Connect to Kibana

Prerequisites

Ensure your Container Service for Kubernetes (ACK) cluster has the following components installed. To view installed components, see Manage components.

• csi-provisioner

• CoreDNS

• One of the following Ingress controllers:

  • ALB Ingress Controller

  • MSE Ingress Controller

  • Nginx Ingress Controller

Procedure

1. Create a namespace.

   # Create a namespace.
   kubectl create namespace sls-kibana

2. Create and edit a values.yaml file with the following content. Modify the parameters to match your settings.

   kibana:
     ingressClass: nginx # Modify the value based on the installed Ingress controller.
     # To find this value, go to the Components page of your ACK cluster and search for Ingress.
     # For ALB Ingress Controller, set the value to alb.
     # For MSE Ingress Controller, set the value to mse.
     # For Nginx Ingress Controller, set the value to nginx.
     ingressDomain: # This can be empty. If you want to access Kibana via a domain name, set this value.
     ingressPath: /kibana/ # Required. The subpath used to access Kibana.
     # If ingressDomain is not empty, you can set ingressPath to /.
     #i18nLocale: en # Sets the Kibana language. The default is English (en). To use Chinese, set the value to zh-CN.
   
   elasticsearch:
     password: aStrongPass  # Modify the Elasticsearch password based on your requirements. This is also the Kibana access password for the `elastic` user.
     #diskZoneId: cn-hongkong-c # Specifies the zone where the disk used by Elasticsearch resides. If not set, a zone is automatically selected.
   
   repository:
     region: cn-hangzhou
     # The region where the image is located. Set to cn-hangzhou for regions in mainland China and ap-southeast-1 for regions outside mainland China. The image is pulled over the public network.
   
   #kproxy:
   #  ecsRoleName:  # If you use an ECS instance RAM role for access, specify the role name.
   
   #arch: amd64 # amd64 or arm64. Default is amd64.
   
   sls:
     - project: k8s-log-c5****** # The Simple Log Service project.
       endpoint: cn-huhehaote.log.aliyuncs.com # The endpoint of the Simple Log Service project.
       accessKeyId: The AccessKey ID that has permissions to access Simple Log Service.
       accessKeySecret: The AccessKey secret that has permissions to access Simple Log Service.
     #  alias: etl-logs # Optional. If the project name is too long in Kibana, you can set an alias.
     #  kibanaSpace: default  # Optional. Specifies the space in which to create the index pattern. If the space does not exist, it is automatically created.
     #  logstoreFilters: "*" # Optional. Specifies the Logstores for which index patterns are automatically created. Separate multiple patterns with a comma (,) and enclose the value in double quotation marks ("). Example: "access*,error*".
   
     # To add a second project, use the same format as above.
     #- project: etl-dev2 # The Simple Log Service project.
     #  endpoint: cn-huhehaote.log.aliyuncs.com # The endpoint of the Simple Log Service project.
     #  accessKeyId: The AccessKey ID that has permissions to access Simple Log Service.
     #  accessKeySecret: The AccessKey secret that has permissions to access Simple Log Service.
     #  alias: etl-logs2 # Optional. If the project name is too long in Kibana, you can set an alias.
     #  kibanaSpace: default  # Optional. Specifies the space in which to create the index pattern. If the space does not exist, it is automatically created.
     #  logstoreFilters: "*" # Optional. Specifies the Logstores for which index patterns are automatically created. Separate multiple patterns with a comma (,) and enclose the value in double quotation marks ("). Example: "access*,error*".

   Parameter	Description
   kibana.ingressClass	Specify this parameter based on the Ingress controller that you installed. For details, see Manage components. ALB Ingress Controller: set to alb. MSE Ingress Controller: set to mse. Nginx Ingress Controller: set to nginx.
   kibana.ingressDomain	Optional. The domain name for accessing Kibana. This parameter is required if you want to use a domain name.
   repository.region	The region where the image is located. Set to cn-hangzhou for regions in the Chinese mainland and ap-southeast-1 for regions outside the Chinese mainland. The image is pulled over the public network.
   kibana.ingressPath	The subpath for accessing Kibana. If ingressDomain is not empty, you can set ingressPath to /.
   elasticsearch.password	Modify the Elasticsearch password, which is also the logon password for Kibana. The Elasticsearch account is elastic.
   kproxy.ecsRoleName	The name of the ECS instance RAM role used for access. For details on the required permissions, see RAM authorization.
   sls.project	The name of the Simple Log Service project. For details, see Manage projects.
   sls.endpoint	The endpoint of the project. For details, see Manage projects.
   sls.accessKeyId	The AccessKey ID of the RAM user created in the Prerequisites section. This user must have permission to query data in the Logstore. For details, see RAM authorization.
   sls.accessKeySecret	The AccessKey secret of the RAM user created in the Prerequisites section. This user must have permission to query data in the Logstore. For details, see RAM authorization.
   sls.alias	Optional. If the project name is too long in Kibana, you can set an alias.
   sls.kibanaSpace	Optional. Specifies the space in which to create the index pattern. If the space does not exist, the system creates it automatically.
   sls.logstoreFilters	Optional. Specifies the Logstores for which to automatically create index patterns. Separate multiple patterns with commas and enclose the entire value in double quotation marks. Example: "access*,error*".

3. Run the following command to deploy the services by using Helm.

   helm install sls-kibana https://sls-kproxy.oss-cn-hangzhou.aliyuncs.com/sls-kibana-1.5.7.tgz -f values.yaml --namespace sls-kibana

4. After the deployment is complete, enter http://${ingress address}/kibana/ in your browser to access the Kibana login page. Log in with the username elastic and the password you configured in the values.yaml file.

   http://${ingress address}/kibana/ 

   

Step 1: Deploy Elasticsearch

1. Run the following commands on the server to deploy Elasticsearch.

   sudo docker pull sls-registry.cn-hangzhou.cr.aliyuncs.com/kproxy/elasticsearch:7.17.26
   
   sudo mkdir /data  # The directory where Elasticsearch data is stored. Modify the path based on your requirements.
   sudo chmod 777 /data # Configure permissions.
   
   sudo docker run -d --name es -p 9200:9200 \
              -e "discovery.type=single-node" \
              -e "ES_JAVA_OPTS=-Xms2G -Xmx2G" \
              -e ELASTIC_USERNAME=elastic \
              -e ELASTIC_PASSWORD=passwd \
              -e xpack.security.enabled=true \
              -v /data:/usr/share/elasticsearch/data \
              sls-registry.cn-hangzhou.cr.aliyuncs.com/kproxy/elasticsearch:7.17.26

   Parameter	Description
   ELASTIC_USERNAME	The username to log in to Elasticsearch. This is fixed to elastic.
   ELASTIC_PASSWORD	The password to log in to Elasticsearch. The password must be a string.
   /data	The data storage path for Elasticsearch on the host machine.

2. After the deployment is complete, run the following command to verify that Elasticsearch is running. If you are using a public IP address, you must add a security group rule to the server to allow inbound traffic on port 9200. For details, see Add a security group rule.

   curl http://${IP address of the server where Elasticsearch is deployed}:9200

   A response containing security_exception indicates that Elasticsearch is deployed successfully.

   {"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}

Step 2: Deploy the proxy

When you connect Kibana to Simple Log Service, you can connect to one or more projects. Add the project information when you deploy the proxy.

sudo docker pull sls-registry.cn-hangzhou.cr.aliyuncs.com/kproxy/kproxy:2.1.8

sudo docker run  -d --name proxy \
            -e ES_ENDPOINT=${IP address of the server where Elasticsearch is deployed}:9200 \
            -e SLS_ENDPOINT=https://prjA.cn-guangzhou.log.aliyuncs.com/es/ \
            -e SLS_PROJECT=prjA \
            -e SLS_ACCESS_KEY_ID=${aliyunAccessId} \
            -e SLS_ACCESS_KEY_SECRET=${aliyunAccessKey} \
            -p 9201:9201 \
            -ti sls-registry.cn-hangzhou.cr.aliyuncs.com/kproxy/kproxy:2.1.8

sudo docker pull sls-registry.cn-hangzhou.cr.aliyuncs.com/kproxy/kproxy:2.1.8

sudo docker run  -d --name proxy \
            -e ES_ENDPOINT=${IP address of the server where Elasticsearch is deployed}:9200 \
            -e SLS_ENDPOINT=https://prjA.cn-guangzhou.log.aliyuncs.com/es/ \
            -e SLS_ENDPOINT2=https://prjB.cn-guangzhou.log.aliyuncs.com/es/ \ 
            -e SLS_PROJECT=prjA \
            -e SLS_PROJECT2=prjB \
            -e SLS_ACCESS_KEY_ID=${aliyunAccessId} \ 
            -e SLS_ACCESS_KEY_SECRET=${aliyunAccessKey} \ 
            -e SLS_ACCESS_KEY_ID2=${aliyunAccessId} \ # If the value is the same as SLS_ACCESS_KEY_ID, you do not need to configure this variable.
            -e SLS_ACCESS_KEY_SECRET2=${aliyunAccessKey} \ # If the value is the same as SLS_ACCESS_KEY_SECRET, you do not need to configure this variable.
            -p 9201:9201 \
            -ti sls-registry.cn-hangzhou.cr.aliyuncs.com/kproxy/kproxy:2.1.8

The following table describes the parameters.

After the deployment is complete, run the following command to verify that the proxy is running. If you use a public IP address, you must add a security group rule to the server to allow inbound traffic on port 9201. For details, see Add a security group rule.

curl http://${IP address of the server where the proxy is deployed}:9201

A response containing security_exception indicates that the proxy is deployed successfully.

{"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/]","header":{"WWW-Authenticate":"Basic realm=\"security\" charset=\"UTF-8\""}},"status":401}

Step 3: Deploy Kibana

This example deploys Kibana version 7.17.26.

sudo docker pull  sls-registry.cn-hangzhou.cr.aliyuncs.com/kproxy/kibana:7.17.26

sudo docker run -d --name kibana \
            -e ELASTICSEARCH_HOSTS=http://${IP address of the server where the proxy is deployed}:9201 \
            -e ELASTICSEARCH_USERNAME=elastic \
            -e ELASTICSEARCH_PASSWORD=passwd \
            -e XPACK_MONITORING_UI_CONTAINER_ELASTICSEARCH_ENABLED=true \
            -p 5601:5601 \
            sls-registry.cn-hangzhou.cr.aliyuncs.com/kproxy/kibana:7.17.26

After the deployment is complete, enter http://${IP address of the server where Kibana is deployed}:5601 in your browser to access the Kibana login page. Log in with the username and password that you configured for Elasticsearch in Step 1.

http://${IP address of the server where Kibana is deployed}:5601