kibana でさくらのウェブアクセラレータのログを確認してみた [第１回]

[root@kibana01 ~]# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

[root@kibana01 ~]# vi /etc/yum.repos.d/elasticsearch.repo

[elasticsearch]
name=Elasticsearch repository for 9.x packages
baseurl=https://artifacts.elastic.co/packages/9.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
type=rpm-md

[root@kibana01 ~]# dnf install --enablerepo=elasticsearch elasticsearch

--------------------------- Security autoconfiguration information ------------------------------

Authentication and authorization are enabled.
TLS for the transport and HTTP layers is enabled and configured.

The generated password for the elastic built-in superuser is : yPxxxxxxxxxxxxxxxx1w

[root@kibana01 ~]# vi /etc/elasticsearch/jvm.options

-Xms1g
-Xmx1g

[root@kibana01 ~]# systemctl enable elasticsearch

[root@kibana01 ~]# systemctl start elasticsearch

[root@kibana01 ~]# tail -3 /var/log/elasticsearch/elasticsearch.log
[2026-09-05T23:16:34,575][INFO ][o.e.c.m.MetadataCreateDataStreamService] [kibana01] adding data stream [ilm-history-7] with write index [.ds-ilm-history-7-2026.09.05-000001], backing indices [], and aliases []
[2026-09-05T23:16:34,576][INFO ][o.e.c.r.a.AllocationService] [kibana01] in project [default] updating number_of_replicas to [0] for indices [.ds-ilm-history-7-2026.09.05-000001]
[2026-09-05T23:16:34,668][INFO ][o.e.c.r.a.AllocationService] [kibana01] current.health="GREEN" message="Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.ds-ilm-history-7-2026.09.05-000001][0]]])." previous.health="YELLOW" reason="shards started [[.ds-ilm-history-7-2026.09.05-000001][0]]"

[root@kibana01 ~]# curl -k -u elastic:yPxxxxxxxxxxxxxxxx1w https://localhost:9200
{
  "name" : "kibana01",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "hvX--1HISQStr1eA3MIqng",
  "version" : {
    "number" : "9.5.3",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "367ec317ec5f668dd864d41be06052a567102fec",
    "build_date" : "2026-09-01T16:11:59.322249404Z",
    "build_snapshot" : false,
    "lucene_version" : "10.5.1",
    "minimum_wire_compatibility_version" : "8.19.0",
    "minimum_index_compatibility_version" : "8.0.0"
  },
  "tagline" : "You Know, for Search"
}

[root@kibana01 ~]# vi ~/.netrc

machine localhost
login elastic
password yPxxxxxxxxxxxxxxxx1w

[root@kibana01 ~]# curl -k --netrc https://localhost:9200

[root@kibana01 ~]# vi /etc/yum.repos.d/kibana.repo

[kibana-9.X]
name=Kibana repository for 9.x packages
baseurl=https://artifacts.elastic.co/packages/9.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

[root@kibana01 ~]# /usr/share/elasticsearch/bin/elasticsearch -V
Version: 9.5.3, Build: rpm/367ec317ec5f668dd864d41be06052a567102fec/2026-09-01T16:11:59.322249404Z, JVM: 26.0.2

[root@kibana01 ~]# dnf install kibana-9.5.3

[root@kibana01 ~]# /usr/share/kibana/bin/kibana-encryption-keys generate
## Kibana Encryption Key Generation Utility

The 'generate' command guides you through the process of setting encryption keys for:

xpack.encryptedSavedObjects.encryptionKey
    Used to encrypt stored objects such as dashboards and visualizations
    https://www.elastic.co/guide/en/kibana/current/xpack-security-secure-saved-objects.html#xpack-security-secure-saved-objects

xpack.reporting.encryptionKey
    Used to encrypt saved reports
    https://www.elastic.co/guide/en/kibana/current/reporting-settings-kb.html#general-reporting-settings

xpack.security.encryptionKey
    Used to encrypt session information
    https://www.elastic.co/guide/en/kibana/current/security-settings-kb.html#security-session-and-cookie-settings


Already defined settings are ignored and can be regenerated using the --force flag.  Check the documentation links for instructions on how to rotate encryption keys.
Definitions should be set in the kibana.yml used configure Kibana.

Settings:
xpack.encryptedSavedObjects.encryptionKey: c64xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx195
xpack.reporting.encryptionKey: eb1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx103
xpack.security.encryptionKey: 6bbxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxc4d

[root@kibana01 ~]# vi /etc/kibana/kibana.yml

server.host: "0.0.0.0"

xpack.encryptedSavedObjects.encryptionKey: c64xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx195
xpack.reporting.encryptionKey: eb1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx103
xpack.security.encryptionKey: 6bbxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxc4d

[root@kibana01 ~]# systemctl enable kibana

[root@kibana01 ~]# systemctl start kibana

[root@kibana01 ~]# systemctl status kibana

# tail -F /var/log/messages

Sep  5 13:26:49 kibana01 kibana[2128]: Go to http://0.0.0.0:5601/?code=615705 to get started.

[root@kibana01 ~]# firewall-cmd --add-port=5601/tcp --permanent

[root@kibana01 ~]# firewall-cmd --reload

[root@kibana01 ~]# /usr/share/elasticsearch/bin/elasticsearch-reset-password -u kibana_system
This tool will reset the password of the [kibana_system] user to an autogenerated value.
The password will be printed in the console.
Please confirm that you would like to continue [y/N]y


Password for the [kibana_system] user successfully reset.
New value: hKxxxxxxxxxxxxxxxxpE

[root@kibana01 ~]# /usr/share/kibana/bin/kibana-verification-code
Your verification code is:  6X4 7X1

statusCode	503
error	"Service Unavailable"
message	"License information could not be obtained from Elasticsearch. Please check the logs for further details."

[root@kibana01 ~]# vi /etc/kibana/node.options

--max-old-space-size=1024

[root@kibana01 ~]# systemctl restart kibana

[root@kibana01 ~]# vi /etc/yum.repos.d/elastic.repo

[elastic-9.x]
name=Elastic repository for 9.x packages
baseurl=https://artifacts.elastic.co/packages/9.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

[root@kibana01 ~]# dnf install filebeat-9.5.3

[root@kibana01 ~]# vi /etc/filebeat/filebeat.yml

  protocol: "https"
  ssl.verification_mode: "none"
  username: "elastic"
  password: "yPxxxxxxxxxxxxxxxx1w"

[root@kibana01 ~]# filebeat test config
Config OK

[root@kibana01 ~]# filebeat test output
elasticsearch: https://localhost:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: ::1, 127.0.0.1
    dial up... OK
  TLS...
    security... WARN server's certificate chain verification is disabled
    handshake... OK
    TLS version: TLSv1.3
    dial up... OK
  talk to server... OK
  version: 9.5.3

[root@kibana01 ~]# filebeat setup
Overwriting lifecycle policy is disabled. Set `setup.ilm.overwrite: true` to overwrite.
Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards
Loaded Ingest pipelines
[root@kibana01 ~]#

[root@kibana01 ~]# tail -F /var/log/messages

[root@kibana01 ~]# filebeat modules enable system
Enabled system

[root@kibana01 ~]# vi /etc/filebeat/modules.d/system.yml

[root@kibana01 ~]# filebeat test config
Config OK

# systemctl enable filebeat

# systemctl start filebeat

# systemctl status filebeat