elk收集log日志——elk安装

架构

安装elasticsearch

https://www.elastic.co/guide/en/elasticsearch/reference/current/rpm.html

elasticsearch监听9200端口，安装成功，访问如http://12.0.0.1:9200 可以看到对应的结果

配置文件目录

/etc/elasticsearch/

服务启动方式

sudo systemctl start elasticsearch.service
sudo systemctl stop elasticsearch.service

安装kibana

https://www.elastic.co/guide/en/kibana/current/rpm.html

kibana监听5601端口，安装成功，访问http://12.0.0.1:5601 可以看到对应的结果

配置文件目录

/etc/kibana/

服务启动方式

sudo systemctl start kibana.service
sudo systemctl stop kibana.service

不想暴露5601端口，需要做nginx转发

 location / {
    proxy_pass  http://127.0.0.1:5601/; # 转发规则
 }

安装logstash

https://www.elastic.co/guide/en/logstash/current/installing-logstash.html

配置文件目录

/etc/logstash/

服务启动方式

sudo systemctl start logstash.service
sudo systemctl stop logstash.service

安装filebeat

在要抓取的log的服务器上安装filebeat

https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html

配置文件目录

/etc/filebeat/

安装redis

略