关于ELK

准备工作 1.准备两台虚拟机(我的是centos7系统的) 

      一台是 192.168.18.140

      一台是 192.168.18.141

     2.关闭防火墙 和SELinux

1
2
systemctl stop firewalld
setenforce 0

优化系统

1
2
3
4
5
6
7
vim /etc/security/limits.conf
********************************
*                soft    nproc           65535
*                hard    nproc           65535
*                soft    nofile          65535
*                hard    nofile          65535
********************************

 测试是否优化系统完成 断开连接重新连接一下如下所示 就可以了

1
2
[root@localhost ~]# ulimit -n
65535  

这两台服务器都需要安装jdk环境

1
2
3
4
5
6
7
8
9
10
11
12
13
14
[root@localhost src]# rpm -ivh jdk-8u131-linux-x64_.rpm
准备中...                          ################################# [100%]
正在升级/安装...
   1:jdk1.8.0_131-2000:1.8.0_131-fcs  ################################# [100%]
Unpacking JAR files...
    tools.jar...
    plugin.jar...
    javaws.jar...
    deploy.jar...
    rt.jar...
    jsse.jar...
    charsets.jar...
    localedata.jar...
[root@localhost src]#

140 服务器是ES+kibana

先安装ES(elasticsearch)

1
2
3
4
5
6
7
8
9
10
11
12
13
[root@localhost src]# rpm -ivh elasticsearch-6.6.2.rpm
警告:elasticsearch-6.6.2.rpm: 头V4 RSA/SHA512 Signature, 密钥 ID d88e42b4: NOKEY
准备中...                          ################################# [100%]
Creating elasticsearch group... OK
Creating elasticsearch user... OK
正在升级/安装...
   1:elasticsearch-0:6.6.2-1          ################################# [100%]
### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using systemd
 sudo systemctl daemon-reload
 sudo systemctl enable elasticsearch.service
### You can start elasticsearch service by executing
 sudo systemctl start elasticsearch.service
Created elasticsearch keystore in /etc/elasticsearch<br>

 编辑elasticesarch的配置文件

1
2
3
4
5
vim /etc/elasticsearch/elasticsearch.yml
 
修改以下内容
network.host: 192.168.18.140 //修改为本机IP地址
http.port: 9200<br><br>systemctl restart elasticsearch

开始安装kibana

1
2
3
4
5
rpm -ivh kibana-6.6.2-x86_64.rpm
警告:kibana-6.6.2-x86_64.rpm: 头V4 RSA/SHA512 Signature, 密钥 ID d88e42b4: NOKEY
准备中...                          ################################# [100%]
正在升级/安装...
   1:kibana-6.6.2-1                   ################################# [100%]

  编辑kibana的配置文件

1
2
3
4
5
6
7
8
修改成如下所示就可以了
 
cat /etc/kibana/kibana.yml |grep -v '^#'
*****************************************
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://192.168.18.140:9200"]
*****************************************

重启kibana

sysetmct restart kibana

给予权限

chmod -R 777 /var/log/messages

141 服务器是logstash

安装

1
2
3
4
5
6
7
rpm -ivh logstash-6.6.0.rpm
警告:logstash-6.6.0.rpm: 头V4 RSA/SHA512 Signature, 密钥 ID d88e42b4: NOKEY
准备中...                          ################################# [100%]
正在升级/安装...
   1:logstash-1:6.6.0-1               ################################# [100%]
Using provided startup.options file: /etc/logstash/startup.options
Successfully created system startup script for Logstash

  编写一个收集日志的配置文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
vim /etc/logstash/conf.d/system.conf
*******************************************
input {
        file {
                path => "/var/log/messages"
                type => "system-log"
                start_position => "beginning"
        }
}
output {
        elasticsearch {
                hosts => "192.168.18.140:9200"
                index => "system_log-%{+YYYY.MM.dd}"
        }
}
******************************************* <br>重启服务<br>systemctl restart logstash 

给予权限 

chmod -R 777 /var/log/messages

 执行  这条命令 curl -X GET HTTP://192.168.18.140:9200/_cat/indices?v  如下所示表示成功可以检索   在两台服务器上都执行以下这条命令

1
2
3
health status index                 uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   .kibana_1             JK3lTv0uSw2ewk3_Qvwmww   1   0          2            0      8.6kb          8.6kb
yellow open   system_log-2019.12.08 12ezV-ilT9uIU7if-xIATw   5   1        328            0    189.2kb        189.2kb

 访问kibana的服务器 在浏览器中

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

posted @ 2019-12-09 10:59  速溶咖啡  阅读(267)  评论(0编辑  收藏  举报