WordPress + ELK 스택으로 Apache 로그 모니터링 구축

목표

WordPress 사이트의 Apache 액세스 로그를 실시간으로 수집하여 Kibana에서 모니터링할 수 있는 시스템 구축

 

사전 준비

• Docker & Docker Compose 설치

• 포트 8081 (WordPress), 5601 (Kibana), 9200 (Elasticsearch), 3306 (MySQL) 사용 가능

1단계: 프로젝트 구조 생성

 

 

mkdir wordpress-elk && cd wordpress-elk

mkdir -p filebeat/logs

 

 

 

2단계: Docker Compose 파일 생성

docker-compose.yml

version: '3.8'

services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.11.0
    container_name: elasticsearch
    environment:
      - discovery.type=single-node
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
      - xpack.security.enabled=false
    ports:
      - "9200:9200"
    networks:
      - elk
    restart: unless-stopped

  kibana:
    image: docker.elastic.co/kibana/kibana:8.11.0
    container_name: kibana
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    ports:
      - "5601:5601"
    networks:
      - elk
    depends_on:
      - elasticsearch
    restart: unless-stopped

  filebeat:
    image: docker.elastic.co/beats/filebeat:8.11.0
    container_name: filebeat
    user: root
    volumes:
      - ./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/log/filebeat:/var/log/filebeat
    networks:
      - elk
    depends_on:
      - elasticsearch
    restart: unless-stopped

  wordpress:
    image: wordpress:latest
    container_name: wordpress
    environment:
      - WORDPRESS_DB_HOST=mysql:3306
      - WORDPRESS_DB_USER=wordpress
      - WORDPRESS_DB_PASSWORD=wordpress
      - WORDPRESS_DB_NAME=wordpress
    ports:
      - "8081:80"
    networks:
      - mysql
      - elk
    depends_on:
      - mysql
      - filebeat
    restart: unless-stopped
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  mysql:
    image: mysql:8.0
    container_name: mysql
    environment:
      - MYSQL_ROOT_PASSWORD=rootpassword
      - MYSQL_DATABASE=wordpress
      - MYSQL_USER=wordpress
      - MYSQL_PASSWORD=wordpress
    ports:
      - "3306:3306"
    networks:
      - mysql
    restart: unless-stopped

networks:
  elk:
    driver: bridge
  mysql:
    driver: bridge

 

3단계: Filebeat 설정 파일 생성

filebeat.yml

filebeat.inputs:
- type: container
  paths:
    - '/var/lib/docker/containers/*/*.log'
  processors:
    - add_docker_metadata:
        host: "unix:///var/run/docker.sock"
    - add_fields:
        fields:
          service: wordpress
    - dissect:
        tokenizer: "%{client_ip} - - [%{timestamp}] \"%{http_method} %{request_path} %{http_version}\" %{response_code} %{response_size} \"%{referer}\" \"%{user_agent}\""
        field: "message"
        target_prefix: "apache"
        when.contains.message: "GET"
    - add_fields:
        fields:
          log_type: apache_access
        when.has_fields: ["apache.client_ip"]

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded

output.elasticsearch:
  hosts: ["elasticsearch:9200"]
  index: "wordpress-logs-%{+yyyy.MM.dd}"

setup.template.name: "wordpress-logs"
setup.template.pattern: "wordpress-logs-*"
setup.template.settings:
  index.number_of_shards: 1
  index.number_of_replicas: 0

logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644

 

4단계: 시스템 시작

 

 

# 컨테이너 시작

docker-compose up -d

 

# 상태 확인

docker ps

 

# 로그 확인 (선택사항)

docker logs filebeat

 

 

 

5단계: WordPress 컨테이너 ID 확인 및 Filebeat 설정 업데이트

 

 

# WordPress 컨테이너 ID 확인

docker inspect wordpress | grep LogPath

 

# filebeat.yml에서 경로 업데이트 (필요시)

# '/var/lib/docker/containers/[CONTAINER_ID]/*.log'

 

# Filebeat 재시작

docker-compose restart filebeat

 

 

 

6단계: 테스트 로그 생성

 

 

# WordPress 사이트 접속하여 로그 생성

curl "http://localhost:8081"

curl "http://localhost:8081/?page_id=2"

curl "http://localhost:8081/?p=1"

 

 

 

7단계: Kibana 설정

1. Kibana 접속: http://localhost:5601
2. Data View 생성:
   1. Stack Management → Data Views → Create data view
   2. Index pattern: wordpress-logs-*
   3. Time field: @timestamp
   4. Create data view
3. Discover에서 로그 확인:
   1. Discover 메뉴에서 wordpress-logs-* 선택
   2. 시간 범위를 "Last 1 hour" 또는 "Today"로 설정
   3. 필드 추가: apache.client_ip, apache.http_method, apache.request_path, apache.response_code

 

8단계: 대시보드 생성 (선택사항)

Visualization 예시:

• 요청 수: X축: @timestamp, Y축: Count

• 상태 코드별 분포: Pie chart, apache.response_code

• 상위 IP: Data table, apache.client_ip

• 상위 페이지: Data table, apache.request_path

 

문제 해결

인덱스가 보이지 않는 경우:

 

 

# Elasticsearch 인덱스 확인

curl "http://localhost:9200/_cat/indices?v"

 

# 문서 수 확인

curl "http://localhost:9200/wordpress-logs-*/_count"

 

 

 

Filebeat 로그 확인:

 

 

docker logs filebeat

 

 

 

WordPress 로그 확인:

 

 

docker logs wordpress --tail 10

 

 

 

수집되는 데이터 구조

 

 

{

  "message": "192.168.65.1 - - [02/Oct/2025:09:24:05 +0000] \"GET /?p=1 HTTP/1.1\" 302 368 \"-\" \"curl/8.7.1\"",

  "apache": {

    "client_ip": "192.168.65.1",

    "http_method": "GET",

    "request_path": "/?p=1",

    "response_code": "302",

    "response_size": "368",

    "timestamp": "02/Oct/2025:09:24:05 +0000",

    "referer": "-",

    "user_agent": "curl/8.7.1"

  },

  "service": "wordpress",

  "log_type": "apache_access",

  "@timestamp": "2025-10-02T09:24:05.768Z"

}

 

 

 

 

핵심 포인트

1. Logstash 제거: 복잡한 파싱 로직 대신 Filebeat의 dissect 프로세서 사용

1. 직접 전송: Filebeat → Elasticsearch 직접 연결로 단순화

1. 자동 파싱: Apache 로그를 구조화된 필드로 자동 분리

1. 실시간 모니터링: WordPress 접속 시 즉시 Kibana에서 확인 가능