_rust-1.1.2-py3-none-any.whl
Collecting typing-extensions>=3.7.4.3 (from setuptools-rust)
Using cached https://files.pythonhosted.org/packages/45/6b/44f7f8f1e110027cf88956b59f2fad776cca7e1704396d043f89effd3a0e/typing_extensions-4.1.1-py3-none-any.whl
Collecting setuptools>=46.1 (from setuptools-rust)
Downloading https://files.pythonhosted.org/packages/b0/3a/88b210db68e56854d0bcf4b38e165e03be377e13907746f825790f3df5bf/setuptools-59.6.0-py3-none-any.whl (952kB)
100% |████████████████████████████████| 962kB 2.0MB/s
Collecting semantic-version<3,>=2.8.2 (from setuptools-rust)
Downloading https://files.pythonhosted.org/packages/6a/23/8146aad7d88f4fcb3a6218f41a60f6c2d4e3a72de72da1825dc7c8f7877c/semantic_version-2.10.0-py2.py3-none-any.whl
Installing collected packages: typing-extensions, setuptools, semantic-version, setuptools-rust
Successfully installed semantic-version-2.10.0 setuptools-59.6.0 setuptools-rust-1.1.2 typing-extensions-4.1.1
[root@tmplogsvr opt]#
pip를 설치하여 pip3가 아닌 pip로 elastalert 설치
- 오류발생: error: command 'gcc' failed with exit status 1
[root@tmplogsvr opt]# pip install elastalert
Collecting elastalert
Using cached elastalert-0.2.4.tar.gz (128 kB)
Preparing metadata (setup.py) ... done
Collecting apscheduler>=3.3.0
Using cached APScheduler-3.10.1-py3-none-any.whl (59 kB)
Collecting aws-requests-auth>=0.3.0
Using cached aws_requests_auth-0.4.3-py2.py3-none-any.whl (6.8 kB)
Collecting blist>=1.3.6
Using cached blist-1.3.6.tar.gz (122 kB)
Preparing metadata (setup.py) ... done
Collecting boto3>=1.4.4
Using cached boto3-1.23.10-py3-none-any.whl (132 kB)
Collecting configparser>=3.5.0
Using cached configparser-5.2.0-py3-none-any.whl (19 kB)
Collecting croniter>=0.3.16
Using cached croniter-1.3.8-py2.py3-none-any.whl (18 kB)
Collecting elasticsearch==7.0.0
Using cached elasticsearch-7.0.0-py2.py3-none-any.whl (80 kB)
Collecting envparse>=0.2.0
Using cached envparse-0.2.0.tar.gz (7.6 kB)
Preparing metadata (setup.py) ... done
Collecting exotel>=0.1.3
Using cached exotel-0.1.5.tar.gz (2.2 kB)
Preparing metadata (setup.py) ... done
Collecting jira>=2.0.0
Using cached jira-3.2.0-py3-none-any.whl (69 kB)
Collecting jsonschema>=3.0.2
Using cached jsonschema-3.2.0-py2.py3-none-any.whl (56 kB)
Collecting mock>=2.0.0
Using cached mock-5.0.1-py3-none-any.whl (30 kB)
Collecting prison>=0.1.2
Using cached prison-0.2.1-py2.py3-none-any.whl (5.8 kB)
Collecting PyStaticConfiguration>=0.10.3
Using cached PyStaticConfiguration-0.11.1-py3-none-any.whl (27 kB)
Requirement already satisfied: python-dateutil<2.7.0,>=2.6.0 in /usr/lib/python3.6/site-packages (from elastalert) (2.6.1)
Requirement already satisfied: PyYAML>=3.12 in /usr/lib64/python3.6/site-packages (from elastalert) (3.12)
Requirement already satisfied: requests>=2.10.0 in /usr/lib/python3.6/site-packages (from elastalert) (2.20.0)
Collecting stomp.py>=4.1.17
Using cached stomp.py-8.1.0-py3-none-any.whl (42 kB)
Collecting texttable>=0.8.8
Using cached texttable-1.6.7-py2.py3-none-any.whl (10 kB)
Collecting twilio<6.1,>=6.0.0
Using cached twilio-6.0.0.tar.gz (304 kB)
Preparing metadata (setup.py) ... done
Collecting python-magic>=0.4.15
Using cached python_magic-0.4.27-py2.py3-none-any.whl (13 kB)
Collecting cffi>=1.11.5
Using cached cffi-1.15.1-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl (402 kB)
Requirement already satisfied: urllib3>=1.21.1 in /usr/lib/python3.6/site-packages (from elasticsearch==7.0.0->elastalert) (1.24.2)
Requirement already satisfied: six>=1.4.0 in /usr/lib/python3.6/site-packages (from apscheduler>=3.3.0->elastalert) (1.11.0)
Requirement already satisfied: pytz in /usr/lib/python3.6/site-packages (from apscheduler>=3.3.0->elastalert) (2017.2)
Collecting tzlocal!=3.*,>=2.0
Using cached tzlocal-4.2-py3-none-any.whl (19 kB)
Requirement already satisfied: setuptools>=0.7 in /usr/local/lib/python3.6/site-packages (from apscheduler>=3.3.0->elastalert) (59.6.0)
Collecting s3transfer<0.6.0,>=0.5.0
Using cached s3transfer-0.5.2-py3-none-any.whl (79 kB)
Collecting botocore<1.27.0,>=1.26.10
Using cached botocore-1.26.10-py3-none-any.whl (8.8 MB)
Collecting jmespath<2.0.0,>=0.7.1
Using cached jmespath-0.10.0-py2.py3-none-any.whl (24 kB)
Collecting pycparser
Using cached pycparser-2.21-py2.py3-none-any.whl (118 kB)
Collecting defusedxml
Using cached defusedxml-0.7.1-py2.py3-none-any.whl (25 kB)
Collecting requests-oauthlib>=1.1.0
Using cached requests_oauthlib-1.3.1-py2.py3-none-any.whl (23 kB)
Collecting requests-toolbelt
Using cached requests_toolbelt-0.10.1-py2.py3-none-any.whl (54 kB)
Collecting keyring
Using cached keyring-23.4.1-py3-none-any.whl (33 kB)
Requirement already satisfied: typing-extensions>=3.7.4.2 in /usr/local/lib/python3.6/site-packages (from jira>=2.0.0->elastalert) (4.1.1)
Collecting importlib-metadata
Using cached importlib_metadata-4.8.3-py3-none-any.whl (17 kB)
Collecting pyrsistent>=0.14.0
Using cached pyrsistent-0.18.0-cp36-cp36m-manylinux1_x86_64.whl (117 kB)
Collecting attrs>=17.4.0
Using cached attrs-22.2.0-py3-none-any.whl (60 kB)
Requirement already satisfied: chardet<3.1.0,>=3.0.2 in /usr/lib/python3.6/site-packages (from requests>=2.10.0->elastalert) (3.0.4)
Requirement already satisfied: idna<2.8,>=2.5 in /usr/lib/python3.6/site-packages (from requests>=2.10.0->elastalert) (2.5)
Collecting docopt<0.7.0,>=0.6.2
Using cached docopt-0.6.2.tar.gz (25 kB)
Preparing metadata (setup.py) ... done
Collecting websocket-client<2.0.0,>=1.2.3
Using cached websocket_client-1.3.1-py3-none-any.whl (54 kB)
Collecting PyJWT>=1.4.2
Using cached PyJWT-2.4.0-py3-none-any.whl (18 kB)
Requirement already satisfied: pysocks in /usr/lib/python3.6/site-packages (from twilio<6.1,>=6.0.0->elastalert) (1.6.8)
INFO: pip is looking at multiple versions of attrs to determine which version is compatible with other requirements. This could take a while.
Collecting attrs>=17.4.0
Downloading attrs-22.1.0-py2.py3-none-any.whl (58 kB)
|████████████████████████████████| 58 kB 12.4 MB/s
INFO: pip is looking at multiple versions of twilio to determine which version is compatible with other requirements. This could take a while.
INFO: pip is looking at multiple versions of texttable to determine which version is compatible with other requirements. This could take a while.
Collecting texttable>=0.8.8
Downloading texttable-1.6.6-py2.py3-none-any.whl (11 kB)
INFO: pip is looking at multiple versions of stomp-py to determine which version is compatible with other requirements. This could take a while.
Collecting stomp.py>=4.1.17
Downloading stomp.py-8.0.1-py3-none-any.whl (37 kB)
INFO: pip is looking at multiple versions of requests to determine which version is compatible with other requirements. This could take a while.
Collecting requests>=2.10.0
Downloading requests-2.27.1-py2.py3-none-any.whl (63 kB)
|████████████████████████████████| 63 kB 5.3 MB/s
Collecting charset-normalizer~=2.0.0
Downloading charset_normalizer-2.0.12-py3-none-any.whl (39 kB)
Collecting certifi>=2017.4.17
Downloading certifi-2022.12.7-py3-none-any.whl (155 kB)
|████████████████████████████████| 155 kB 74.1 MB/s
Collecting urllib3>=1.21.1
Downloading urllib3-1.26.15-py2.py3-none-any.whl (140 kB)
|████████████████████████████████| 140 kB 69.9 MB/s
Collecting oauthlib>=3.0.0
Using cached oauthlib-3.2.2-py3-none-any.whl (151 kB)
Collecting backports.zoneinfo
Using cached backports.zoneinfo-0.2.1-cp36-cp36m-manylinux1_x86_64.whl (70 kB)
Collecting pytz-deprecation-shim
Using cached pytz_deprecation_shim-0.1.0.post0-py2.py3-none-any.whl (15 kB)
Collecting zipp>=0.5
Using cached zipp-3.6.0-py3-none-any.whl (5.3 kB)
Collecting jeepney>=0.4.2
Using cached jeepney-0.7.1-py3-none-any.whl (54 kB)
Collecting SecretStorage>=3.2
Using cached SecretStorage-3.3.3-py3-none-any.whl (15 kB)
Collecting cryptography>=2.0
Downloading cryptography-39.0.2-cp36-abi3-manylinux_2_28_x86_64.whl (4.2 MB)
|████████████████████████████████| 4.2 MB 78.6 MB/s
Collecting importlib-resources
Using cached importlib_resources-5.4.0-py3-none-any.whl (28 kB)
Collecting tzdata
Using cached tzdata-2022.7-py2.py3-none-any.whl (340 kB)
Using legacy 'setup.py install' for elastalert, since package 'wheel' is not installed.
Using legacy 'setup.py install' for blist, since package 'wheel' is not installed.
Using legacy 'setup.py install' for envparse, since package 'wheel' is not installed.
Using legacy 'setup.py install' for exotel, since package 'wheel' is not installed.
Using legacy 'setup.py install' for twilio, since package 'wheel' is not installed.
Using legacy 'setup.py install' for docopt, since package 'wheel' is not installed.
Installing collected packages: zipp, pycparser, importlib-resources, cffi, urllib3, tzdata, jmespath, jeepney, cryptography, charset-normalizer, certifi, backports.zoneinfo, SecretStorage, requests, pytz-deprecation-shim, oauthlib, importlib-metadata, botocore, websocket-client, tzlocal, s3transfer, requests-toolbelt, requests-oauthlib, pyrsistent, PyJWT, keyring, docopt, defusedxml, attrs, twilio, texttable, stomp.py, python-magic, PyStaticConfiguration, prison, mock, jsonschema, jira, exotel, envparse, elasticsearch, croniter, configparser, boto3, blist, aws-requests-auth, apscheduler, elastalert
Attempting uninstall: urllib3
Found existing installation: urllib3 1.24.2
Uninstalling urllib3-1.24.2:
Successfully uninstalled urllib3-1.24.2
Attempting uninstall: requests
Found existing installation: requests 2.20.0
Uninstalling requests-2.20.0:
Successfully uninstalled requests-2.20.0
Running setup.py install for docopt ... done
Running setup.py install for twilio ... done
Running setup.py install for exotel ... done
Running setup.py install for envparse ... done
Running setup.py install for blist ... error
ERROR: Command errored out with exit status 1:
command: /usr/bin/python3.6 -u -c 'import io, os, sys, setuptools, tokenize; sys.argv[0] = '"'"'/tmp/pip-install-vw09qqdo/blist_5985a06eebc244dfbb6203841bf7f137/setup.py'"'"'; __file__='"'"'/tmp/pip-install-vw09qqdo/blist_5985a06eebc244dfbb6203841bf7f137/setup.py'"'"';f = getattr(tokenize, '"'"'open'"'"', open)(__file__) if os.path.exists(__file__) else io.StringIO('"'"'from setuptools import setup; setup()'"'"');code = f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record /tmp/pip-record-9ratp9fl/install-record.txt --single-version-externally-managed --compile --install-headers /usr/local/include/python3.6m/blist
cwd: /tmp/pip-install-vw09qqdo/blist_5985a06eebc244dfbb6203841bf7f137/
Complete output (22 lines):
running install
/usr/local/lib/python3.6/site-packages/setuptools/command/install.py:37: SetuptoolsDeprecationWarning: setup.py install is deprecated. Use build and pip and other standards-based tools.
setuptools.SetuptoolsDeprecationWarning,
running build
running build_py
creating build
creating build/lib.linux-x86_64-3.6
creating build/lib.linux-x86_64-3.6/blist
copying blist/_sorteddict.py -> build/lib.linux-x86_64-3.6/blist
copying blist/_sortedlist.py -> build/lib.linux-x86_64-3.6/blist
copying blist/_btuple.py -> build/lib.linux-x86_64-3.6/blist
copying blist/__init__.py -> build/lib.linux-x86_64-3.6/blist
running build_ext
building 'blist._blist' extension
creating build/temp.linux-x86_64-3.6
creating build/temp.linux-x86_64-3.6/blist
gcc -pthread -Wno-unused-result -Wsign-compare -DDYNAMIC_ANNOTATIONS_ENABLED=1 -DNDEBUG -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -D_GNU_SOURCE -fPIC -fwrapv -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -D_GNU_SOURCE -fPIC -fwrapv -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -D_GNU_SOURCE -fPIC -fwrapv -fPIC -DBLIST_FLOAT_RADIX_SORT=1 -I/usr/include/python3.6m -c blist/_blist.c -o build/temp.linux-x86_64-3.6/blist/_blist.o
blist/_blist.c:38:10: fatal error: Python.h: 그런 파일이나 디렉터리가 없습니다
#include <Python.h>
^~~~~~~~~~
compilation terminated.
error: command 'gcc' failed with exit status 1
----------------------------------------
ERROR: Command errored out with exit status 1: /usr/bin/python3.6 -u -c 'import io, os, sys, setuptools, tokenize; sys.argv[0] = '"'"'/tmp/pip-install-vw09qqdo/blist_5985a06eebc244dfbb6203841bf7f137/setup.py'"'"'; __file__='"'"'/tmp/pip-install-vw09qqdo/blist_5985a06eebc244dfbb6203841bf7f137/setup.py'"'"';f = getattr(tokenize, '"'"'open'"'"', open)(__file__) if os.path.exists(__file__) else io.StringIO('"'"'from setuptools import setup; setup()'"'"');code = f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' install --record /tmp/pip-record-9ratp9fl/install-record.txt --single-version-externally-managed --compile --install-headers /usr/local/include/python3.6m/blist Check the logs for full command output.
[root@tmplogsvr opt]#
elastalert을 설치하기 위한 구성 툴을 추가 설치
[root@tmplogsvr opt]# yum install gcc libffi-devel python36-devel openssl-devel
마지막 메타자료 만료확인 1:24:43 이전인: 2023년 03월 16일 (목) 오전 09시 47분 28초.
꾸러미 gcc-8.5.0-18.el8.x86_64가 이미 설치되어 있습니다.
꾸러미 openssl-devel-1:1.1.1k-7.el8.x86_64가 이미 설치되어 있습니다.
종속성이 해결되었습니다.
======================================================================================================================================================================================================
꾸러미 구조 버전 레포지터리 크기
======================================================================================================================================================================================================
설치 중:
libffi-devel x86_64 3.1-24.el8 baseos 29 k
python36-devel x86_64 3.6.8-38.module_el8.5.0+895+a459eca8 appstream 16 k
향상 중:
openssl x86_64 1:1.1.1k-9.el8 baseos 737 k
openssl-devel x86_64 1:1.1.1k-9.el8 baseos 3.2 M
openssl-libs x86_64 1:1.1.1k-9.el8 baseos 1.5 M
종속 꾸러미 설치 중:
platform-python-devel x86_64 3.6.8-51.el8 appstream 240 k
python3-rpm-generators noarch 5-8.el8 appstream 25 k
연결 요약
======================================================================================================================================================================================================
설치 4 꾸러미
향상 3 꾸러미
총계 내려받기 크기: 5.7 M
진행 할 까요? [y/N]: y
꾸러미 내려받기 중:
(1/7): python3-rpm-generators-5-8.el8.noarch.rpm 533 kB/s | 25 kB 00:00
(2/7): python36-devel-3.6.8-38.module_el8.5.0+895+a459eca8.x86_64.rpm 189 kB/s | 16 kB 00:00
(3/7): platform-python-devel-3.6.8-51.el8.x86_64.rpm 2.6 MB/s | 240 kB 00:00
(4/7): openssl-1.1.1k-9.el8.x86_64.rpm 4.1 MB/s | 737 kB 00:00
(5/7): openssl-libs-1.1.1k-9.el8.x86_64.rpm 15 MB/s | 1.5 MB 00:00
(6/7): libffi-devel-3.1-24.el8.x86_64.rpm 59 kB/s | 29 kB 00:00
(7/7): openssl-devel-1.1.1k-9.el8.x86_64.rpm 5.3 MB/s | 3.2 MB 00:00
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
합계 2.8 MB/s | 5.7 MB 00:02
CentOS Stream 8 - AppStream 1.6 MB/s | 1.6 kB 00:00
GPG키 0x8483C65D 가져오는 중:
사용자 ID : "CentOS (CentOS Official Signing Key) <security@centos.org>"
지문: 99DB 70FA E1D7 CE22 7FB6 4882 05B5 55B3 8483 C65D
출처 : /etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial
진행 할 까요? [y/N]: y
키 가져오기에 성공했습니다
연결 확인 실행 중
연결 확인에 성공했습니다.
연결 시험 실행 중
연결 시험에 성공했습니다.
연결 실행 중
준비 중 : 1/1
향상 중 : openssl-libs-1:1.1.1k-9.el8.x86_64 1/10
스크립트릿 실행 중: openssl-libs-1:1.1.1k-9.el8.x86_64 1/10
설치 중 : python3-rpm-generators-5-8.el8.noarch 2/10
설치 중 : platform-python-devel-3.6.8-51.el8.x86_64 3/10
설치 중 : python36-devel-3.6.8-38.module_el8.5.0+895+a459eca8.x86_64 4/10
스크립트릿 실행 중: python36-devel-3.6.8-38.module_el8.5.0+895+a459eca8.x86_64 4/10
향상 중 : openssl-1:1.1.1k-9.el8.x86_64 5/10
향상 중 : openssl-devel-1:1.1.1k-9.el8.x86_64 6/10
설치 중 : libffi-devel-3.1-24.el8.x86_64 7/10
스크립트릿 실행 중: libffi-devel-3.1-24.el8.x86_64 7/10
정리 : openssl-1:1.1.1k-7.el8.x86_64 8/10
정리 : openssl-devel-1:1.1.1k-7.el8.x86_64 9/10
정리 : openssl-libs-1:1.1.1k-7.el8.x86_64 10/10
스크립트릿 실행 중: openssl-libs-1:1.1.1k-7.el8.x86_64 10/10
확인 중 : platform-python-devel-3.6.8-51.el8.x86_64 1/10
확인 중 : python3-rpm-generators-5-8.el8.noarch 2/10
확인 중 : python36-devel-3.6.8-38.module_el8.5.0+895+a459eca8.x86_64 3/10
확인 중 : libffi-devel-3.1-24.el8.x86_64 4/10
확인 중 : openssl-1:1.1.1k-9.el8.x86_64 5/10
확인 중 : openssl-1:1.1.1k-7.el8.x86_64 6/10
확인 중 : openssl-devel-1:1.1.1k-9.el8.x86_64 7/10
확인 중 : openssl-devel-1:1.1.1k-7.el8.x86_64 8/10
확인 중 : openssl-libs-1:1.1.1k-9.el8.x86_64 9/10
확인 중 : openssl-libs-1:1.1.1k-7.el8.x86_64 10/10
향상되었습니다:
openssl-1:1.1.1k-9.el8.x86_64 openssl-devel-1:1.1.1k-9.el8.x86_64 openssl-libs-1:1.1.1k-9.el8.x86_64
설치되었습니다:
libffi-devel-3.1-24.el8.x86_64 platform-python-devel-3.6.8-51.el8.x86_64 python3-rpm-generators-5-8.el8.noarch python36-devel-3.6.8-38.module_el8.5.0+895+a459eca8.x86_64
완료되었습니다!
[root@tmplogsvr opt]#
elastalert 재설치 시도 및 완료
[root@tmplogsvr opt]# pip install elastalert
Collecting elastalert
Using cached elastalert-0.2.4.tar.gz (128 kB)
Preparing metadata (setup.py) ... done
Collecting apscheduler>=3.3.0
Using cached APScheduler-3.10.1-py3-none-any.whl (59 kB)
Collecting aws-requests-auth>=0.3.0
Using cached aws_requests_auth-0.4.3-py2.py3-none-any.whl (6.8 kB)
Collecting blist>=1.3.6
Using cached blist-1.3.6.tar.gz (122 kB)
Preparing metadata (setup.py) ... done
Requirement already satisfied: boto3>=1.4.4 in /usr/local/lib/python3.6/site-packages (from elastalert) (1.23.10)
Requirement already satisfied: configparser>=3.5.0 in /usr/local/lib/python3.6/site-packages (from elastalert) (5.2.0)
Requirement already satisfied: croniter>=0.3.16 in /usr/local/lib/python3.6/site-packages (from elastalert) (1.3.8)
Requirement already satisfied: elasticsearch==7.0.0 in /usr/local/lib/python3.6/site-packages (from elastalert) (7.0.0)
Requirement already satisfied: envparse>=0.2.0 in /usr/local/lib/python3.6/site-packages (from elastalert) (0.2.0)
Requirement already satisfied: exotel>=0.1.3 in /usr/local/lib/python3.6/site-packages (from elastalert) (0.1.5)
Requirement already satisfied: jira>=2.0.0 in /usr/local/lib/python3.6/site-packages (from elastalert) (3.2.0)
Requirement already satisfied: jsonschema>=3.0.2 in /usr/local/lib/python3.6/site-packages (from elastalert) (3.2.0)
Requirement already satisfied: mock>=2.0.0 in /usr/local/lib/python3.6/site-packages (from elastalert) (5.0.1)
Requirement already satisfied: prison>=0.1.2 in /usr/local/lib/python3.6/site-packages (from elastalert) (0.2.1)
Requirement already satisfied: PyStaticConfiguration>=0.10.3 in /usr/local/lib/python3.6/site-packages (from elastalert) (0.11.1)
Requirement already satisfied: python-dateutil<2.7.0,>=2.6.0 in /usr/lib/python3.6/site-packages (from elastalert) (2.6.1)
Requirement already satisfied: PyYAML>=3.12 in /usr/lib64/python3.6/site-packages (from elastalert) (3.12)
Requirement already satisfied: requests>=2.10.0 in /usr/local/lib/python3.6/site-packages (from elastalert) (2.27.1)
Requirement already satisfied: stomp.py>=4.1.17 in /usr/local/lib/python3.6/site-packages (from elastalert) (8.1.0)
Requirement already satisfied: texttable>=0.8.8 in /usr/local/lib/python3.6/site-packages (from elastalert) (1.6.7)
Requirement already satisfied: twilio<6.1,>=6.0.0 in /usr/local/lib/python3.6/site-packages (from elastalert) (6.0.0)
Requirement already satisfied: python-magic>=0.4.15 in /usr/local/lib/python3.6/site-packages (from elastalert) (0.4.27)
Requirement already satisfied: cffi>=1.11.5 in /usr/local/lib64/python3.6/site-packages (from elastalert) (1.15.1)
Requirement already satisfied: urllib3>=1.21.1 in /usr/local/lib/python3.6/site-packages (from elasticsearch==7.0.0->elastalert) (1.26.15)
Requirement already satisfied: setuptools>=0.7 in /usr/local/lib/python3.6/site-packages (from apscheduler>=3.3.0->elastalert) (59.6.0)
Requirement already satisfied: pytz in /usr/lib/python3.6/site-packages (from apscheduler>=3.3.0->elastalert) (2017.2)
Requirement already satisfied: tzlocal!=3.*,>=2.0 in /usr/local/lib/python3.6/site-packages (from apscheduler>=3.3.0->elastalert) (4.2)
Requirement already satisfied: six>=1.4.0 in /usr/lib/python3.6/site-packages (from apscheduler>=3.3.0->elastalert) (1.11.0)
Requirement already satisfied: botocore<1.27.0,>=1.26.10 in /usr/local/lib/python3.6/site-packages (from boto3>=1.4.4->elastalert) (1.26.10)
Requirement already satisfied: s3transfer<0.6.0,>=0.5.0 in /usr/local/lib/python3.6/site-packages (from boto3>=1.4.4->elastalert) (0.5.2)
Requirement already satisfied: jmespath<2.0.0,>=0.7.1 in /usr/local/lib/python3.6/site-packages (from boto3>=1.4.4->elastalert) (0.10.0)
Requirement already satisfied: pycparser in /usr/local/lib/python3.6/site-packages (from cffi>=1.11.5->elastalert) (2.21)
Requirement already satisfied: requests-oauthlib>=1.1.0 in /usr/local/lib/python3.6/site-packages (from jira>=2.0.0->elastalert) (1.3.1)
Requirement already satisfied: keyring in /usr/local/lib/python3.6/site-packages (from jira>=2.0.0->elastalert) (23.4.1)
Requirement already satisfied: requests-toolbelt in /usr/local/lib/python3.6/site-packages (from jira>=2.0.0->elastalert) (0.10.1)
Requirement already satisfied: typing-extensions>=3.7.4.2 in /usr/local/lib/python3.6/site-packages (from jira>=2.0.0->elastalert) (4.1.1)
Requirement already satisfied: defusedxml in /usr/local/lib/python3.6/site-packages (from jira>=2.0.0->elastalert) (0.7.1)
Requirement already satisfied: pyrsistent>=0.14.0 in /usr/local/lib64/python3.6/site-packages (from jsonschema>=3.0.2->elastalert) (0.18.0)
Requirement already satisfied: importlib-metadata in /usr/local/lib/python3.6/site-packages (from jsonschema>=3.0.2->elastalert) (4.8.3)
Requirement already satisfied: attrs>=17.4.0 in /usr/local/lib/python3.6/site-packages (from jsonschema>=3.0.2->elastalert) (22.2.0)
Requirement already satisfied: charset-normalizer~=2.0.0 in /usr/local/lib/python3.6/site-packages (from requests>=2.10.0->elastalert) (2.0.12)
Requirement already satisfied: certifi>=2017.4.17 in /usr/local/lib/python3.6/site-packages (from requests>=2.10.0->elastalert) (2022.12.7)
Requirement already satisfied: idna<4,>=2.5 in /usr/lib/python3.6/site-packages (from requests>=2.10.0->elastalert) (2.5)
Requirement already satisfied: websocket-client<2.0.0,>=1.2.3 in /usr/local/lib/python3.6/site-packages (from stomp.py>=4.1.17->elastalert) (1.3.1)
Requirement already satisfied: docopt<0.7.0,>=0.6.2 in /usr/local/lib/python3.6/site-packages (from stomp.py>=4.1.17->elastalert) (0.6.2)
Requirement already satisfied: PyJWT>=1.4.2 in /usr/local/lib/python3.6/site-packages (from twilio<6.1,>=6.0.0->elastalert) (2.4.0)
Requirement already satisfied: pysocks in /usr/lib/python3.6/site-packages (from twilio<6.1,>=6.0.0->elastalert) (1.6.8)
Requirement already satisfied: oauthlib>=3.0.0 in /usr/local/lib/python3.6/site-packages (from requests-oauthlib>=1.1.0->jira>=2.0.0->elastalert) (3.2.2)
Requirement already satisfied: pytz-deprecation-shim in /usr/local/lib/python3.6/site-packages (from tzlocal!=3.*,>=2.0->apscheduler>=3.3.0->elastalert) (0.1.0.post0)
Requirement already satisfied: backports.zoneinfo in /usr/local/lib64/python3.6/site-packages (from tzlocal!=3.*,>=2.0->apscheduler>=3.3.0->elastalert) (0.2.1)
Requirement already satisfied: zipp>=0.5 in /usr/local/lib/python3.6/site-packages (from importlib-metadata->jsonschema>=3.0.2->elastalert) (3.6.0)
Requirement already satisfied: SecretStorage>=3.2 in /usr/local/lib/python3.6/site-packages (from keyring->jira>=2.0.0->elastalert) (3.3.3)
Requirement already satisfied: jeepney>=0.4.2 in /usr/local/lib/python3.6/site-packages (from keyring->jira>=2.0.0->elastalert) (0.7.1)
Requirement already satisfied: cryptography>=2.0 in /usr/local/lib64/python3.6/site-packages (from SecretStorage>=3.2->keyring->jira>=2.0.0->elastalert) (39.0.2)
Requirement already satisfied: importlib-resources in /usr/local/lib/python3.6/site-packages (from backports.zoneinfo->tzlocal!=3.*,>=2.0->apscheduler>=3.3.0->elastalert) (5.4.0)
Requirement already satisfied: tzdata in /usr/local/lib/python3.6/site-packages (from pytz-deprecation-shim->tzlocal!=3.*,>=2.0->apscheduler>=3.3.0->elastalert) (2022.7)
Using legacy 'setup.py install' for elastalert, since package 'wheel' is not installed.
Using legacy 'setup.py install' for blist, since package 'wheel' is not installed.
Installing collected packages: blist, aws-requests-auth, apscheduler, elastalert
Running setup.py install for blist ... done
Running setup.py install for elastalert ... done
Successfully installed apscheduler-3.10.1 aws-requests-auth-0.4.3 blist-1.3.6 elastalert-0.2.4
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv
[root@tmplogsvr opt]#
elastalert 구성요소 설치하기 폴더 삭제하기
[root@tmplogsvr ~]# cd /opt
[root@tmplogsvr opt]# git clone https://github.com/Yelp/elastalert.git
'elastalert'에 복제합니다...
remote: Enumerating objects: 11518, done.
remote: Total 11518 (delta 0), reused 0 (delta 0), pack-reused 11518
오브젝트를 받는 중: 100% (11518/11518), 3.61 MiB | 31.89 MiB/s, 완료.
델타를 알아내는 중: 100% (7978/7978), 완료.
[root@tmplogsvr opt]# ls -al
합계 12
drwxr-xr-x. 3 root root 4096 3월 16 11:37 .
dr-xr-xr-x. 18 root root 4096 3월 15 14:16 ..
drwxr-xr-x. 7 root root 4096 3월 16 11:37 elastalert
[root@tmplogsvr opt]# cd elastalert/
[root@tmplogsvr elastalert]# ls -al
합계 132
drwxr-xr-x. 7 root root 4096 3월 16 11:37 .
drwxr-xr-x. 3 root root 4096 3월 16 11:37 ..
-rw-r--r--. 1 root root 216 3월 16 11:37 .editorconfig
drwxr-xr-x. 8 root root 4096 3월 16 11:37 .git
-rw-r--r--. 1 root root 160 3월 16 11:37 .gitignore
-rw-r--r--. 1 root root 718 3월 16 11:37 .pre-commit-config.yaml
-rw-r--r--. 1 root root 574 3월 16 11:37 .secrets.baseline
-rw-r--r--. 1 root root 1262 3월 16 11:37 .travis.yml
-rw-r--r--. 1 root root 244 3월 16 11:37 Dockerfile-test
-rw-r--r--. 1 root root 11359 3월 16 11:37 LICENSE
-rw-r--r--. 1 root root 528 3월 16 11:37 Makefile
-rw-r--r--. 1 root root 16197 3월 16 11:37 README.md
-rw-r--r--. 1 root root 11649 3월 16 11:37 changelog.md
-rw-r--r--. 1 root root 3321 3월 16 11:37 config.yaml.example
-rw-r--r--. 1 root root 261 3월 16 11:37 docker-compose.yml
drwxr-xr-x. 3 root root 4096 3월 16 11:37 docs
drwxr-xr-x. 3 root root 4096 3월 16 11:37 elastalert
drwxr-xr-x. 2 root root 4096 3월 16 11:37 example_rules
-rw-r--r--. 1 root root 74 3월 16 11:37 pytest.ini
-rw-r--r--. 1 root root 114 3월 16 11:37 requirements-dev.txt
-rw-r--r--. 1 root root 389 3월 16 11:37 requirements.txt
-rw-r--r--. 1 root root 100 3월 16 11:37 setup.cfg
-rw-r--r--. 1 root root 1659 3월 16 11:37 setup.py
-rw-r--r--. 1 root root 780 3월 16 11:37 supervisord.conf.example
drwxr-xr-x. 2 root root 4096 3월 16 11:37 tests
-rw-r--r--. 1 root root 609 3월 16 11:37 tox.ini
[root@tmplogsvr elastalert]# pip install -r ./requirements.txt
Requirement already satisfied: apscheduler>=3.3.0 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 1)) (3.10.1)
Requirement already satisfied: aws-requests-auth>=0.3.0 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 2)) (0.4.3)
Requirement already satisfied: blist>=1.3.6 in /usr/local/lib64/python3.6/site-packages (from -r ./requirements.txt (line 3)) (1.3.6)
Requirement already satisfied: boto3>=1.4.4 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 4)) (1.23.10)
Requirement already satisfied: cffi>=1.11.5 in /usr/local/lib64/python3.6/site-packages (from -r ./requirements.txt (line 5)) (1.15.1)
Requirement already satisfied: configparser>=3.5.0 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 6)) (5.2.0)
Requirement already satisfied: croniter>=0.3.16 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 7)) (1.3.8)
Requirement already satisfied: elasticsearch>=7.0.0 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 8)) (7.0.0)
Requirement already satisfied: envparse>=0.2.0 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 9)) (0.2.0)
Requirement already satisfied: exotel>=0.1.3 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 10)) (0.1.5)
Collecting jira<1.0.15,>=1.0.10
Downloading jira-1.0.14-py2.py3-none-any.whl (95 kB)
|████████████████████████████████| 95 kB 9.4 MB/s
Requirement already satisfied: jsonschema>=3.0.2 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 12)) (3.2.0)
Requirement already satisfied: mock>=2.0.0 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 13)) (5.0.1)
Requirement already satisfied: prison>=0.1.2 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 14)) (0.2.1)
Collecting py-zabbix==1.1.3
Downloading py_zabbix-1.1.3-py2.py3-none-any.whl (12 kB)
Requirement already satisfied: PyStaticConfiguration>=0.10.3 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 16)) (0.11.1)
Requirement already satisfied: python-dateutil<2.7.0,>=2.6.0 in /usr/lib/python3.6/site-packages (from -r ./requirements.txt (line 17)) (2.6.1)
Collecting PyYAML>=5.1
Using cached PyYAML-6.0-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl (603 kB)
Requirement already satisfied: requests>=2.0.0 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 19)) (2.27.1)
Requirement already satisfied: stomp.py>=4.1.17 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 20)) (8.1.0)
Requirement already satisfied: texttable>=0.8.8 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 21)) (1.6.7)
Requirement already satisfied: twilio==6.0.0 in /usr/local/lib/python3.6/site-packages (from -r ./requirements.txt (line 22)) (6.0.0)
Requirement already satisfied: six in /usr/lib/python3.6/site-packages (from twilio==6.0.0->-r ./requirements.txt (line 22)) (1.11.0)
Requirement already satisfied: pytz in /usr/lib/python3.6/site-packages (from twilio==6.0.0->-r ./requirements.txt (line 22)) (2017.2)
Requirement already satisfied: PyJWT>=1.4.2 in /usr/local/lib/python3.6/site-packages (from twilio==6.0.0->-r ./requirements.txt (line 22)) (2.4.0)
Requirement already satisfied: pysocks in /usr/lib/python3.6/site-packages (from twilio==6.0.0->-r ./requirements.txt (line 22)) (1.6.8)
Requirement already satisfied: tzlocal!=3.*,>=2.0 in /usr/local/lib/python3.6/site-packages (from apscheduler>=3.3.0->-r ./requirements.txt (line 1)) (4.2)
Requirement already satisfied: setuptools>=0.7 in /usr/local/lib/python3.6/site-packages (from apscheduler>=3.3.0->-r ./requirements.txt (line 1)) (59.6.0)
Requirement already satisfied: s3transfer<0.6.0,>=0.5.0 in /usr/local/lib/python3.6/site-packages (from boto3>=1.4.4->-r ./requirements.txt (line 4)) (0.5.2)
Requirement already satisfied: botocore<1.27.0,>=1.26.10 in /usr/local/lib/python3.6/site-packages (from boto3>=1.4.4->-r ./requirements.txt (line 4)) (1.26.10)
Requirement already satisfied: jmespath<2.0.0,>=0.7.1 in /usr/local/lib/python3.6/site-packages (from boto3>=1.4.4->-r ./requirements.txt (line 4)) (0.10.0)
Requirement already satisfied: pycparser in /usr/local/lib/python3.6/site-packages (from cffi>=1.11.5->-r ./requirements.txt (line 5)) (2.21)
Requirement already satisfied: urllib3>=1.21.1 in /usr/local/lib/python3.6/site-packages (from elasticsearch>=7.0.0->-r ./requirements.txt (line 8)) (1.26.15)
Requirement already satisfied: defusedxml in /usr/local/lib/python3.6/site-packages (from jira<1.0.15,>=1.0.10->-r ./requirements.txt (line 11)) (0.7.1)
Requirement already satisfied: requests-oauthlib>=0.6.1 in /usr/local/lib/python3.6/site-packages (from jira<1.0.15,>=1.0.10->-r ./requirements.txt (line 11)) (1.3.1)
Collecting pbr>=3.0.0
Downloading pbr-5.11.1-py2.py3-none-any.whl (112 kB)
|████████████████████████████████| 112 kB 80.8 MB/s
Requirement already satisfied: requests-toolbelt in /usr/local/lib/python3.6/site-packages (from jira<1.0.15,>=1.0.10->-r ./requirements.txt (line 11)) (0.10.1)
Requirement already satisfied: attrs>=17.4.0 in /usr/local/lib/python3.6/site-packages (from jsonschema>=3.0.2->-r ./requirements.txt (line 12)) (22.2.0)
Requirement already satisfied: pyrsistent>=0.14.0 in /usr/local/lib64/python3.6/site-packages (from jsonschema>=3.0.2->-r ./requirements.txt (line 12)) (0.18.0)
Requirement already satisfied: importlib-metadata in /usr/local/lib/python3.6/site-packages (from jsonschema>=3.0.2->-r ./requirements.txt (line 12)) (4.8.3)
Requirement already satisfied: typing-extensions in /usr/local/lib/python3.6/site-packages (from PyStaticConfiguration>=0.10.3->-r ./requirements.txt (line 16)) (4.1.1)
Requirement already satisfied: certifi>=2017.4.17 in /usr/local/lib/python3.6/site-packages (from requests>=2.0.0->-r ./requirements.txt (line 19)) (2022.12.7)
Requirement already satisfied: charset-normalizer~=2.0.0 in /usr/local/lib/python3.6/site-packages (from requests>=2.0.0->-r ./requirements.txt (line 19)) (2.0.12)
Requirement already satisfied: idna<4,>=2.5 in /usr/lib/python3.6/site-packages (from requests>=2.0.0->-r ./requirements.txt (line 19)) (2.5)
Requirement already satisfied: websocket-client<2.0.0,>=1.2.3 in /usr/local/lib/python3.6/site-packages (from stomp.py>=4.1.17->-r ./requirements.txt (line 20)) (1.3.1)
Requirement already satisfied: docopt<0.7.0,>=0.6.2 in /usr/local/lib/python3.6/site-packages (from stomp.py>=4.1.17->-r ./requirements.txt (line 20)) (0.6.2)
Requirement already satisfied: oauthlib>=3.0.0 in /usr/local/lib/python3.6/site-packages (from requests-oauthlib>=0.6.1->jira<1.0.15,>=1.0.10->-r ./requirements.txt (line 11)) (3.2.2)
Requirement already satisfied: backports.zoneinfo in /usr/local/lib64/python3.6/site-packages (from tzlocal!=3.*,>=2.0->apscheduler>=3.3.0->-r ./requirements.txt (line 1)) (0.2.1)
Requirement already satisfied: pytz-deprecation-shim in /usr/local/lib/python3.6/site-packages (from tzlocal!=3.*,>=2.0->apscheduler>=3.3.0->-r ./requirements.txt (line 1)) (0.1.0.post0)
Requirement already satisfied: zipp>=0.5 in /usr/local/lib/python3.6/site-packages (from importlib-metadata->jsonschema>=3.0.2->-r ./requirements.txt (line 12)) (3.6.0)
Requirement already satisfied: importlib-resources in /usr/local/lib/python3.6/site-packages (from backports.zoneinfo->tzlocal!=3.*,>=2.0->apscheduler>=3.3.0->-r ./requirements.txt (line 1)) (5.4.0)
Requirement already satisfied: tzdata in /usr/local/lib/python3.6/site-packages (from pytz-deprecation-shim->tzlocal!=3.*,>=2.0->apscheduler>=3.3.0->-r ./requirements.txt (line 1)) (2022.7)
Installing collected packages: pbr, PyYAML, py-zabbix, jira
Attempting uninstall: PyYAML
Found existing installation: PyYAML 3.12
ERROR: Cannot uninstall 'PyYAML'. It is a distutils installed project and thus we cannot accurately determine which files belong to it which would lead to only a partial uninstall.
[root@tmplogsvr elastalert]# pip install --ignore-installed PyYAML -r requirements.txt
Collecting PyYAML
Using cached PyYAML-6.0-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_12_x86_64.manylinux2010_x86_64.whl (603 kB)
Collecting apscheduler>=3.3.0
Using cached APScheduler-3.10.1-py3-none-any.whl (59 kB)
Collecting aws-requests-auth>=0.3.0
Using cached aws_requests_auth-0.4.3-py2.py3-none-any.whl (6.8 kB)
Collecting blist>=1.3.6
Using cached blist-1.3.6.tar.gz (122 kB)
Preparing metadata (setup.py) ... done
Collecting boto3>=1.4.4
Using cached boto3-1.23.10-py3-none-any.whl (132 kB)
Collecting cffi>=1.11.5
Using cached cffi-1.15.1-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl (402 kB)
Collecting configparser>=3.5.0
Using cached configparser-5.2.0-py3-none-any.whl (19 kB)
Collecting croniter>=0.3.16
Using cached croniter-1.3.8-py2.py3-none-any.whl (18 kB)
Collecting elasticsearch>=7.0.0
Downloading elasticsearch-8.6.2-py3-none-any.whl (385 kB)
|████████████████████████████████| 385 kB 19.2 MB/s
Collecting envparse>=0.2.0
Using cached envparse-0.2.0.tar.gz (7.6 kB)
Preparing metadata (setup.py) ... done
Collecting exotel>=0.1.3
Using cached exotel-0.1.5.tar.gz (2.2 kB)
Preparing metadata (setup.py) ... done
Collecting jira<1.0.15,>=1.0.10
Using cached jira-1.0.14-py2.py3-none-any.whl (95 kB)
Collecting jsonschema>=3.0.2
Using cached jsonschema-3.2.0-py2.py3-none-any.whl (56 kB)
Collecting mock>=2.0.0
Using cached mock-5.0.1-py3-none-any.whl (30 kB)
Collecting prison>=0.1.2
Using cached prison-0.2.1-py2.py3-none-any.whl (5.8 kB)
Collecting py-zabbix==1.1.3
Using cached py_zabbix-1.1.3-py2.py3-none-any.whl (12 kB)
Collecting PyStaticConfiguration>=0.10.3
Using cached PyStaticConfiguration-0.11.1-py3-none-any.whl (27 kB)
Collecting python-dateutil<2.7.0,>=2.6.0
Downloading python_dateutil-2.6.1-py2.py3-none-any.whl (194 kB)
|████████████████████████████████| 194 kB 60.7 MB/s
Collecting requests>=2.0.0
Using cached requests-2.27.1-py2.py3-none-any.whl (63 kB)
Collecting stomp.py>=4.1.17
Using cached stomp.py-8.1.0-py3-none-any.whl (42 kB)
Collecting texttable>=0.8.8
Using cached texttable-1.6.7-py2.py3-none-any.whl (10 kB)
Collecting twilio==6.0.0
Using cached twilio-6.0.0.tar.gz (304 kB)
Preparing metadata (setup.py) ... done
Collecting six
Downloading six-1.16.0-py2.py3-none-any.whl (11 kB)
Collecting pytz
Downloading pytz-2022.7.1-py2.py3-none-any.whl (499 kB)
|████████████████████████████████| 499 kB 68.4 MB/s
Collecting PyJWT>=1.4.2
Using cached PyJWT-2.4.0-py3-none-any.whl (18 kB)
Collecting pysocks
Downloading PySocks-1.7.1-py3-none-any.whl (16 kB)
Collecting tzlocal!=3.*,>=2.0
Using cached tzlocal-4.2-py3-none-any.whl (19 kB)
Collecting setuptools>=0.7
Using cached setuptools-59.6.0-py3-none-any.whl (952 kB)
Collecting s3transfer<0.6.0,>=0.5.0
Using cached s3transfer-0.5.2-py3-none-any.whl (79 kB)
Collecting jmespath<2.0.0,>=0.7.1
Using cached jmespath-0.10.0-py2.py3-none-any.whl (24 kB)
Collecting botocore<1.27.0,>=1.26.10
Using cached botocore-1.26.10-py3-none-any.whl (8.8 MB)
Collecting pycparser
Using cached pycparser-2.21-py2.py3-none-any.whl (118 kB)
Collecting elastic-transport<9,>=8
Downloading elastic_transport-8.4.0-py3-none-any.whl (59 kB)
|████████████████████████████████| 59 kB 20.2 MB/s
Collecting pbr>=3.0.0
Using cached pbr-5.11.1-py2.py3-none-any.whl (112 kB)
Collecting defusedxml
Using cached defusedxml-0.7.1-py2.py3-none-any.whl (25 kB)
Collecting requests-toolbelt
Using cached requests_toolbelt-0.10.1-py2.py3-none-any.whl (54 kB)
Collecting requests-oauthlib>=0.6.1
Using cached requests_oauthlib-1.3.1-py2.py3-none-any.whl (23 kB)
Collecting importlib-metadata
Using cached importlib_metadata-4.8.3-py3-none-any.whl (17 kB)
Collecting pyrsistent>=0.14.0
Using cached pyrsistent-0.18.0-cp36-cp36m-manylinux1_x86_64.whl (117 kB)
Collecting attrs>=17.4.0
Using cached attrs-22.2.0-py3-none-any.whl (60 kB)
Collecting typing-extensions
Using cached typing_extensions-4.1.1-py3-none-any.whl (26 kB)
Collecting urllib3<1.27,>=1.21.1
Using cached urllib3-1.26.15-py2.py3-none-any.whl (140 kB)
Collecting idna<4,>=2.5
Downloading idna-3.4-py3-none-any.whl (61 kB)
|████████████████████████████████| 61 kB 338 kB/s
Collecting certifi>=2017.4.17
Using cached certifi-2022.12.7-py3-none-any.whl (155 kB)
Collecting charset-normalizer~=2.0.0
Using cached charset_normalizer-2.0.12-py3-none-any.whl (39 kB)
Collecting docopt<0.7.0,>=0.6.2
Using cached docopt-0.6.2.tar.gz (25 kB)
Preparing metadata (setup.py) ... done
Collecting websocket-client<2.0.0,>=1.2.3
Using cached websocket_client-1.3.1-py3-none-any.whl (54 kB)
Collecting dataclasses
Downloading dataclasses-0.8-py3-none-any.whl (19 kB)
Collecting oauthlib>=3.0.0
Using cached oauthlib-3.2.2-py3-none-any.whl (151 kB)
Collecting pytz-deprecation-shim
Using cached pytz_deprecation_shim-0.1.0.post0-py2.py3-none-any.whl (15 kB)
Collecting backports.zoneinfo
Using cached backports.zoneinfo-0.2.1-cp36-cp36m-manylinux1_x86_64.whl (70 kB)
Collecting zipp>=0.5
Using cached zipp-3.6.0-py3-none-any.whl (5.3 kB)
Collecting importlib-resources
Using cached importlib_resources-5.4.0-py3-none-any.whl (28 kB)
Collecting tzdata
Using cached tzdata-2022.7-py2.py3-none-any.whl (340 kB)
Using legacy 'setup.py install' for twilio, since package 'wheel' is not installed.
Using legacy 'setup.py install' for blist, since package 'wheel' is not installed.
Using legacy 'setup.py install' for envparse, since package 'wheel' is not installed.
Using legacy 'setup.py install' for exotel, since package 'wheel' is not installed.
Using legacy 'setup.py install' for docopt, since package 'wheel' is not installed.
Installing collected packages: zipp, six, importlib-resources, urllib3, tzdata, python-dateutil, jmespath, idna, charset-normalizer, certifi, backports.zoneinfo, typing-extensions, requests, pytz-deprecation-shim, oauthlib, dataclasses, botocore, websocket-client, tzlocal, setuptools, s3transfer, requests-toolbelt, requests-oauthlib, pytz, pysocks, pyrsistent, PyJWT, pycparser, pbr, importlib-metadata, elastic-transport, docopt, defusedxml, attrs, twilio, texttable, stomp.py, PyYAML, PyStaticConfiguration, py-zabbix, prison, mock, jsonschema, jira, exotel, envparse, elasticsearch, croniter, configparser, cffi, boto3, blist, aws-requests-auth, apscheduler
Running setup.py install for docopt ... done
Running setup.py install for twilio ... done
Running setup.py install for exotel ... done
Running setup.py install for envparse ... done
Running setup.py install for blist ... done
ERROR: pips dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.
elastalert 0.2.4 requires elasticsearch==7.0.0, but you have elasticsearch 8.6.2 which is incompatible.
elastalert 0.2.4 requires jira>=2.0.0, but you have jira 1.0.14 which is incompatible.
Successfully installed PyJWT-2.4.0 PyStaticConfiguration-0.11.1 PyYAML-6.0 apscheduler-3.10.1 attrs-22.2.0 aws-requests-auth-0.4.3 backports.zoneinfo-0.2.1 blist-1.3.6 boto3-1.23.10 botocore-1.26.10 certifi-2022.12.7 cffi-1.15.1 charset-normalizer-2.0.12 configparser-5.2.0 croniter-1.3.8 dataclasses-0.8 defusedxml-0.7.1 docopt-0.6.2 elastic-transport-8.4.0 elasticsearch-8.6.2 envparse-0.2.0 exotel-0.1.5 idna-3.4 importlib-metadata-4.8.3 importlib-resources-5.4.0 jira-3.2.0 jmespath-0.10.0 jsonschema-3.2.0 mock-5.0.1 oauthlib-3.2.2 pbr-5.11.1 prison-0.2.1 py-zabbix-1.1.3 pycparser-2.21 pyrsistent-0.18.0 pysocks-1.7.1 python-dateutil-2.6.1 pytz-2022.7.1 pytz-deprecation-shim-0.1.0.post0 requests-2.27.1 requests-oauthlib-1.3.1 requests-toolbelt-0.10.1 s3transfer-0.5.2 setuptools-59.6.0 six-1.16.0 stomp.py-8.1.0 texttable-1.6.7 twilio-6.0.0 typing-extensions-4.1.1 tzdata-2022.7 tzlocal-4.2 urllib3-1.26.15 websocket-client-1.3.1 zipp-3.6.0
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv
[root@tmplogsvr elastalert]#
[root@tmplogsvr elastalert]# cd ..
[root@tmplogsvr opt]# rm -rf ./elastalert/
[root@tmplogsvr elastalert]# yum install npm
마지막 메타자료 만료확인 1:39:50 이전인: 2023년 03월 16일 (목) 오전 09시 47분 28초.
종속성이 해결되었습니다.
======================================================================================================================================================================================================
꾸러미 구조 버전 레포지터리 크기
======================================================================================================================================================================================================
설치 중:
npm x86_64 1:6.14.10-1.10.23.1.1.module_el8.4.0+645+9ce14ba2 appstream 3.7 M
종속 꾸러미 설치 중:
nodejs x86_64 1:10.23.1-1.module_el8.4.0+645+9ce14ba2 appstream 8.9 M
취약한 종속 꾸러미 설치 중:
nodejs-full-i18n x86_64 1:10.23.1-1.module_el8.4.0+645+9ce14ba2 appstream 7.3 M
모듈 스트림 활성화:
nodejs 10
연결 요약
======================================================================================================================================================================================================
설치 3 꾸러미
총계 내려받기 크기: 20 M
설치된 크기 : 71 M
진행 할 까요? [y/N]: y
꾸러미 내려받기 중:
(1/3): npm-6.14.10-1.10.23.1.1.module_el8.4.0+645+9ce14ba2.x86_64.rpm 7.4 MB/s | 3.7 MB 00:00
(2/3): nodejs-full-i18n-10.23.1-1.module_el8.4.0+645+9ce14ba2.x86_64.rpm 6.3 MB/s | 7.3 MB 00:01
(3/3): nodejs-10.23.1-1.module_el8.4.0+645+9ce14ba2.x86_64.rpm 7.4 MB/s | 8.9 MB 00:01
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
합계 10 MB/s | 20 MB 00:01
연결 확인 실행 중
연결 확인에 성공했습니다.
연결 시험 실행 중
연결 시험에 성공했습니다.
연결 실행 중
스크립트릿 실행 중: npm-1:6.14.10-1.10.23.1.1.module_el8.4.0+645+9ce14ba2.x86_64 1/1
준비 중 : 1/1
설치 중 : nodejs-full-i18n-1:10.23.1-1.module_el8.4.0+645+9ce14ba2.x86_64 1/3
설치 중 : npm-1:6.14.10-1.10.23.1.1.module_el8.4.0+645+9ce14ba2.x86_64 2/3
설치 중 : nodejs-1:10.23.1-1.module_el8.4.0+645+9ce14ba2.x86_64 3/3
스크립트릿 실행 중: nodejs-1:10.23.1-1.module_el8.4.0+645+9ce14ba2.x86_64 3/3
확인 중 : nodejs-1:10.23.1-1.module_el8.4.0+645+9ce14ba2.x86_64 1/3
확인 중 : nodejs-full-i18n-1:10.23.1-1.module_el8.4.0+645+9ce14ba2.x86_64 2/3
확인 중 : npm-1:6.14.10-1.10.23.1.1.module_el8.4.0+645+9ce14ba2.x86_64 3/3
설치되었습니다:
nodejs-1:10.23.1-1.module_el8.4.0+645+9ce14ba2.x86_64 nodejs-full-i18n-1:10.23.1-1.module_el8.4.0+645+9ce14ba2.x86_64 npm-1:6.14.10-1.10.23.1.1.module_el8.4.0+645+9ce14ba2.x86_64
완료되었습니다!
[root@tmplogsvr elastalert]#
npm 실행 오류 1 및 해결
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
./scripts/start.sh: line 3: ./node_modules/.bin/bunyan: 그런 파일이나 디렉터리가 없습니다
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'babel-register'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/opt/elastalert/index.js:1:1)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:789:10)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
at Function.Module._load (internal/modules/cjs/loader.js:585:3)
npm ERR! code ELIFECYCLE
npm ERR! syscall spawn
npm ERR! file sh
npm ERR! errno ENOENT
npm ERR! @bitsensor/elastalert@3.0.0-beta.0 start: `sh ./scripts/start.sh`
npm ERR! spawn ENOENT
npm ERR!
npm ERR! Failed at the @bitsensor/elastalert@3.0.0-beta.0 start script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.
npm WARN Local package.json exists, but node_modules missing, did you mean to install?
npm ERR! A complete log of this run can be found in:
npm ERR! /root/.npm/_logs/2023-03-16T02_32_07_479Z-debug.log
[root@tmplogsvr elastalert]#
[root@tmplogsvr elastalert]# npm install bunyan
> dtrace-provider@0.8.8 install /opt/elastalert/node_modules/dtrace-provider
> node-gyp rebuild || node suppress-error.js
make: 디렉터리 '/opt/elastalert/node_modules/dtrace-provider/build' 들어감
TOUCH Release/obj.target/DTraceProviderStub.stamp
make: 디렉터리 '/opt/elastalert/node_modules/dtrace-provider/build' 나감
npm notice created a lockfile as package-lock.json. You should commit this file.
+ bunyan@1.8.15
added 20 packages from 23 contributors and audited 20 packages in 2.499s
1 package is looking for funding
run `npm fund` for details
found 0 vulnerabilities
[root@tmplogsvr elastalert]# npm install babel-register --save-dev
npm WARN deprecated core-js@2.6.12: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
> core-js@2.6.12 postinstall /opt/elastalert/node_modules/core-js
> node -e "try{require('./postinstall')}catch(e){}"
Thank you for using core-js ( https://github.com/zloirock/core-js ) for polyfilling JavaScript standard library!
The project needs your help! Please consider supporting of core-js on Open Collective or Patreon:
> https://opencollective.com/core-js
> https://www.patreon.com/zloirock
Also, the author of core-js ( https://github.com/zloirock ) is looking for a good job -)
npm notice save babel-register is being moved from dependencies to devDependencies
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ babel-register@6.26.0
added 51 packages from 53 contributors and audited 93 packages in 1.83s
3 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]#
npm 실행 오류 2 및 해결
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
/opt/elastalert/node_modules/babel-core/lib/transformation/file/options/option-manager.js:328
throw e;
^
Error: Couldnt find preset "es2015" relative to directory "/opt/elastalert"
at /opt/elastalert/node_modules/babel-core/lib/transformation/file/options/option-manager.js:293:19
at Array.map (<anonymous>)
at OptionManager.resolvePresets (/opt/elastalert/node_modules/babel-core/lib/transformation/file/options/option-manager.js:275:20)
at OptionManager.mergePresets (/opt/elastalert/node_modules/babel-core/lib/transformation/file/options/option-manager.js:264:10)
at OptionManager.mergeOptions (/opt/elastalert/node_modules/babel-core/lib/transformation/file/options/option-manager.js:249:14)
at OptionManager.init (/opt/elastalert/node_modules/babel-core/lib/transformation/file/options/option-manager.js:368:12)
at compile (/opt/elastalert/node_modules/babel-register/lib/node.js:103:45)
at loader (/opt/elastalert/node_modules/babel-register/lib/node.js:144:14)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:154:7)
at Module.load (internal/modules/cjs/loader.js:653:32)
[root@tmplogsvr elastalert]# npm install babel-preset-es2015
npm WARN deprecated babel-preset-es2015@6.24.1: 🙌 Thanks for using Babel: we recommend using babel-preset-env now: please read https://babeljs.io/env to update!
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ babel-preset-es2015@6.24.1
added 43 packages from 8 contributors and audited 136 packages in 2.904s
3 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'express'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/opt/elastalert/src/elastalert_server.js:1:1)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at loader (/opt/elastalert/node_modules/babel-register/lib/node.js:144:5)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:154:7)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
[root@tmplogsvr elastalert]# npm install express
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ express@4.18.2
added 54 packages from 40 contributors and audited 190 packages in 1.574s
10 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'body-parser'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/opt/elastalert/src/elastalert_server.js:2:1)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at loader (/opt/elastalert/node_modules/babel-register/lib/node.js:144:5)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:154:7)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
[root@tmplogsvr elastalert]# npm install body-parser
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ body-parser@1.20.2
added 2 packages from 3 contributors and audited 192 packages in 0.82s
10 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'joi'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/opt/elastalert/src/common/config/server_config.js:1:1)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at loader (/opt/elastalert/node_modules/babel-register/lib/node.js:144:5)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:154:7)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
[root@tmplogsvr elastalert]# npm install joi
npm WARN deprecated joi@13.7.0: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm WARN deprecated topo@3.0.3: This module has moved and is now available at @hapi/topo. Please update your dependencies as this version is no longer maintained an may contain bugs and security issues.
npm WARN deprecated hoek@5.0.4: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm WARN deprecated hoek@6.1.3: This module has moved and is now available at @hapi/hoek. Please update your dependencies as this version is no longer maintained an may contain bugs and security issues.
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ joi@13.7.0
added 6 packages from 1 contributor and audited 198 packages in 0.992s
10 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'object-resolve-path'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/opt/elastalert/src/common/config/server_config.js:5:1)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at loader (/opt/elastalert/node_modules/babel-register/lib/node.js:144:5)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:154:7)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
[root@tmplogsvr elastalert]# npm install object-resolve-path
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ object-resolve-path@1.1.1
added 1 package from 1 contributor and audited 199 packages in 1.433s
10 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'mkdirp'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/opt/elastalert/src/common/file_system.js:3:1)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at loader (/opt/elastalert/node_modules/babel-register/lib/node.js:144:5)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:154:7)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
[root@tmplogsvr elastalert]# npm install mkdirp
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ mkdirp@0.5.6
added 1 package from 1 contributor and audited 200 packages in 0.821s
10 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'ws'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/opt/elastalert/src/common/websocket.js:1:1)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at loader (/opt/elastalert/node_modules/babel-register/lib/node.js:144:5)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:154:7)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
[root@tmplogsvr elastalert]# npm install ws
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ ws@6.2.2
added 2 packages from 2 contributors and audited 202 packages in 0.873s
10 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'lodash'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/opt/elastalert/src/routes/route_setup.js:1:1)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at loader (/opt/elastalert/node_modules/babel-register/lib/node.js:144:5)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:154:7)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
[root@tmplogsvr elastalert]# npm install lodash
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ lodash@4.17.21
added 1 package from 2 contributors and audited 203 packages in 0.815s
10 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'elasticsearch'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/opt/elastalert/src/common/elasticsearch_client.js:1:1)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at loader (/opt/elastalert/node_modules/babel-register/lib/node.js:144:5)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:154:7)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
[root@tmplogsvr elastalert]# npm install elasticsearch
npm WARN deprecated elasticsearch@15.5.0: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ elasticsearch@15.5.0
added 3 packages from 3 contributors and audited 207 packages in 0.943s
10 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'tar'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/opt/elastalert/src/controllers/rules/index.js:3:1)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at loader (/opt/elastalert/node_modules/babel-register/lib/node.js:144:5)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:154:7)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
[root@tmplogsvr elastalert]# npm install tar
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ tar@4.4.19
added 6 packages from 1 contributor and audited 213 packages in 1.447s
10 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'fs-extra'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/opt/elastalert/src/controllers/rules/index.js:4:1)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at loader (/opt/elastalert/node_modules/babel-register/lib/node.js:144:5)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:154:7)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
[root@tmplogsvr elastalert]# npm install fs-extra
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ fs-extra@5.0.0
added 4 packages from 2 contributors and audited 217 packages in 0.975s
10 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'request-promise-native'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/opt/elastalert/src/controllers/rules/index.js:5:1)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at loader (/opt/elastalert/node_modules/babel-register/lib/node.js:144:5)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:154:7)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
[root@tmplogsvr elastalert]# npm install request-promise-native
npm WARN deprecated request-promise-native@1.0.9: request-promise-native has been deprecated because it extends the now deprecated request package, see https://github.com/request/request/issues/3142
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
npm WARN request-promise-native@1.0.9 requires a peer of request@^2.34 but none is installed. You must install peer dependencies yourself.
npm WARN request-promise-core@1.1.4 requires a peer of request@^2.34 but none is installed. You must install peer dependencies yourself.
+ request-promise-native@1.0.9
added 5 packages from 9 contributors and audited 222 packages in 0.974s
10 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'request'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at /opt/elastalert/node_modules/request-promise-native/lib/rp.js:8:12
at module.exports (/opt/elastalert/node_modules/stealthy-require/lib/index.js:62:23)
at Object.<anonymous> (/opt/elastalert/node_modules/request-promise-native/lib/rp.js:7:15)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at Module._extensions..js (internal/modules/cjs/loader.js:789:10)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:152:7)
[root@tmplogsvr elastalert]# npm install request
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ request@2.88.2
added 40 packages from 43 contributors and audited 262 packages in 1.55s
11 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'randomstring'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/opt/elastalert/src/controllers/test/index.js:5:1)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at loader (/opt/elastalert/node_modules/babel-register/lib/node.js:144:5)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:154:7)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
[root@tmplogsvr elastalert]# npm install randomstring
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ randomstring@1.2.3
added 3 packages from 2 contributors and audited 265 packages in 1.026s
11 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'cors'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/opt/elastalert/src/elastalert_server.js:13:1)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at loader (/opt/elastalert/node_modules/babel-register/lib/node.js:144:5)
at Object.require.extensions.(anonymous function) [as .js] (/opt/elastalert/node_modules/babel-register/lib/node.js:154:7)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
[root@tmplogsvr elastalert]# npm install cors
npm WARN @babel/register@7.21.0 requires a peer of @babel/core@^7.0.0-0 but none is installed. You must install peer dependencies yourself.
+ cors@2.8.5
added 2 packages from 2 contributors and audited 267 packages in 1.027s
11 packages are looking for funding
run `npm fund` for details
found 1 high severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
[root@tmplogsvr elastalert]#
npm 실행 오류 3 및 해결
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
03:04:12.912Z INFO elastalert-server: Config: No config.dev.json file was found in /opt/elastalert/config/config.dev.json.
03:04:12.913Z INFO elastalert-server: Config: Proceeding to look for normal config file.
03:04:12.913Z INFO elastalert-server: Config: A config file was found in /opt/elastalert/config/config.json. Using that config.
03:04:12.919Z INFO elastalert-server: Router: Listening for GET request on /.
03:04:12.919Z INFO elastalert-server: Router: Listening for GET request on /status.
03:04:12.919Z INFO elastalert-server: Router: Listening for GET request on /status/control/:action.
03:04:12.919Z INFO elastalert-server: Router: Listening for GET request on /status/errors.
03:04:12.919Z INFO elastalert-server: Router: Listening for GET request on /rules.
03:04:12.920Z INFO elastalert-server: Router: Listening for GET request on /rules/:id.
03:04:12.920Z INFO elastalert-server: Router: Listening for POST request on /rules/:id.
03:04:12.920Z INFO elastalert-server: Router: Listening for DELETE request on /rules/:id.
03:04:12.920Z INFO elastalert-server: Router: Listening for GET request on /templates.
03:04:12.920Z INFO elastalert-server: Router: Listening for GET request on /templates/:id.
03:04:12.920Z INFO elastalert-server: Router: Listening for POST request on /templates/:id.
03:04:12.920Z INFO elastalert-server: Router: Listening for DELETE request on /templates/:id.
03:04:12.921Z INFO elastalert-server: Router: Listening for POST request on /test.
03:04:12.921Z INFO elastalert-server: Router: Listening for GET request on /config.
03:04:12.921Z INFO elastalert-server: Router: Listening for POST request on /config.
03:04:12.921Z INFO elastalert-server: Router: Listening for POST request on /download.
03:04:12.921Z INFO elastalert-server: Router: Listening for GET request on /metadata/:type.
03:04:12.921Z INFO elastalert-server: Router: Listening for GET request on /mapping/:index.
03:04:12.921Z INFO elastalert-server: Router: Listening for POST request on /search/:index.
03:04:12.923Z INFO elastalert-server: ProcessController: Starting ElastAlert
03:04:12.923Z INFO elastalert-server: ProcessController: Creating index
03:04:13.089Z ERROR elastalert-server:
ProcessController: Traceback (most recent call last):
File "/usr/lib64/python3.6/runpy.py", line 183, in _run_module_as_main
mod_name, mod_spec, code = _get_module_details(mod_name, _Error)
File "/usr/lib64/python3.6/runpy.py", line 109, in _get_module_details
__import__(pkg_name)
File "/usr/local/lib/python3.6/site-packages/elastalert/__init__.py", line 6, in <module>
from elasticsearch import RequestsHttpConnection
ImportError: cannot import name 'RequestsHttpConnection'
03:04:13.089Z ERROR elastalert-server: ProcessController: Index create exited with code 1
03:04:13.089Z WARN elastalert-server: ProcessController: ElastAlert will start but might not be able to save its data!
03:04:13.089Z INFO elastalert-server: ProcessController: Starting elastalert with arguments [none]
03:04:13.093Z INFO elastalert-server: ProcessController: Started Elastalert (PID: 71989)
03:04:13.093Z INFO elastalert-server: Server: Server listening on port 3030
03:04:13.094Z INFO elastalert-server: Server: Websocket listening on port 3333
03:04:13.094Z INFO elastalert-server: Server: Server started
03:04:13.240Z ERROR elastalert-server:
ProcessController: Traceback (most recent call last):
File "/usr/lib64/python3.6/runpy.py", line 183, in _run_module_as_main
mod_name, mod_spec, code = _get_module_details(mod_name, _Error)
File "/usr/lib64/python3.6/runpy.py", line 109, in _get_module_details
__import__(pkg_name)
File "/usr/local/lib/python3.6/site-packages/elastalert/__init__.py", line 6, in <module>
from elasticsearch import RequestsHttpConnection
ImportError: cannot import name 'RequestsHttpConnection'
03:04:13.255Z ERROR elastalert-server: ProcessController: ElastAlert exited with code 1
03:04:13.255Z INFO elastalert-server: Server: Stopping server
03:04:13.255Z INFO elastalert-server: ProcessController: ElastAlert is not running
03:04:13.256Z INFO elastalert-server: Server: Server stopped. Bye!
[root@tmplogsvr elastalert]# python -m pip install --upgrade 'elasticsearch>=7.16,<8'
Collecting elasticsearch<8,>=7.16
Downloading elasticsearch-7.17.9-py2.py3-none-any.whl (385 kB)
|████████████████████████████████| 385 kB 40.4 MB/s
Requirement already satisfied: urllib3<2,>=1.21.1 in /usr/local/lib/python3.6/site-packages (from elasticsearch<8,>=7.16) (1.26.15)
Requirement already satisfied: certifi in /usr/local/lib/python3.6/site-packages (from elasticsearch<8,>=7.16) (2022.12.7)
Installing collected packages: elasticsearch
Attempting uninstall: elasticsearch
Found existing installation: elasticsearch 8.6.2
Uninstalling elasticsearch-8.6.2:
Successfully uninstalled elasticsearch-8.6.2
ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.
elastalert 0.2.4 requires elasticsearch==7.0.0, but you have elasticsearch 7.17.9 which is incompatible.
Successfully installed elasticsearch-7.17.9
WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv
[root@tmplogsvr elastalert]#
npm 실행 오류 4 및 해결
[root@tmplogsvr elastalert]# npm start
> @bitsensor/elastalert@3.0.0-beta.0 start /opt/elastalert
> sh ./scripts/start.sh
03:16:12.392Z INFO elastalert-server: Config: No config.dev.json file was found in /opt/elastalert/config/config.dev.json.
03:16:12.393Z INFO elastalert-server: Config: Proceeding to look for normal config file.
03:16:12.393Z INFO elastalert-server: Config: A config file was found in /opt/elastalert/config/config.json. Using that config.
03:16:12.399Z INFO elastalert-server: Router: Listening for GET request on /.
03:16:12.399Z INFO elastalert-server: Router: Listening for GET request on /status.
03:16:12.399Z INFO elastalert-server: Router: Listening for GET request on /status/control/:action.
03:16:12.399Z INFO elastalert-server: Router: Listening for GET request on /status/errors.
03:16:12.399Z INFO elastalert-server: Router: Listening for GET request on /rules.
03:16:12.400Z INFO elastalert-server: Router: Listening for GET request on /rules/:id.
03:16:12.400Z INFO elastalert-server: Router: Listening for POST request on /rules/:id.
03:16:12.400Z INFO elastalert-server: Router: Listening for DELETE request on /rules/:id.
03:16:12.400Z INFO elastalert-server: Router: Listening for GET request on /templates.
03:16:12.400Z INFO elastalert-server: Router: Listening for GET request on /templates/:id.
03:16:12.400Z INFO elastalert-server: Router: Listening for POST request on /templates/:id.
03:16:12.400Z INFO elastalert-server: Router: Listening for DELETE request on /templates/:id.
03:16:12.400Z INFO elastalert-server: Router: Listening for POST request on /test.
03:16:12.400Z INFO elastalert-server: Router: Listening for GET request on /config.
03:16:12.400Z INFO elastalert-server: Router: Listening for POST request on /config.
03:16:12.400Z INFO elastalert-server: Router: Listening for POST request on /download.
03:16:12.400Z INFO elastalert-server: Router: Listening for GET request on /metadata/:type.
03:16:12.400Z INFO elastalert-server: Router: Listening for GET request on /mapping/:index.
03:16:12.400Z INFO elastalert-server: Router: Listening for POST request on /search/:index.
03:16:12.403Z INFO elastalert-server: ProcessController: Starting ElastAlert
03:16:12.403Z INFO elastalert-server: ProcessController: Creating index
03:16:12.587Z INFO elastalert-server: ProcessController: Enter Elasticsearch host:
03:16:12.587Z ERROR elastalert-server:
ProcessController: Traceback (most recent call last):
File "/usr/lib64/python3.6/runpy.py", line 193, in _run_module_as_main
"__main__", mod_spec)
File "/usr/lib64/python3.6/runpy.py", line 85, in _run_code
exec(code, run_globals)
File "/usr/local/lib/python3.6/site-packages/elastalert/create_index.py", line 268, in <module>
main()
File "/usr/local/lib/python3.6/site-packages/elastalert/create_index.py", line 215, in main
host = args.host if args.host else input('Enter Elasticsearch host: ')
EOFError: EOF when reading a line
03:16:12.587Z ERROR elastalert-server: ProcessController: Index create exited with code 1
03:16:12.587Z WARN elastalert-server: ProcessController: ElastAlert will start but might not be able to save its data!
03:16:12.587Z INFO elastalert-server: ProcessController: Starting elastalert with arguments [none]
03:16:12.591Z INFO elastalert-server: ProcessController: Started Elastalert (PID: 72288)
03:16:12.592Z INFO elastalert-server: Server: Server listening on port 3030
03:16:12.592Z INFO elastalert-server: Server: Websocket listening on port 3333
03:16:12.592Z INFO elastalert-server: Server: Server started
03:16:12.883Z ERROR elastalert-server:
ProcessController: Traceback (most recent call last):
File "/usr/lib64/python3.6/runpy.py", line 193, in _run_module_as_main
"__main__", mod_spec)
File "/usr/lib64/python3.6/runpy.py", line 85, in _run_code
exec(code, run_globals)
File "/usr/local/lib/python3.6/site-packages/elastalert/elastalert.py", line 2055, in <module>
sys.exit(main(sys.argv[1:]))
File "/usr/local/lib/python3.6/site-packages/elastalert/elastalert.py", line 2049, in main
client = ElastAlerter(args)
File "/usr/local/lib/python3.6/site-packages/elastalert/elastalert.py", line 138, in __init__
self.conf = load_conf(self.args)
File "/usr/local/lib/python3.6/site-packages/elastalert/config.py", line 45, in load_conf
conf = yaml_loader(filename)
File "/usr/local/lib/python3.6/site-packages/staticconf/loader.py", line 177, in yaml_loader
with open(filename) as fh:
FileNotFoundError: [Errno 2] No such file or directory: 'config.yaml'
03:16:12.916Z ERROR elastalert-server: ProcessController: ElastAlert exited with code 1
03:16:12.916Z INFO elastalert-server: Server: Stopping server
03:16:12.916Z INFO elastalert-server: ProcessController: ElastAlert is not running
03:16:12.917Z INFO elastalert-server: Server: Server stopped. Bye!
[root@tmplogsvr elastalert]#
[root@tmplogsvr elastalert]# echo \
'rules_folder: rules # 폴더명
run_every: # elasticsearch를 쿼리하는 빈도
minutes: 1
buffer_time: # 쿼리가 실행되는 시간부터 뒤로 늘어나는 쿼리 창의 크기
minutes: 15
es_host: 192.168.0.17 # elasticsearch host
es_port: 9200 # elasticsearch 사용 port
writeback_index: elastalert_status # elastalert2가 데이터를 저장할 index
alert_time_limit: # 실패한 경고에 대한 재시도 기간
days: 2' > config.yaml
[root@tmplogsvr elastalert]#
rsyslog의 설정을 제가 한 대로 따라하셨다면, 해당 폴더에 syslog 를 수신한 폴더와 내부에 파일이 보일 겁니다.
[root@tmplogsvr rsyslog]# pwd
/var/log/rsyslog
[root@tmplogsvr rsyslog]# ls -al
합계 4
drwx------. 7 root root 106 2월 15 14:45 .
drwxr-xr-x. 17 root root 4096 2월 19 00:00 ..
drwx------. 2 root root 138 2월 20 00:12 192.168.0.54
drwx------. 2 root root 138 2월 20 00:00 192.168.10.2
drwx------. 2 root root 138 2월 20 08:23 192.168.10.3
drwx------. 2 root root 138 2월 20 08:31 192.168.10.4
drwx------. 2 root root 138 2월 20 01:39 192.168.10.5
[root@tmplogsvr rsyslog]#
해당 폴더에 들어가면 수신날자.log 형태의 파일을 확인할 수 있습니다.
[root@tmplogsvr 192.168.10.2]# ls -al
합계 3072
drwx------. 2 root root 138 2월 20 00:00 .
drwx------. 7 root root 106 2월 15 14:45 ..
-rw-------. 1 root root 703219 2월 15 23:57 2023-02-15.log
-rw-------. 1 root root 1129390 2월 16 18:29 2023-02-16.log
-rw-------. 1 root root 176330 2월 17 21:12 2023-02-17.log
-rw-------. 1 root root 504511 2월 18 23:59 2023-02-18.log
-rw-------. 1 root root 542715 2월 19 22:26 2023-02-19.log
-rw-------. 1 root root 71405 2월 20 11:17 2023-02-20.log
[root@tmplogsvr 192.168.10.2]#
kibana에서 보고 싶은 파일의 위치를 확인 하신 후 logstash의 설정을 합니다.
우선 먼저 어떻게 파일이 수신되는지 확인을 합니다.
저는 logstash의 로그 파싱 설정을 /etc/logstash/conf.d 폴더에 logstash.conf 로 작성하였습니다.
[root@tmplogsvr 192.168.10.2]# cat /etc/logstash/conf.d/logstash.conf
input { # logstash에서 파일을 받아들이겠다는 선언
file { # 어떤 형태의 입력 type을 받겠다는 선언
path => "/var/log/rsyslog/192.168.10.2/*.log" # 받아 들일 로그의 위치 선언
start_position => "beginning" # 파일을 읽는 방식으로 차후 자세한 설명
tags => ["ap1"] # 해당 경로의 파일인 경우 tag에 "ap1"을 표시
}
}
output { #logstash에서 파일을 내보내겠다는 선언
if "ap1" in [tags] { # 로그 중 tags에 "ap1"이 표시되어 있다면
elasticsearch { # 로그를 elasticsearch에 보내겠다는 선언
hosts => ["http://192.168.0.17:9200"] # elasticsearch url 정보
index => "logstash-ap1-index-%{+YYYY.MM.dd}" # elasticsearch의 index 입력 방식
}
}
}
위의 설정대로 하신 후 logstash를 재시작 합니다.
이제 kibana에 접속을 합니다.
정상적으로 출력이 됐다면, logstash.conf 파일을 아래와 같이 수정
input {
file {
path => "/var/log/rsyslog/192.168.10.2/*.log"
start_position => "beginning"
tags => ["ap1"]
}
}
filter {
if "ap1" in [tags] { # tags에 "ap1"이 있다면
grok { # grok 적용해라
patterns_dir => ["/etc/logstash/patterns.d"] # grok 적용 전 패턴 등록
match => { "message" => [ "%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip} %{IPORHOST:process}\[%{BASE10NUM:process_id}\]\: %{GREEDYDATA:sub_message}" ] }
}
mutate { remove_field => [ "message" ] } # message 필드 삭제
}
}
output {
if "ap1" in [tags] {
elasticsearch {
hosts => ["http://192.168.0.17:9200"]
index => "logstash-ap1-index-%{+YYYY.MM.dd}"
}
}
}
[root@tmplogsvr logstash]# cat /etc/logstash/logstash.yml
# Settings file in YAML
#
# Settings can be specified either in hierarchical form, e.g.:
#
# pipeline:
# batch:
# size: 125
# delay: 5
#
# Or as flat keys:
#
# pipeline.batch.size: 125
# pipeline.batch.delay: 5
#
# ------------ Node identity ------------
#
# Use a descriptive name for the node:
#
# node.name: test
#
# If omitted the node name will default to the machine's host name
#
# ------------ Data path ------------------
#
# Which directory should be used by logstash and its plugins
# for any persistent needs. Defaults to LOGSTASH_HOME/data
#
path.data: /var/lib/logstash
#
# ------------ Pipeline Settings --------------
#
# The ID of the pipeline.
#
# pipeline.id: main
#
# Set the number of workers that will, in parallel, execute the filters+outputs
# stage of the pipeline.
#
# This defaults to the number of the host's CPU cores.
#
# pipeline.workers: 2
#
# How many events to retrieve from inputs before sending to filters+workers
#
# pipeline.batch.size: 125
#
# How long to wait in milliseconds while polling for the next event
# before dispatching an undersized batch to filters+outputs
#
# pipeline.batch.delay: 50
#
# Force Logstash to exit during shutdown even if there are still inflight
# events in memory. By default, logstash will refuse to quit until all
# received events have been pushed to the outputs.
#
# WARNING: Enabling this can lead to data loss during shutdown
#
# pipeline.unsafe_shutdown: false
#
# Set the pipeline event ordering. Options are "auto" (the default), "true" or "false".
# "auto" automatically enables ordering if the 'pipeline.workers' setting
# is also set to '1', and disables otherwise.
# "true" enforces ordering on the pipeline and prevent logstash from starting
# if there are multiple workers.
# "false" disables any extra processing necessary for preserving ordering.
#
# pipeline.ordered: auto
#
# Sets the pipeline's default value for `ecs_compatibility`, a setting that is
# available to plugins that implement an ECS Compatibility mode for use with
# the Elastic Common Schema.
# Possible values are:
# - disabled
# - v1
# - v8 (default)
# Pipelines defined before Logstash 8 operated without ECS in mind. To ensure a
# migrated pipeline continues to operate as it did before your upgrade, opt-OUT
# of ECS for the individual pipeline in its `pipelines.yml` definition. Setting
# it here will set the default for _all_ pipelines, including new ones.
#
# pipeline.ecs_compatibility: v8
#
# ------------ Pipeline Configuration Settings --------------
#
# Where to fetch the pipeline configuration for the main pipeline
#
# path.config:
#
# Pipeline configuration string for the main pipeline
#
# config.string:
#
# At startup, test if the configuration is valid and exit (dry run)
#
# config.test_and_exit: false
#
# Periodically check if the configuration has changed and reload the pipeline
# This can also be triggered manually through the SIGHUP signal
#
# config.reload.automatic: false
#
# How often to check if the pipeline configuration has changed (in seconds)
# Note that the unit value (s) is required. Values without a qualifier (e.g. 60)
# are treated as nanoseconds.
# Setting the interval this way is not recommended and might change in later versions.
#
# config.reload.interval: 3s
#
# Show fully compiled configuration as debug log message
# NOTE: --log.level must be 'debug'
#
# config.debug: false
#
# When enabled, process escaped characters such as \n and \" in strings in the
# pipeline configuration files.
#
# config.support_escapes: false
#
# ------------ API Settings -------------
# Define settings related to the HTTP API here.
#
# The HTTP API is enabled by default. It can be disabled, but features that rely
# on it will not work as intended.
#
# api.enabled: true
#
# By default, the HTTP API is not secured and is therefore bound to only the
# host's loopback interface, ensuring that it is not accessible to the rest of
# the network.
# When secured with SSL and Basic Auth, the API is bound to _all_ interfaces
# unless configured otherwise.
#
# api.http.host: 127.0.0.1
#
# The HTTP API web server will listen on an available port from the given range.
# Values can be specified as a single port (e.g., `9600`), or an inclusive range
# of ports (e.g., `9600-9700`).
#
# api.http.port: 9600-9700
#
# The HTTP API includes a customizable "environment" value in its response,
# which can be configured here.
#
# api.environment: "production"
#
# The HTTP API can be secured with SSL (TLS). To do so, you will need to provide
# the path to a password-protected keystore in p12 or jks format, along with credentials.
#
# api.ssl.enabled: false
# api.ssl.keystore.path: /path/to/keystore.jks
# api.ssl.keystore.password: "y0uRp4$$w0rD"
#
# The HTTP API can be configured to require authentication. Acceptable values are
# - `none`: no auth is required (default)
# - `basic`: clients must authenticate with HTTP Basic auth, as configured
# with `api.auth.basic.*` options below
# api.auth.type: none
#
# When configured with `api.auth.type` `basic`, you must provide the credentials
# that requests will be validated against. Usage of Environment or Keystore
# variable replacements is encouraged (such as the value `"${HTTP_PASS}"`, which
# resolves to the value stored in the keystore's `HTTP_PASS` variable if present
# or the same variable from the environment)
#
# api.auth.basic.username: "logstash-user"
# api.auth.basic.password: "s3cUreP4$$w0rD"
#
# When setting `api.auth.basic.password`, the password should meet
# the default password policy requirements.
# The default password policy requires non-empty minimum 8 char string that
# includes a digit, upper case letter and lower case letter.
# Policy mode sets Logstash to WARN or ERROR when HTTP authentication password doesn't
# meet the password policy requirements.
# The default is WARN. Setting to ERROR enforces stronger passwords (recommended).
#
# api.auth.basic.password_policy.mode: WARN
#
# ------------ Module Settings ---------------
# Define modules here. Modules definitions must be defined as an array.
# The simple way to see this is to prepend each `name` with a `-`, and keep
# all associated variables under the `name` they are associated with, and
# above the next, like this:
#
# modules:
# - name: MODULE_NAME
# var.PLUGINTYPE1.PLUGINNAME1.KEY1: VALUE
# var.PLUGINTYPE1.PLUGINNAME1.KEY2: VALUE
# var.PLUGINTYPE2.PLUGINNAME1.KEY1: VALUE
# var.PLUGINTYPE3.PLUGINNAME3.KEY1: VALUE
#
# Module variable names must be in the format of
#
# var.PLUGIN_TYPE.PLUGIN_NAME.KEY
#
# modules:
#
# ------------ Cloud Settings ---------------
# Define Elastic Cloud settings here.
# Format of cloud.id is a base64 value e.g. dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRub3RhcmVhbCRpZGVudGlmaWVy
# and it may have an label prefix e.g. staging:dXMtZ...
# This will overwrite 'var.elasticsearch.hosts' and 'var.kibana.host'
# cloud.id: <identifier>
#
# Format of cloud.auth is: <user>:<pass>
# This is optional
# If supplied this will overwrite 'var.elasticsearch.username' and 'var.elasticsearch.password'
# If supplied this will overwrite 'var.kibana.username' and 'var.kibana.password'
# cloud.auth: elastic:<password>
#
# ------------ Queuing Settings --------------
#
# Internal queuing model, "memory" for legacy in-memory based queuing and
# "persisted" for disk-based acked queueing. Defaults is memory
#
# queue.type: memory
#
# If `queue.type: persisted`, the directory path where the pipeline data files will be stored.
# Each pipeline will group its PQ files in a subdirectory matching its `pipeline.id`.
# Default is path.data/queue.
#
# path.queue:
#
# If using queue.type: persisted, the page data files size. The queue data consists of
# append-only data files separated into pages. Default is 64mb
#
# queue.page_capacity: 64mb
#
# If using queue.type: persisted, the maximum number of unread events in the queue.
# Default is 0 (unlimited)
#
# queue.max_events: 0
#
# If using queue.type: persisted, the total capacity of the queue in number of bytes.
# If you would like more unacked events to be buffered in Logstash, you can increase the
# capacity using this setting. Please make sure your disk drive has capacity greater than
# the size specified here. If both max_bytes and max_events are specified, Logstash will pick
# whichever criteria is reached first
# Default is 1024mb or 1gb
#
# queue.max_bytes: 1024mb
#
# If using queue.type: persisted, the maximum number of acked events before forcing a checkpoint
# Default is 1024, 0 for unlimited
#
# queue.checkpoint.acks: 1024
#
# If using queue.type: persisted, the maximum number of written events before forcing a checkpoint
# Default is 1024, 0 for unlimited
#
# queue.checkpoint.writes: 1024
#
# If using queue.type: persisted, the interval in milliseconds when a checkpoint is forced on the head page
# Default is 1000, 0 for no periodic checkpoint.
#
# queue.checkpoint.interval: 1000
#
# ------------ Dead-Letter Queue Settings --------------
# Flag to turn on dead-letter queue.
#
# dead_letter_queue.enable: false
# If using dead_letter_queue.enable: true, the maximum size of each dead letter queue. Entries
# will be dropped if they would increase the size of the dead letter queue beyond this setting.
# Default is 1024mb
# dead_letter_queue.max_bytes: 1024mb
# If using dead_letter_queue.enable: true, the interval in milliseconds where if no further events eligible for the DLQ
# have been created, a dead letter queue file will be written. A low value here will mean that more, smaller, queue files
# may be written, while a larger value will introduce more latency between items being "written" to the dead letter queue, and
# being available to be read by the dead_letter_queue input when items are written infrequently.
# Default is 5000.
#
# dead_letter_queue.flush_interval: 5000
# If using dead_letter_queue.enable: true, controls which entries should be dropped to avoid exceeding the size limit.
# Set the value to `drop_newer` (default) to stop accepting new events that would push the DLQ size over the limit.
# Set the value to `drop_older` to remove queue pages containing the oldest events to make space for new ones.
#
# dead_letter_queue.storage_policy: drop_newer
# If using dead_letter_queue.enable: true, the interval that events have to be considered valid. After the interval has
# expired the events could be automatically deleted from the DLQ.
# The interval could be expressed in days, hours, minutes or seconds, using as postfix notation like 5d,
# to represent a five days interval.
# The available units are respectively d, h, m, s for day, hours, minutes and seconds.
# If not specified then the DLQ doesn't use any age policy for cleaning events.
#
# dead_letter_queue.retain.age: 1d
# If using dead_letter_queue.enable: true, defines the action to take when the dead_letter_queue.max_bytes is reached,
# could be "drop_newer" or "drop_older".
# With drop_newer, messages that were inserted most recently are dropped, logging an error line.
# With drop_older setting, the oldest messages are dropped as new ones are inserted.
# Default value is "drop_newer".
# dead_letter_queue.storage_policy: drop_newer
# If using dead_letter_queue.enable: true, the directory path where the data files will be stored.
# Default is path.data/dead_letter_queue
#
# path.dead_letter_queue:
#
# ------------ Debugging Settings --------------
#
# Options for log.level:
# * fatal
# * error
# * warn
# * info (default)
# * debug
# * trace
#
# log.level: info
path.logs: /var/log/logstash
#
# ------------ Other Settings --------------
#
# Allow or block running Logstash as superuser (default: true)
# allow_superuser: false
#
# Where to find custom plugins
# path.plugins: []
#
# Flag to output log lines of each pipeline in its separate log file. Each log filename contains the pipeline.name
# Default is false
# pipeline.separate_logs: false
#
# ------------ X-Pack Settings (not applicable for OSS build)--------------
#
# X-Pack Monitoring
# https://www.elastic.co/guide/en/logstash/current/monitoring-logstash.html
#xpack.monitoring.enabled: false
#xpack.monitoring.elasticsearch.username: logstash_system
#xpack.monitoring.elasticsearch.password: password
#xpack.monitoring.elasticsearch.proxy: ["http://proxy:port"]
#xpack.monitoring.elasticsearch.hosts: ["https://es1:9200", "https://es2:9200"]
# an alternative to hosts + username/password settings is to use cloud_id/cloud_auth
#xpack.monitoring.elasticsearch.cloud_id: monitoring_cluster_id:xxxxxxxxxx
#xpack.monitoring.elasticsearch.cloud_auth: logstash_system:password
# another authentication alternative is to use an Elasticsearch API key
#xpack.monitoring.elasticsearch.api_key: "id:api_key"
#xpack.monitoring.elasticsearch.ssl.certificate_authority: "/path/to/ca.crt"
#xpack.monitoring.elasticsearch.ssl.ca_trusted_fingerprint: xxxxxxxxxx
#xpack.monitoring.elasticsearch.ssl.truststore.path: path/to/file
#xpack.monitoring.elasticsearch.ssl.truststore.password: password
#xpack.monitoring.elasticsearch.ssl.keystore.path: /path/to/file
#xpack.monitoring.elasticsearch.ssl.keystore.password: password
#xpack.monitoring.elasticsearch.ssl.verification_mode: certificate
#xpack.monitoring.elasticsearch.sniffing: false
#xpack.monitoring.collection.interval: 10s
#xpack.monitoring.collection.pipeline.details.enabled: true
#
# X-Pack Management
# https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html
#xpack.management.enabled: false
#xpack.management.pipeline.id: ["main", "apache_logs"]
#xpack.management.elasticsearch.username: logstash_admin_user
#xpack.management.elasticsearch.password: password
#xpack.management.elasticsearch.proxy: ["http://proxy:port"]
#xpack.management.elasticsearch.hosts: ["https://es1:9200", "https://es2:9200"]
# an alternative to hosts + username/password settings is to use cloud_id/cloud_auth
#xpack.management.elasticsearch.cloud_id: management_cluster_id:xxxxxxxxxx
#xpack.management.elasticsearch.cloud_auth: logstash_admin_user:password
# another authentication alternative is to use an Elasticsearch API key
#xpack.management.elasticsearch.api_key: "id:api_key"
#xpack.management.elasticsearch.ssl.ca_trusted_fingerprint: xxxxxxxxxx
#xpack.management.elasticsearch.ssl.certificate_authority: "/path/to/ca.crt"
#xpack.management.elasticsearch.ssl.truststore.path: /path/to/file
#xpack.management.elasticsearch.ssl.truststore.password: password
#xpack.management.elasticsearch.ssl.keystore.path: /path/to/file
#xpack.management.elasticsearch.ssl.keystore.password: password
#xpack.management.elasticsearch.ssl.verification_mode: certificate
#xpack.management.elasticsearch.sniffing: false
#xpack.management.logstash.poll_interval: 5s
# X-Pack GeoIP plugin
# https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-manage_update
#xpack.geoip.download.endpoint: "https://geoip.elastic.co/v1/database"
# For more configuration options see the configuration guide for Kibana in
# https://www.elastic.co/guide/index.html
# =================== System: Kibana Server ===================
# Kibana is served by a back end server. This setting specifies the port to use.
server.port: 5601
# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
server.host: "0.0.0.0"
# Enables you to specify a path to mount Kibana at if you are running behind a proxy.
# Use the `server.rewriteBasePath` setting to tell Kibana if it should remove the basePath
# from requests it receives, and to prevent a deprecation warning at startup.
# This setting cannot end in a slash.
#server.basePath: ""
# Specifies whether Kibana should rewrite requests that are prefixed with
# `server.basePath` or require that they are rewritten by your reverse proxy.
# Defaults to `false`.
#server.rewriteBasePath: false
# Specifies the public URL at which Kibana is available for end users. If
# `server.basePath` is configured this URL should end with the same basePath.
#server.publicBaseUrl: ""
# The maximum payload size in bytes for incoming server requests.
#server.maxPayload: 1048576
# The Kibana server's name. This is used for display purposes.
server.name: "tmplogsvr"
# =================== System: Kibana Server (Optional) ===================
# Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.
# These settings enable SSL for outgoing requests from the Kibana server to the browser.
#server.ssl.enabled: false
#server.ssl.certificate: /path/to/your/server.crt
#server.ssl.key: /path/to/your/server.key
# =================== System: Elasticsearch ===================
# The URLs of the Elasticsearch instances to use for all your queries.
elasticsearch.hosts: ["http://localhost:9200"]
# If your Elasticsearch is protected with basic authentication, these settings provide
# the username and password that the Kibana server uses to perform maintenance on the Kibana
# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
# is proxied through the Kibana server.
#elasticsearch.username: "kibana_system"
#elasticsearch.password: "pass"
# Kibana can also authenticate to Elasticsearch via "service account tokens".
# Service account tokens are Bearer style tokens that replace the traditional username/password based configuration.
# Use this token instead of a username/password.
# elasticsearch.serviceAccountToken: "my_token"
# Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of
# the elasticsearch.requestTimeout setting.
#elasticsearch.pingTimeout: 1500
# Time in milliseconds to wait for responses from the back end or Elasticsearch. This value
# must be a positive integer.
#elasticsearch.requestTimeout: 30000
# The maximum number of sockets that can be used for communications with elasticsearch.
# Defaults to `Infinity`.
#elasticsearch.maxSockets: 1024
# Specifies whether Kibana should use compression for communications with elasticsearch
# Defaults to `false`.
#elasticsearch.compression: false
# List of Kibana client-side headers to send to Elasticsearch. To send *no* client-side
# headers, set this value to [] (an empty list).
#elasticsearch.requestHeadersWhitelist: [ authorization ]
# Header names and values that are sent to Elasticsearch. Any custom headers cannot be overwritten
# by client-side headers, regardless of the elasticsearch.requestHeadersWhitelist configuration.
#elasticsearch.customHeaders: {}
# Time in milliseconds for Elasticsearch to wait for responses from shards. Set to 0 to disable.
#elasticsearch.shardTimeout: 30000
# =================== System: Elasticsearch (Optional) ===================
# These files are used to verify the identity of Kibana to Elasticsearch and are required when
# xpack.security.http.ssl.client_authentication in Elasticsearch is set to required.
#elasticsearch.ssl.certificate: /path/to/your/client.crt
#elasticsearch.ssl.key: /path/to/your/client.key
# Enables you to specify a path to the PEM file for the certificate
# authority for your Elasticsearch instance.
#elasticsearch.ssl.certificateAuthorities: [ "/path/to/your/CA.pem" ]
# To disregard the validity of SSL certificates, change this setting's value to 'none'.
#elasticsearch.ssl.verificationMode: full
# =================== System: Logging ===================
# Set the value of this setting to off to suppress all logging output, or to debug to log everything. Defaults to 'info'
#logging.root.level: debug
# Enables you to specify a file where Kibana stores log output.
logging:
appenders:
file:
type: file
fileName: /var/log/kibana/kibana.log
layout:
type: json
root:
appenders:
- default
- file
# layout:
# type: json
# Logs queries sent to Elasticsearch.
#logging.loggers:
# - name: elasticsearch.query
# level: debug
# Logs http responses.
#logging.loggers:
# - name: http.server.response
# level: debug
# Logs system usage information.
#logging.loggers:
# - name: metrics.ops
# level: debug
# =================== System: Other ===================
# The path where Kibana stores persistent data not saved in Elasticsearch. Defaults to data
#path.data: data
# Specifies the path where Kibana creates the process ID file.
pid.file: /run/kibana/kibana.pid
# Set the interval in milliseconds to sample system and process performance
# metrics. Minimum is 100ms. Defaults to 5000ms.
#ops.interval: 5000
# Specifies locale to be used for all localizable strings, dates and number formats.
# Supported languages are the following: English (default) "en", Chinese "zh-CN", Japanese "ja-JP", French "fr-FR".
#i18n.locale: "en"
# =================== Frequently used (Optional)===================
# =================== Saved Objects: Migrations ===================
# Saved object migrations run at startup. If you run into migration-related issues, you might need to adjust these settings.
# The number of documents migrated at a time.
# If Kibana can't start up or upgrade due to an Elasticsearch `circuit_breaking_exception`,
# use a smaller batchSize value to reduce the memory pressure. Defaults to 1000 objects per batch.
#migrations.batchSize: 1000
# The maximum payload size for indexing batches of upgraded saved objects.
# To avoid migrations failing due to a 413 Request Entity Too Large response from Elasticsearch.
# This value should be lower than or equal to your Elasticsearch cluster’s `http.max_content_length`
# configuration option. Default: 100mb
#migrations.maxBatchSizeBytes: 100mb
# The number of times to retry temporary migration failures. Increase the setting
# if migrations fail frequently with a message such as `Unable to complete the [...] step after
# 15 attempts, terminating`. Defaults to 15
#migrations.retryAttempts: 15
# =================== Search Autocomplete ===================
# Time in milliseconds to wait for autocomplete suggestions from Elasticsearch.
# This value must be a whole number greater than zero. Defaults to 1000ms
#unifiedSearch.autocomplete.valueSuggestions.timeout: 1000
# Maximum number of documents loaded by each shard to generate autocomplete suggestions.
# This value must be a whole number greater than zero. Defaults to 100_000
#unifiedSearch.autocomplete.valueSuggestions.terminateAfter: 100000
cluster를 사용할 경우 로그: /var/log/elasticsearch/{cluster.name}.log
cluster를 사용하지 않을 경우 로그: /var/log/elasticsearch/elasticsearch.log
클러스터 설정 사용하지 않을 경우
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
# 클러스터 사용할 경우 아래 항목 활성화
# cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: tmplogsvr
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
# discovery.seed_hosts: ["127.0.0.1"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
# 클러스터 사용할 경우 아래 항목 설정 적용
# cluster.initial_master_nodes: ["tmplogsvr"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
설정에 맞게 사용 (전체 설정 내용)
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: tmplogsvr
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /var/lib/elasticsearch
#
# Path to log files:
#
path.logs: /var/log/elasticsearch
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# By default Elasticsearch is only accessible on localhost. Set a different
# address here to expose this node on the network:
#
network.host: 0.0.0.0
#
# By default Elasticsearch listens for HTTP traffic on the first free port it
# finds starting at 9200. Set a specific HTTP port here:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["127.0.0.1", "[::1]"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["tmplogsvr"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# --------------------------------- Readiness ----------------------------------
#
# Enable an unauthenticated TCP readiness endpoint on localhost
#
#readiness.port: 9399
#
# ---------------------------------- Various -----------------------------------
#
# Allow wildcard deletion of indices:
#
#action.destructive_requires_name: false
#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------
#
# The following settings, TLS certificates, and keys have been automatically
# generated to configure Elasticsearch security features on 16-02-2023 03:11:46
#
# --------------------------------------------------------------------------------
# Enable security features
xpack.security.enabled: false
xpack.security.enrollment.enabled: false
# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
enabled: false
keystore.path: certs/http.p12
# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
enabled: false
verification_mode: certificate
keystore.path: certs/transport.p12
truststore.path: certs/transport.p12
# Create a new cluster with the current node only
# Additional nodes can still join the cluster later
#cluster.initial_master_nodes: ["localhost"]
# Allow HTTP API connections from anywhere
# Connections are encrypted and require user authentication
http.host: 0.0.0.0
# Allow other nodes to join the cluster from anywhere
# Connections are encrypted and mutually authenticated
#transport.host: 0.0.0.0
#----------------------- END SECURITY AUTO CONFIGURATION -------------------------
# Error 로그에exception during geoip databases update 가 있는 경우
ingest.geoip.downloader.enabled: false
