WSO2 API Manager与ELK Stack集成失败求助

问题描述 #

尝试将WSO2 API Manager 4.2.0与ELK Stack集成，已按照官方文档操作，但Kibana显示无数据，且apim_metrics.log文件为空，未获取到任何日志或分析数据。

已配置文件 #

Filebeat配置文件 #

filebeat.inputs:
- type: log
  paths:
    - /home/aluno/wso2am-4.2.0/repository/logs/apim_metrics.log
  include_lines: ['(apimMetrics):']

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1

setup.kibana:

output.logstash:
  hosts: ["192.168.56.104:5044"]

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

Logstash配置文件 #

input {
    beats {
        port => 5044
    }
}

filter {
    grok {
        match => ["message", "%{GREEDYDATA:UNWANTED}\ apimMetrics:%{GREEDYDATA:apimMetrics}\, %{GREEDYDATA:UNWANTED} \:%{GREEDYDATA:properties}"]
    }
    json {
        source => "properties"
    }
}
output {
    if [apimMetrics] == " apim:response" {
        elasticsearch {
            hosts => ["http://192.168.56.104:9200"]
            index => "apim_event_response"
            user => "elastic"
            password => "alunowso2"
        }
    } else if [apimMetrics] == " apim:faulty" {
        elasticsearch {
            hosts => ["http://192.168.56.104:9200"]
            index => "apim_event_faulty"
            user => "elastic"
            password => "alunowso2"
        }
    }
}

Kibana配置文件 #

server.port: 5601

server.publicBaseUrl: "http://192.168.56.104:5601"

elasticsearch.username: "kibana_system"
elasticsearch.password: "alunowso2"
  appenders:
    file:
      type: file
      fileName: /var/log/kibana/kibana.log
      layout:
        type: json
  root:
    appenders:
      - default
      - file

Elasticsearch配置文件 #

node.name: wso2-elastic
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch

xpack.security.enabled: true

xpack.security.enrollment.enabled: true

xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/http.p12
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12
http.host: 0.0.0.0

WSO2 APIM Deployment.toml配置 #

[server]
hostname = "wso2.test"
base_path = "${carbon.protocol}://${carbon.host}:${carbon.management.port}"
server_role = "default"

[super_admin]
username = "admin"
password = "admin"
create_admin_account = true

[user_store]
type = "database_unique_id"

[database.apim_db]
type = "h2"
url = "jdbc:h2:./repository/database/WSO2AM_DB;AUTO_SERVER=TRUE;DB_CLOSE_ON_EXIT=FALSE"
username = "wso2carbon"
password = "wso2carbon"

[database.shared_db]
type = "h2"
url = "jdbc:h2:./repository/database/WSO2SHARED_DB;DB_CLOSE_ON_EXIT=FALSE"
username = "wso2carbon"
password = "wso2carbon"

[keystore.tls]
file_name =  "wso2carbon.jks"
type =  "JKS"
password =  "wso2carbon"
alias =  "wso2carbon"
key_password =  "wso2carbon"

[[apim.gateway.environment]]
name = "Default"
type = "hybrid"
provider = "wso2"
display_in_api_console = true
description = "This is a hybrid gateway that handles both production and sandbox token traffic."
show_as_token_endpoint_url = true
service_url = "https://localhost:${mgt.transport.https.port}/services/"
username= "${admin.username}"
password= "${admin.password}"
ws_endpoint = "ws://localhost:9099"
wss_endpoint = "wss://localhost:8099"
http_endpoint = "http://localhost:${http.nio.port}"
https_endpoint = "https://localhost:${https.nio.port}"
websub_event_receiver_http_endpoint = "http://localhost:9021"
websub_event_receiver_https_endpoint = "https://localhost:8021"

[apim.sync_runtime_artifacts.gateway]
gateway_labels =["Default"]

[apim.analytics]
enable = true
type = "elk"

[apim.key_manager]
enable_apikey_subscription_validation = true

[apim.cors]
allow_origins = "*"
allow_methods = ["GET","PUT","POST","DELETE","PATCH","OPTIONS"]
allow_headers = ["authorization","Access-Control-Allow-Origin","Content-Type","SOAPAction","apikey","Internal-Key"]
allow_credentials = false

[[event_handler]]
name="userPostSelfRegistration"
subscriptions=["POST_ADD_USER"]

[service_provider]
sp_name_regex = "^[\\sa-zA-Z0-9._-]*$"

[database.local]
url = "jdbc:h2:./repository/database/WSO2CARBON_DB;DB_CLOSE_ON_EXIT=FALSE"

[[event_listener]]
id = "token_revocation"
type = "org.wso2.carbon.identity.core.handler.AbstractIdentityHandler"
name = "org.wso2.is.notification.ApimOauthEventInterceptor"
order = 1
[event_listener.properties]
notification_endpoint = "https://localhost:${mgt.transport.https.port}/internal/data/v1/notify"
username = "${admin.username}"
password = "${admin.password}"
'header.X-WSO2-KEY-MANAGER' = "default"

[oauth.grant_type.token_exchange]
enable = true
allow_refresh_tokens = true
iat_validity_period = "1h"

[transport.https.properties]
proxyPort = 443

排查解决步骤 #

1. 确保WSO2 APIM生成apim_metrics.log日志 #

apim_metrics.log为空是核心问题，需先让APIM输出该日志：

• 编辑repository/conf/log4j2.xml，添加对应的Appender和Logger：

  <Appender type="RollingFile" name="APIM_METRICS_APPENDER" fileName="${sys:carbon.home}/repository/logs/apim_metrics.log" filePattern="${sys:carbon.home}/repository/logs/apim_metrics-%d{MM-dd-yyyy}.log">
    <PatternLayout pattern="%d{ISO8601} [%X{Correlation-ID}] %5p %c{1} - %m%n"/>
    <Policies>
      <TimeBasedTriggeringPolicy interval="1" modulate="true"/>
    </Policies>
  </Appender>
  <Logger name="apimMetrics" level="INFO" additivity="false">
    <AppenderRef ref="APIM_METRICS_APPENDER"/>
  </Logger>
  

• 重启WSO2 APIM，调用已发布的API（如默认的PizzaShackAPI），再次检查apim_metrics.log是否有内容生成。

2. 验证Filebeat配置与运行状态 #

• 确认filebeat.inputs中的日志路径/home/aluno/wso2am-4.2.0/repository/logs/apim_metrics.log存在，且Filebeat进程有该文件的读取权限。
• 执行filebeat test config验证配置语法是否正确，无报错。
• 执行filebeat test output测试与Logstash的连接是否正常，确保网络可达、端口未被防火墙阻断。
• 查看Filebeat日志（默认路径：/var/log/filebeat/filebeat.log），排查是否有文件读取失败、连接Logstash超时等错误。

3. 修正Logstash配置问题 #

• Elasticsearch连接协议错误：你的Elasticsearch开启了HTTPS，但Logstash输出配置使用http://，需改为https://，并添加SSL配置：
  修改Logstash的output部分：

  elasticsearch {
    hosts => ["https://192.168.56.104:9200"]
    index => "apim_event_response"
    user => "elastic"
    password => "alunowso2"
    ssl => true
    ssl_certificate_verification => false # 测试环境临时关闭，生产环境需配置信任证书
  }
  

• Grok表达式匹配验证：使用logstash -f your-config.conf --config.test_and_exit测试配置语法，或用Grok调试工具验证表达式是否匹配apim_metrics.log的实际日志格式，避免因格式不匹配导致数据丢失。
• 查看Logstash日志（默认路径：/var/log/logstash/logstash-plain.log），检查是否有输入接收异常、过滤解析错误或输出到ES失败的信息。

4. 验证Elasticsearch与Kibana状态 #

• 访问Elasticsearch地址https://192.168.56.104:9200，使用elastic用户登录，确认集群状态为green或yellow。
• 查看Kibana日志（/var/log/kibana/kibana.log），确认Kibana与Elasticsearch连接正常。
• 在Kibana中创建索引模式（匹配apim_event_response*和apim_event_faulty*），确保索引存在后，切换到Discover页面查看数据。

内容的提问来源于stack exchange，提问作者Miguel Angelo