📘 Day 31 (2025.07.28.MON) - ST_ELK 생성, Elasticsearch와 Python, 웹 연동
📦 ST_ELK (Ubuntu, 192.168.0.180)
- ▶ Elasticsearch 시작 및 상태 확인
sudo systemctl start elasticsearch
sudo systemctl status elasticsearch - ▶ Elasticsearch 인증 확인
curl -u elastic:123456 http://localhost:9200/_aliases?pretty - ▶ 비밀번호 초기화
./bin/elasticsearch-reset-password -u elastic
📄 ela.py 생성
from elasticsearch import Elasticsearch
es = Elasticsearch(
["http://localhost:9200"],
basic_auth=("elastic", "123456"),
verify_certs=False
)
if es.ping():
print("Elasticsearch 연결 성공!")
else:
print("연결 실패")
📡 데이터 수집
- ELK는 NAT, ST는 브릿지 어댑터 설정
- ST_U240402002 1 → DHCP로 IP 자동 할당 확인
▶ 패킷비트 설치 및 설정
curl -fsSL https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elastic.gpg
echo "deb [signed-by=/usr/share/keyrings/elastic.gpg] https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
sudo apt update
sudo apt install packetbeat
sudo nano /etc/packetbeat/packetbeat.yml
packetbeat.interfaces.device: any
output.elasticsearch:
hosts: ["192.168.0.129:9200"]
username: "elastic"
password: "123456"
sudo systemctl enable packetbeat
sudo systemctl start packetbeat
sudo systemctl status packetbeat
netstat -ant | grep 9200
🖥️ ST_ELK (10.0.2.15)
sudo apt -y install net-tools
netstat -ant | grep 9200
sudo systemctl start elasticsearch
🧩 ST207 (브릿지 어댑터)
/etc/packetbeat/packetbeat.yml 수정 → hosts: ["192.168.0.129:9200"] 로 설정
sudo systemctl restart packetbeat
🌐 SY_ELK (NAT)
sudo nano /etc/elasticsearch/elasticsearch.yml
- network.host: 0.0.0.0
- cluster.initial_master_nodes: ["node-1", "node-2"]
sudo systemctl restart elasticsearch
curl -u elastic:123456 http://localhost:9200/_aliases?pretty
🎯 미션! (ST_ELK)
- 1️⃣ packet.py 만들기 → 패킷 인덱스 확인 프로그램
nano packet.py
chmod 777 packet.py
python3 -m pip install elasticsearch --break-system-packages - 2️⃣ 웹으로 데이터 확인 → Flask + Elasticsearch 연동
🌍 Flask 기반 NMS 구축
- ✅ 가상환경 구축
date
sudo ln -sf /usr/share/zoneinfo/Asia/Seoul /etc/localtime
sudo apt update
sudo apt -y install python3-venv
mkdir -p ~/projects ~/venvs
cd ~/venvs
python3 -m venv mysite
. ~/venvs/mysite/bin/activate - ✅ Flask 설치
pip install flask flask-migrate flask-wtf email_validator flask-markdown
* 참고 *
pip install git+https://github.com/vanzhiganov/flask-markdown.git
cd ~
cd projects
파일 올리기
export FLASK_APP=nms
export FLASK_DEBUG=true
cd ~
cd projects/flask
flask db init
flask db migrate
flask db upgrade
flask run --host=0.0.0.0
* * - ✅ 프로젝트 구성 및 실행
export FLASK_APP=nms export FLASK_DEBUG=true cd ~/projects/flask flask db init && flask db migrate && flask db upgrade flask run --host=0.0.0.0
🛠️ 자동 실행 스크립트 설정
파일: ~/venvs/mysite.sh
cd /home/master/venvs
nano /home/master/venvs/mysite.sh
#!/bin/bash
cd ~/projects/flask
export FLASK_APP=nms
export FLASK_DEBUG=true
export APP_CONFIG_FILE=/home/master/projects/flask/config/production.py
. ~/venvs/myproject/bin/activate
nano /home/master/venvs/mysite.env
FLASK_APP=nms
FLASK_DEBUG=true
APP_CONFIG_FILE=/home/master/projects/flask/config/production.py
alias 등록: nano ~/.profile
alias mysite='export FLASK_APP=nms; export FLASK_DEBUG=true; export APP_CONFIG_FILE=/home/master/projects/flask/config/production.py; cd ~/projects/myproject; . ~/venvs/mysite/bin/activate'
🐘 gunicorn & nginx 연동
pip install gunicorn
* 참고 *
cd ~/projects/mysite
gunicorn --bind 0:5000 "nms:create_app()"
gunicorn --bind unix:/tmp/mysite.sock "nms:create_app()"
* *
sudo apt -y install nginx
cd /etc/systemd/system/
sudo nano mysite.service
[Unit]
Description=gunicorn daemon
After=network.target
[Service]
User=master
Group=master
WorkingDirectory=/home/master/projects/flask
EnvironmentFile=/home/master/venvs/mysite.env
ExecStart=/home/master/venvs/mysite/bin/gunicorn \
--workers 2 \
--bind unix:/tmp/mysite.sock \
"nms:create_app()"
[Install]
WantedBy=multi-user.target
▶ nginx 설정 (/etc/nginx/sites-available/mysite)
* 참고 *
sudo systemctl start mysite.service
sudo systemctl enable mysite.service
sudo apt install nginx(강력한 웹서버-기존엔 apache 사용했음)
* *
sudo nano mysite
server {
listen 80;
server_name 192.168.219.XXX;
location = /favicon.ico { access_log off; log_not_found off; }
location /static {
alias /home/master/projects/flask/nms/static;
}
location / {
include proxy_params;
proxy_pass http://unix:/tmp/mysite.sock;
}
}
cd /etc/nginx/sites-enabled/
sudo rm default
sudo ln -s /etc/nginx/sites-available/mysite
sudo systemctl restart nginx
sudo systemctl enable nginx
sudo systemctl enable mysite
📊 쿼리문 및 NMS 시스템 구축
- 📁 /nms/__init__.py → 블루프린트 설정(블루프린트 = 라우트)
- 📁 /nms/views/main.py → index, intro 연결(intro.html 작동)
- 📁 /nms/views/monitor.py → from hospital → nms로 수정
- 📁 /nms/models.py → from hospital import db → nms로 수정