EFK log structures

Install java

Java1.8 or later installed and verified

[root@localhost ~]# yum install java
[root@localhost ~]# java -version
openjdk version "1.8.0_222"
OpenJDK Runtime Environment (build 1.8.0_222-b10)
OpenJDK 64-Bit Server VM (build 25.222-b10, mixed mode)

Installation Elasticsearch

Installation Elasticsearch (Elasticsearch, Kibana, FileBeat best version of the same)

[root @ localhost ~] # wget HTTPS: // artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.2.4.tar.gz 
[root @ localhost ~] # tar -zxvf elasticsearch- 6.2 . 4 . tar .gz 
[the root @ localhost ~] # Music Videos elasticsearch-6.2.4 /usr/local/elasticsearch-6.2.4
[the root @ localhost ~] # CD /usr/local/elasticsearch-6.2.4 [the root @ localhost
~] # VI config / elasticsearch.yml network.host: 0.0 . 0.0 http.port: 9200 # elasticsearch Because there can not be run directly by the root user, so to create a new user [root @ localhost ~]# adduser fengzi [root@localhost ~]# passwd fengzi [root@localhost ~]# chmod -R 777 /usr/local/elasticsearch-6.2.4 [root@localhost ~]# su fengzi

#启动elasticsearch
[root@localhost ~]# ./bin/elasticsearch

If the service does not start up, the following is a solution

Add the following rows # 4 SUMMARY 
[root @ localhost local] # Vim / etc / Security / the limits.conf
         * Soft nofile 65536 
        * Hard nofile 65536 
        eFK the nproc Soft 8192 
        eFK Hard the nproc 8192             

# modified into the following 
[root @ localhost local] # Vim /etc/security/limits.d/ 20 is - nproc.conf
         * Soft the nproc     4096 
        the root Soft Unlimited the nproc     

# Add the following line 
[the root @ localhost local] # Vim / etc / the sysctl.conf 
        vm.max_map_count = 655360 
[the root @ localhost local] # sysctl -the p- 
# look at the 9200 and 9300 ports have not enabled 
[root @ localhost local] # SS - TNL 
State Recv -Q SEND- Q Local Address: Port Peer Address: Port               
LISTEN       0       128                              *: 22                                           *: *                   
LISTEN       0       100                      127.0 . 0.1 : 25                                           *: *                 
LISTEN       0       80                              ::: 3306                                        ::: *                  
LISTEN      0      128                            :::9200                                       :::*                  
LISTEN      0      128                            :::9300                                       :::*                  
LISTEN      0      128                            :::22                                         :::*                  
LISTEN      0      100                           ::1:25                                         :::*                  

 

AnSo Kibana

[root @ localhost local] # wget HTTPS: // artifacts.elastic.co/downloads/kibana/kibana-6.2.4-linux-x86_64.tar.gz 
[root @ localhost local] # tar -zxvf kibana- 6.2 . 4 . -linux-x86_64 tar .gz 
[root @ localhost local] # vi config / kibana.yml 
        elasticsearch.url: " http://0.0.0.0:9200 " 
        server.host: " 0.0.0.0 " 
        kibana.index: " .kibana " 
# start kibana service 
[root @ localhost local] #.
/ bin / kibana

# 5601 to view the port has not started [root@localhost local]# ss
-tnl State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 *:22 *:* LISTEN 0 100 127.0.0.1:25 *:* LISTEN 0 128 *:5601 *:* LISTEN 0 80 :::3306 :::* LISTEN 0 128 :::9200 :::* LISTEN 0 128 :::9300 :::* LISTEN 0 128 :::22 :::* LISTEN 0 100 ::1:25 :::*

Installation FileBeat

[root@localhost local]# wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.2.4-linux-x86_64.tar.gz
[root@localhost local]# tar -zxvf filebeat-6.2.4-linux-x86_64.tar.gz
[root@localhost local]# vi filebeat.yml
        enabled: true
[root@localhost local]# ./filebeat -c filebeat.yml

 

Placed Kibana

 

 

 

 

 

Guess you like

Origin www.cnblogs.com/fengzi7314/p/11462714.html
efk