ELKStack Introduction
to the log, the most common requirement is to collect, store, query, display, exactly corresponding to the open source community open source projects: logstash (collect), elasticsearch (store + search), kibana (show), we bring combining three technologies called ELKStack, so that means that a ELKStack elasticsearch, Logstash, Kibana technology stack, a common architecture as shown below:
elasticsearch (+ storing search)
logstash (collection)
kibana (show)
installed JDK
[root@linux-node1 ~]# yum install -y java
[root@linux-node1 ~]# java -version
openjdk version "1.8.0_65"
OpenJDK Runtime Environment (build 1.8.0_65-b17)
OpenJDK 64-Bit Server VM (build 25.65-b01, mixed mode)
YUM to install ElasticSearch
1. Key download and install the GPG
[@ Hadoop the root-node1 ~] # RPM --import [URL] https://packages.elastic.co/GPG-KEY-elasticsearch[/url]
2.添加yum仓库
[root@hadoop-node1 ~]# vim /etc/yum.repos.d/elasticsearch.repo
[elasticsearch-2.x]
name=Elasticsearch repository for 2.x packages
baseurl=http://packages.elastic.co/elasticsearch/2.x/centos
gpgcheck=1
gpgkey=http://packages.elastic.co/GPG-KEY-elasticsearch
enabled=1
3.安装elasticsearch
[root@hadoop-node1 ~]# yum install -y elasticsearch
LogStash deployment and configuration
and Elasticsearch as before beginning to deploy LogStash also need JDK your environment properly installed. You can download and install Oracle JDK or use the yum install openjdk.
安装JDK
[root@linux-node1 ~]# yum install -y java
[root@linux-node1 ~]# java -version
openjdk version “1.8.0_65”
OpenJDK Runtime Environment (build 1.8.0_65-b17)
OpenJDK 64-Bit Server VM (build 25.65-b01, mixed mode)
YUM deployment LogStash
1.下载并安装GPG key
[root@linux-node2 ~]# rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch
2.添加yum仓库
[root@linux-node2 ~]# vim /etc/yum.repos.d/logstash.repo
[logstash-2.3]
name=Logstash repository for 2.3.x packages
baseurl=https://packages.elastic.co/logstash/2.3/centos
gpgcheck=1
gpgkey=https://packages.elastic.co/GPG-KEY-elasticsearch
enabled=1
3.安装logstash
[root@linux-node2 ~]# yum install -y logstash
Kibana About
Kibana is open source analysis and visualization platform for Elasticsearch design. You can use Kibana to search for, view the data stored in the Elasticsearch index and interact. You can easily implement advanced data analysis and visualization, to show up in the form of a chart.
Yum mounting Kibana
1. Key to download and install the GPG
[node2 the root-Linux @ ~] # RPM --import https://packages.elastic.co/GPG-KEY-elasticsearch
2. Add yum repository
[root @ test ~] # /etc/yum.repos.d/kibana.repo Vim
[kibana 4.5 of 5-]
name = Kibana Repository Packages for 4.5.x
BaseURL = HTTP: //packages.elastic.co/kibana/4.5/centos
gpgcheck. 1 =
gpgkey HTTP = : //packages.elastic.co/GPG-KEY-elasticsearch
Enabled. 1 =
3.安装kibana
[root@test ~]# yum install -y kibana
使用Cobbler创建ELKStack仓库
当然生产环境，肯定不能使用外网的YUM仓库，可以使用Cobbler来创建自己的yum仓库。
[root@log-node1 ~]# cobbler repo add --name=logstash-2.3 --mirror=http://packages.elastic.co/logstash/2.3/centos --arch=x86_64 --breed=yum
[root@log-node1 ~]# cobbler repo add --name=elasticsearch2 --mirror=http://packages.elastic.co/elasticsearch/2.x/centos --arch=x86_64 --breed=yum
[root@log-node1 ~]# cobbler repo add --name=kibana4.5 --mirror=http://packages.elastic.co/kibana/4.5/centos --arch=x86_64 --breed=yum
[root@log-node1 ~]# cobbler reposync
Modify the configuration file
vim /etc/elasticsearch/elasticsearch.yml
cluster.name: myes #子节点与master同步此配置
node.name: node-2
path.data: /data/es-data
path.logs: /var/logelasticsearch
bootstrap.memory_lock: true
network.host: 192.168.0.202
http.port: 9200
mkdir -p /data/es-data
chown -R elasticsearch:elasticsearch /data/es-data
**启动程序**
/etc/init.d/elasticsearch start
# Mounting head plug
/ usr / Share / elasticsearch / bin / mobz the install plugin / elasticsearch-head
/ usr / Share / elasticsearch / bin / lmenezes the install plugin / elasticsearch a Kopf #-monitoring plug
http://192.168.0.201:9200/_plugin / head /
http://192.168.0.201:9200/_plugin/kopf/#!/cluster
Unicast pattern recognition master node needs to change the configuration file
Vim /etc/elasticsearch/elasticsearch.yml
discovery.zen.ping.unicast.hosts: [ "192.168.0.201", "192.168.0.202"]