ELK日志检索-安装

ELK高可用开源全文检索和分析组件

安装环境:

系统:centos7

IP1:192.168.100.128

IP2:192.168.100.130

组件

JDK

elasticsearch

logstash

kibana

1.安装JDK

2.安装elasticsearch

部署主机: 192.168.100.128

yum -y install elasticsearch-6.6.2.rpm

[root@centos7-1 ~]# cat  /etc/elasticsearch/elasticsearch.yml |grep -v '^#'
cluster.name: sun_jl
node.name: node-1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 192.168.100.128
http.port: 9200

[root@centos7-1 ~]# ll /var/log/elasticsearch/
总用量 84
-rw-r--r--. 1 elasticsearch elasticsearch     0 7月   9 14:19 elasticsearch_access.log
-rw-r--r--. 1 elasticsearch elasticsearch     0 7月   9 14:19 elasticsearch_audit.log
-rw-r--r--. 1 elasticsearch elasticsearch     0 7月   9 14:19 elasticsearch_deprecation.log
-rw-r--r--. 1 elasticsearch elasticsearch     0 7月   9 14:19 elasticsearch_index_indexing_slowlog.log
-rw-r--r--. 1 elasticsearch elasticsearch     0 7月   9 14:19 elasticsearch_index_search_slowlog.log
-rw-r--r--. 1 elasticsearch elasticsearch  9020 7月   9 14:23 elasticsearch.log
-rw-r--r--. 1 elasticsearch elasticsearch 64207 7月   9 14:34 gc.log.0.current
-rw-r--r--. 1 elasticsearch elasticsearch     0 7月   9 14:23 sun_jl_access.log
-rw-r--r--. 1 elasticsearch elasticsearch     0 7月   9 14:23 sun_jl_audit.log
-rw-r--r--. 1 elasticsearch elasticsearch     0 7月   9 14:23 sun_jl_deprecation.log
-rw-r--r--. 1 elasticsearch elasticsearch     0 7月   9 14:23 sun_jl_index_indexing_slowlog.log
-rw-r--r--. 1 elasticsearch elasticsearch     0 7月   9 14:23 sun_jl_index_search_slowlog.log
-rw-r--r--. 1 elasticsearch elasticsearch  7133 7月   9 14:24 sun_jl.log

[root@centos7-1 ~]# netstat -anlp |grep java
tcp6       0      0 192.168.100.128:9300    :::*                    LISTEN      4624/java
tcp6       0      0 192.168.100.128:9200    :::*                    LISTEN      4624/java
unix  2      [ ]         STREAM     CONNECTED     48840    4624/java
unix  2      [ ]         STREAM     CONNECTED     50676    4624/java

3.安装logstash

部署:192.168.100.128

yum -y install logstash-6.6.0.rpm

编辑配置文件

[root@centos7-1 ~]# vim /etc/logstash/conf.d/messages.conf
[root@centos7-1 ~]# cat /etc/logstash/conf.d/messages.conf
input {
        file {
                path => "/var/log/messages"
                type => "messages-log"
                start_position => "beginning"
        }

}

output {
        elasticsearch {
                hosts => "192.168.100.128:9200"
                index => "messages_log-%{+YYYY.MM.dd}"
        }

}

启动与权限

[root@centos7-1 ~]# systemctl start logstash.service
[root@centos7-1 ~]# chmod -R 777 /var/log/
[root@centos7-1 ~]# ll /var/log/logstash/
总用量 4
-rwxrwxrwx. 1 logstash logstash 3783 7月   9 14:47 logstash-plain.log
-rwxrwxrwx. 1 logstash logstash    0 7月   9 14:47 logstash-slowlog-plain.log

4.安装kibana

部署:192.168.100.130

yum -y install kibana-6.6.2-x86_64.rpm

修改配置文件

[root@centos7 ~]# vim /etc/kibana/kibana.yml
[root@centos7 ~]# cat /etc/kibana/kibana.yml |grep -v "^#"|sed '/^$/d'
server.port: 5601
server.host: "192.168.100.130"
elasticsearch.hosts: ["192.168.100.128:9200"]

[root@centos7 ~]# systemctl start kibana
[root@centos7 ~]# netstat -anlp | grep 5601
tcp        0      0 192.168.100.130:5601    0.0.0.0:*               LISTEN      2912/node