Ubuntu22.04 AWS EC2 t3.large部署ELK+Filebeat时Filebeat启动失败求助

环境信息 #

• AWS EC2 t3.large实例
• Ubuntu 22.04系统
• ELK Stack版本：8.9.0（Elasticsearch、Kibana、Logstash）+ Filebeat 8.9.0
• 安全组已开放端口：9200、5601、5044

错误日志 #

Aug 12 06:59:12 ip-172-31-25-190 systemd[1]: filebeat.service: Start request repeated too quickly.
Aug 12 06:59:12 ip-172-31-25-190 systemd[1]: filebeat.service: Failed with result 'exit-code'.
Aug 12 06:59:12 ip-172-31-25-190 systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..

部署流程 #

1. 基础环境与Elasticsearch安装 #

sudo apt update
sudo apt upgrade
sudo apt install openjdk-11-jdk

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.9.0-amd64.deb
sudo dpkg -i elasticsearch-8.9.0-amd64.deb

修改/etc/elasticsearch/elasticsearch.yml：

network.host: localhost
http.port: 9200
xpack.security.enabled: false
xpack.security.enrollment.enabled: false

启动并设置开机自启：

sudo systemctl start elasticsearch
sudo systemctl enable elasticsearch
curl -X GET "localhost:9200"

2. Kibana安装 #

wget https://artifacts.elastic.co/downloads/kibana/kibana-8.9.0-amd64.deb
sudo dpkg -i kibana-8.9.0-amd64.deb

修改/etc/kibana/kibana.yml：

server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://localhost:9200"]

设置Nginx认证：

echo "kibanaadmin:`openssl passwd -apr1`" | sudo tee -a /etc/nginx/htpasswd.users

3. Logstash安装 #

wget https://artifacts.elastic.co/downloads/logstash/logstash-8.9.0-amd64.deb
sudo dpkg -i logstash-8.9.0-amd64.deb

创建输入配置/etc/logstash/conf.d/02-beats-input.conf：

input {
  beats {
    port => 5044
  }
}

创建输出配置/etc/logstash/conf.d/30-elasticsearch-output.conf：

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => ["localhost:9200"]
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
      pipeline => "%{[@metadata][pipeline]}"
    }
  } else {
    elasticsearch {
      hosts => ["localhost:9200"]
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    }
  }
}

验证配置并启动：

sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t
sudo systemctl start logstash
sudo systemctl enable logstash

4. Filebeat安装与配置 #

wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-8.9.0-amd64.deb
sudo dpkg -i filebeat-8.9.0-amd64.deb

修改/etc/filebeat/filebeat.yml：

#output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["localhost:9200"]

output.logstash:
  hosts: ["localhost:5044"]

启用系统模块并执行初始化：

sudo filebeat modules enable system
sudo filebeat setup --pipelines --modules system
sudo filebeat setup --index-management -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]'
sudo filebeat setup -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]' -E setup.kibana.host=localhost:5601

尝试启动失败：

sudo systemctl start filebeat
sudo systemctl enable filebeat

验证索引命令：

curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty'

已尝试的调整 #

• JDK版本：从openjdk-19更换为openjdk-11
• 实例规格：从t3.medium升级为t3.large
• Logstash配置替换为简化版：

input {
  beats {
    port => 5044
  }
}
 
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    manage_template => false
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
  }
}

排查与解决建议 #

1. 获取Filebeat详细错误日志 #

系统日志仅提示启动失败，需查看Filebeat自身日志定位具体问题：

sudo tail -n 50 /var/log/filebeat/filebeat.log
# 或前台运行实时查看错误
sudo filebeat -e -c /etc/filebeat/filebeat.yml

2. 验证Logstash端口监听状态 #

Filebeat无法连接Logstash是常见故障点，确认5044端口是否被监听：

sudo ss -tulpn | grep 5044

若无输出，重新检查Logstash配置并重启：

sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t
sudo systemctl restart logstash

3. 检查Filebeat配置合法性 #

确保filebeat.yml语法无错误：

sudo filebeat test config -c /etc/filebeat/filebeat.yml
# 测试与Logstash的连接
sudo filebeat test output -c /etc/filebeat/filebeat.yml

4. 确认Elasticsearch初始化状态 #

Filebeat初始化阶段依赖Elasticsearch，先确认服务正常：

curl -X GET "localhost:9200"
# 检查是否已创建Filebeat索引
curl -XGET 'http://localhost:9200/_cat/indices?v' | grep filebeat

5. 权限排查 #

确保Filebeat对系统日志目录有读取权限：

sudo ls -l /var/log/syslog
# 添加filebeat用户到adm组（Ubuntu默认日志组）
sudo usermod -aG adm filebeat

6. 系统资源检查 #

确认实例资源是否充足：

free -h
df -h
top

内容的提问来源于stack exchange，提问作者Ansh Tyagi