Build EFK log level monitoring system by hand

How to set up log-level monitoring

  • For log-level monitoring, ELK is currently the most popular, which is the abbreviation of Elasticsearch, Logstash, and Kibana.
    • Logstash: responsible for log collection and formatting
    • Elasticsearch: responsible for log search
    • Kibana: Responsible for displaying logs in the form of graphs
    • Supervisord is responsible for managing and starting the first three processes
  • Later, Filebeat was used to replace Logstash to achieve a better log collection effect and form EFK (Filebeat is based on the original logstash-forwarder source code).
  • At present, the actual combination of Internet companies is the following mode (cluster mode):
    Insert picture description here

download link

Simple construction process

  • 1.0, install Elasticsearch
  • 1.1, Elasticsearch installation problems and solutions
  • 2.0, Kibana
  • 2.1, Kibana installation problems and solutions
  • 3.0, install Filebeat
  • 3.1, Filebeat installation problems and solutions

Detailed construction process

1. Install Elasticsearch

1.1, Elasticsearch installation problems and solutions

问题一:
elasticsearch用户拥有的内存权限太小,至少需要262144
问题二:
Exception in thread "main" java.nio.file.AccessDeniedException: /root/home/searchengine/elasticsearc
问题三:
ERROR: [1] bootstrap checks failed
[1]: the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured

2, Kibana

2.1, Kibana installation problems and solutions

问题一:浏览器输入IP:5601,显示空网页
  • Solution: modify the server.host of the configuration file /usr/local/kibana/config/kibana.yml: "xxxx" is the real ip, do not write localhost.

3. Install Filebeat

3.1, Filebeat installation problems and solutions

Reference blog

Guess you like

Origin blog.csdn.net/ljfirst/article/details/106463545