目录
3.1.6、将elasticsearch添加到开机启动... 3
3.1.7、访问elasticsearch rest服务... 3
3.2.1、elasticsearch-plugin命令介绍... 4
3.2.2、安装Elasticsearch-head插件... 5
3.3.2、添加Logstash.repo Yum源... 7
3.4.5、启动Kibana并添加为开机自动启动... 10
一、系统环境配置
[root@localhost ~]# hostnamectl
Static hostname: localhost.localdomain
Transient hostname: localhost
Icon name: computer-vm
Chassis: vm
Machine ID: bc0109238030437780ff3f9a6a48e0df
Boot ID: 69dbc844144f47ffa2f671e9db19d400
Virtualization: vmware
Operating System: CentOS Linux 7 (Core)
CPE OS Name: cpe:/o:centos:centos:7
Kernel: Linux 3.10.0-514.el7.x86_64
Architecture: x86-64
二、安装java JDK
| [root@localhost ~]# yum install java –y [root@localhost ~]# java -version openjdk version "1.8.0_181" OpenJDK Runtime Environment (build 1.8.0_181-b13) OpenJDK 64-Bit Server VM (build 25.181-b13, mixed mode) [root@localhost ~]# |
三、安装ELK
3.1、安装Elasticsearch
https://www.elastic.co/guide/en/elasticsearch/reference/5.6/index.html
https://www.elastic.co/guide/en/elasticsearch/reference/5.6/rpm.html
3.1.1、导入Elasticsearch公钥
# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
3.1.2、创建elasticsearch.repo
# cat /etc/yum.repos.d/elasticsearch.repo
[elasticsearch-5.x]
name=Elasticsearch repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
3.1.3、使用yum安装
# yum install -y elasticsearch
3.1.4、修改elasticsearch配置
$ sudo vim /etc/elasticsearch/elasticsearch.yml
#集群的名称
cluster.name: my-logservice
#节点的名称
node.name: linux-node1
#数据目录的位置
path.data: /var/lib/elasticsearch
#log日志目录的位置
path.logs: /var/log/elasticsearch
#内存设置：锁住内存，不会被放在swap分区上
#注：如果打开可能不会运行此程序
bootstrap.memory_lock: true
#监听的主机，如果多个也可以写成0.0.0.0
network.host: 192.168.0.228
#监听的默认端口
http.port: 9200
| 修改后的文件如下： [root@localhost ~]# grep ^[a-z] /etc/elasticsearch/elasticsearch.yml cluster.name: my-logservice node.name: linux-node1 path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch bootstrap.memory_lock: true network.host: 192.168.1.101 http.port: 9200 |
3.1.5、启动elasticsearch
# systemctl start elasticsearch.service
注意事项
3.1.6、将elasticsearch添加到开机启动
# systemctl enable elasticsearch
3.1.7、访问elasticsearch rest服务
使用http://192.168.1.101:9200/出现如下内容表示elasticsearch安装成功
注：
1、Elasticsearch默认http端口为9200，节点端口为9300
2、Elasticsearch rest服务访问不到则记得查看防火墙配置。
3、Elasticsearch默认安装到/usr/share/elasticsearch目录下
4、Elasticsearch配置文件默认在/etc/elasticsearch/目录下。可以使用rpm -qc命令查看。如下所示：
$ rpm -qc elasticsearch
/etc/elasticsearch/elasticsearch.yml
/etc/elasticsearch/jvm.options
/etc/elasticsearch/log4j2.properties
/etc/elasticsearch/scripts
/etc/init.d/elasticsearch
/etc/sysconfig/elasticsearch
/usr/lib/sysctl.d/elasticsearch.conf
/usr/lib/systemd/system/elasticsearch.service
3.2、安装Elasticsearch插件
https://www.elastic.co/guide/en/elasticsearch/plugins/current/installation.html
3.2.1、elasticsearch-plugin命令介绍
Elasticsearch默认安装在/usr/share/elasticsearch路径下
进入到/usr/share/elasticsearch/bin目录。使用该目录下的elasticsearch-plugin命令管理插件
使用./ elasticsearch-plugin -h命令会列出elasticsearch-plugin命令选项的提示信息
./ elasticsearch-plugin install #安装插件
./ elasticsearch-plugin remove #移除插件
. ./ elasticsearch-plugin list #列出已安装插件列表
这里列出我常用的也是功能最为强大的三款插件
3.2.2、安装Elasticsearch-head插件
3.2.2.1、下载并安装node
# wget https://npm.taobao.org/mirrors/node/v10.8.0/node-v10.8.0.tar.gz
# tar -zxvf node-v10.8.0.tar.gz
# cd node-v10.8.0
# ./configure
# make
# make install
安装grunt
# npm install -g grunt-cli
3.2.2.2、下载Elasticsearch-head
# git clone git://github.com/mobz/elasticsearch-head.git
3.2.2.3、安装Elasticsearch-head
# cd elasticsearch-head
# npm install
前台运行
# npm run start
后台运行
# nohup npm start &
停止程序
# ps -ef | grep npm
# ps -ef | grep node
# kill -9 10532
3.2.2.4、连接到elasticsearch
配置elasticsearch
# vim /etc/elasticsearch/elasticsearch.yml
http.cors.enabled: true
http.cors.allow-origin: "*"
注：添加以上两行内容
配置elasticsearch-head
# cd /root/elasticsearch-head/_site
# vim _site/app.js
# 修改 『http://localhost:9200』字段到本机ES端口与IP
3.2.2.5、访问http://192.168.1.101:9100/
3.2.5、插件列表
https://www.elastic.co/guide/en/elasticsearch/plugins/current/integrations.html
3.3、安装Logstash
https://www.elastic.co/guide/en/logstash/5.6/index.html
3.3.1、导入Logstash公钥
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
3.3.2、添加Logstash.repo Yum源
[root@localhost ~]# cat /etc/yum.repos.d/logstash.repo
[logstash-5.x]
name=Elastic repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
3.3.3、使用yum安装logstash
[root@localhost ~]# yum install logstash
3.3.4、测试logstash是否安装正确
3.3.5、创建第一个配置文件
在/etc/logstash/conf.d目录下创建
[root@localhost conf.d]# cat 01.logstash.conf
input { stdin { } }
output {
elasticsearch { hosts => ["192.168.1.101:9200"] }
stdout { codec => rubydebug }
}
使用logstash –f 运行文件
在Elasticsearch-head下查看是否有数据
3.3.6、配置文件的语法结构
配置文件结构请查看官方文档
https://www.elastic.co/guide/en/logstash/5.6/index.html
https://www.elastic.co/guide/en/logstash/5.6/configuration-file-structure.html
3.4、安装Kibana
https://www.elastic.co/guide/en/kibana/5.6/index.html
3.4.1、导入Kibana公钥
[root@localhost ~]# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
3.4.2、添加Kibana Yum源
[root@localhost ~]# cat /etc/yum.repos.d/kibana.repo
[kibana-5.x]
name=Kibana repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
3.4.3、使用yum安装Kibana
[root@localhost ~]# yum install kibana
注：
1、Kibana默认端口为5601
2、kibana默认安装在/opt/kibana目录下
3、Kibana配置文件路径为/opt/kibana/config/kibana.yml
$ rpm -qc kibana
/opt/kibana/config/kibana.yml
3.4.4、修改Kibana配置
[root@localhost ~]#vim /etc/kibana/kibana.yml
#监听的端口
server.port: 5601
#监听的ip地址
server.host: "0.0.0.0"
# elasticsearch的网络地址
elasticsearch.url: http://192.168.1.101:9200
# kibana的数据索引
kibana.index: ".kibana"
3.4.5、启动Kibana并添加为开机自动启动
[root@localhost ~]# systemctl start kibana.service
设为开机自动启动
[root@localhost ~]# systemctl enable kibana.service
3.4.6、通过Web访问kibana
3.4.7、配置Kibana
3.4.7.1、创建索引
