单点elk日志分析系统的配置（自我安装详细步骤记录）

一、安装部署 Elasticsearch

1、mkdir /usr/local/elasticsearch
2、wget https://mirrors.huaweicloud.com/elasticsearch/7.8.0/elasticsearch-7.8.0-linux-x86_64.tar.gz
3、tar -zxvf elasticsearch-7.8.0-linux-x86_64.tar.gz -C /usr/local/elasticsearch
4、cd /usr/local/elasticsearch/elasticsearch-7.8.0/
5、cd config
vi elasticsearch.yml

# 修改以下几项：
node.name: node-1 # 设置节点名
path.data: /usr/local/elasticsearch/elasticsearch-7.8.0/data
path.logs: /usr/local/elasticsearch/elasticsearch-7.8.0/logs
network.host: 192.168.146.129 # 允许能连通192.168.146.129的ip访问
http.port: 9200 #设置端口为9200
cluster.initial_master_nodes: ["node-1"] # 设置集群初始主节点

6、adduser es
passwd es
chown -R es /usr/local/elasticsearch
7、su es
cd ..
cd bin
./elasticsearch -d #启动 ElasticSearch （-d 表示在后台启动）

报错：
your Java version from [/usr/local/jdk/jdk1.8.0_281/jre] does not meet this requirement
原因：1.7或1.8版本的JDK与Elasticsearch的要求版本无法对应
解决方案：使用JDK11（之后配置elasticsearch文件）或使用ES内置的jdk
【方法一】jdk11安装包下载：wget https://download.java.net/java/GA/jdk11/13/GPL/openjdk-11.0.1_linux-x64_bin.tar.gz
具体步骤查看CSDN：https://blog.csdn.net/weixin_39643007/article/details/110393759
【方法二】修改elasticsearch-env配置文件
vi elasticsearch-env

修改内容如下（先注释掉之前的配置，再添加）：
# now set the path to java
# 注释掉原来的配置信息
#if [ ! -z "$JAVA_HOME" ]; then
# JAVA="$JAVA_HOME/bin/java"
# JAVA_TYPE="JAVA_HOME"
#else
# if [ "$(uname -s)" = "Darwin" ]; then
# # macOS has a different structure
# JAVA="$ES_HOME/jdk.app/Contents/Home/bin/java"
# else
# JAVA="$ES_HOME/jdk/bin/java"
# fi
# JAVA_TYPE="bundled jdk"
#fi
# 添加新的配置信息
if [ ! -z "$JAVA_HOME" ]; then
JAVA="$ES_HOME/jdk/bin/java"
JAVA_TYPE="JAVA_HOME"
else
if [ "$(uname -s)" = "Darwin" ]; then
# macOS has a different structure
JAVA="$ES_HOME/jdk.app/Contents/Home/bin/java"
else
JAVA="$ES_HOME/jdk/bin/java"
fi
JAVA_TYPE="bundled jdk"
fi

8、采用使用ES内置的jdk来处理报错your Java version from [/usr/local/jdk/jdk1.8.0_281/jre] does not meet this requirement后，
输入./elasticsearch -d后台启动 ElasticSearch。

报错：
ERROR: [3] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]
[2]: max number of threads [3795] for user [es] is too low, increase to at least [4096]
[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
处理方法：
su root
vi /etc/security/limits.conf //[1][2]的处理方法
添加以下内容：
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096

vi /etc/sysctl.conf //[3]的处理方法
添加以下内容：
vm.max_map_count=655360
之后输入sysctl -p

9、su es
./elasticsearch -d

10、su root
firewall-cmd --zone=public --add-port=9200/tcp --permanent
firewall-cmd --reload

11、浏览器输入http://192.168.146.129:9200/得到以下内容：
{
"name" : "node-1",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "MQEnPYDxSfy3L5py9-E4hA",
"version" : {
"number" : "7.8.0",
"build_flavor" : "default",
"build_type" : "tar",
"build_hash" : "757314695644ea9a1dc2fecd26d1a43856725e65",
"build_date" : "2020-06-14T19:35:50.234439Z",
"build_snapshot" : false,
"lucene_version" : "8.5.1",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}

二、安装部署 Kibana

1、mkdir /usr/local/kibana-7.8.0
2、选择和Elasticsearch版本一致的Kibana版本下载。
wget https://mirrors.huaweicloud.com/kibana/7.8.0/kibana-7.8.0-linux-x86_64.tar.gz
3、tar -zxvf kibana-7.8.0-linux-x86_64.tar.gz -C /usr/local/kibana-7.8.0
4、cd /usr/local/kibana-7.8.0/kibana-7.8.0-linux-x86_64
5、修改配置文件
cd config
vi kibana.yml

修改内容如下：
# 服务端口
server.port: 5601
# 服务器ip
server.host: "192.168.146.129"
# Elasticsearch 服务地址
elasticsearch.hosts: ["http://192.168.146.129:9200"]
# 设置语言为中文
i18n.locale: "zh-CN"

6、chown -R es /usr/local/kibana-7.8.0 //给 es 用户授予 kibana 目录的权限
7、firewall-cmd --zone=public --add-port=5601/tcp --permanent
firewall-cmd --reload
8、启动 Kibana
su es
cd ..
cd bin
（1）前台启动
./kibana
（2）后台启动
./kibana &

三、安装部署 Logstash

1、mkdir /usr/local/logstash-7.8.0
2、wget https://mirrors.huaweicloud.com/logstash/7.8.0/logstash-7.8.0.tar.gz
3、tar -zxvf logstash-7.8.0.tar.gz -C /usr/local/logstash-7.8.0
4、cd /usr/local/logstash-7.8.0/logstash-7.8.0
5、新增配置文件
根据原有的 logstash-sample.conf 配置文件复制出一个新的配置文件并修改。
cd config
cp logstash-sample.conf logstash-es.conf

6、修改配置文件
vi logstash-es.conf

修改成如下内容：

input{                   # input输入源配置
beats{           # beats是固定的输入源配置；
port=>5044               # 服务器监听端口5044接收日志，默认ip localhost
}
}
output{                   # output 数据输出配置
elasticsearch{ # 使用elasticsearch接收
hosts=>"http://192.168.146.129:9200" # 集群地址多个用,隔开
index=>"nginx-%{+YYYY-MM-dd}"
}
}

7、chown -R es /usr/local/logstash-7.8.0

8、后台启动Logstash
nohup ./logstash -f /usr/local/logstash-7.8.0/logstash-7.8.0/config/logstash-es.conf &
之后输入tail -f nohup.out

报错1：
Java HotSpot(TM) 64-Bit Server VM warning: INFO: os::commit_memory(0x00000000c5330000, 986513408, 0) failed; error='Cannot allocate memory' (errno=12)
#
# There is insufficient memory for the Java Runtime Environment to continue.
# Native memory allocation (mmap) failed to map 986513408 bytes for committing reserved memory.
# An error report file with more information is saved as:
# /usr/local/logstash-7.8.0/logstash-7.8.0/bin/hs_err_pid64295.log
解决方法：
由于Logstash默认分配jvm空间大小为1g，我的服务器内存不够大，修改jvm空间分配
cd ..
cd config
vi jvm.options
将以下内容
-Xms1g
-Xmx1g
修改为
-Xms128m
-Xmx128m
【如果还是报这个错误，则还修改Elasticsearch安装目录下的config的jvm.options，内容修改与上面一致】

报错2：
Sending Logstash logs to /usr/local/logstash-7.8.0/logstash-7.8.0/logs which is now configured via log4j2.properties
[2022-08-17T22:59:02,479][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2022-08-17T22:59:02,878][FATAL][logstash.runner ] Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting.
[2022-08-17T22:59:02,898][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
原因：之前运行的instance有缓冲，保存在path.data里面有.lock文件，删除掉就可以。
解决办法：
在 logstash.yml 文件中找到 Data path 的路径(默认在安装目录的data目录下）
cd /usr/local/logstash-7.8.0/logstash-7.8.0/data
ls -la
rm -rf .locak

四、安装Filebeat

1、mkdir /usr/local/filebeat-7.8.0
2、wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.8.0-linux-x86_64.tar.gz
3、tar -zxvf filebeat-7.8.0-linux-x86_64.tar.gz -C /usr/local/filebeat-7.8.0
4、cd /usr/local/filebeat-7.8.0/filebeat-7.8.0-linux-x86_64
5、vi filebeat.yml
修改如下内容：
filebeat.inputs:
- type: log
enabled: true
paths:
- /usr/local/webserver/nginx/logs/access.log
#需要确保es用户对这两个log文件有读写功能，且有进入这个文件路径的权限。例：
#chmod 777 /usr/local/webserver/nginx/logs/access.log
#chmod 777 /usr/local/webserver/nginx/logs
#chmod 777 /usr/local/webserver/nginx
#chmod 777 /usr/local/webserver
#chmod 777 /usr/local
#chmod 777 /usr
fields:
systemname: nginx131
fields_under_root: true #自定义字段将为文档中的顶级字段

filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
output.logstash:
enabled: true
hosts: ["192.168.146.129:5044"]
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~

6、chown -R es /usr/local/filebeat-7.8.0
7、./filebeat modules enable logstash //启用和配置 kafka 模块
8、启动 Filebeat
./filebeat setup
（1）前台启动
./filebeat -e
（2）后台启动
./filebeat -c filebeat.yml &

报错： ERROR instance/beat.go:958 Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data).
处理：cd data
ls -la
rm -rf xxx.lock