windows下elk安装配置-elasticsearch/kibana/filebeat
以8.6.2为例，下载地址
elasticsearch：https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.6.2-windows-x86_64.zip
kibana：https://artifacts.elastic.co/downloads/kibana/kibana-8.6.2-windows-x86_64.zip
filebeat：https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-8.6.2-windows-x86_64.zip
分别解压至
D:\Deploy\Elastic\search\8.6.2\
D:\Deploy\Elastic\kibana\8.6.2\
D:\Deploy\Elastic\filebeat\8.6.2\
elasticsearch 安装配置
1.新增环境变量 ElasticSearch 已由 JAVA_HOME 转用 ES_JAVA_HOME。
变量名：ES_JAVA_HOME
变量值：D:\Deploy\Elastic\search\8.6.2\jdk
2.修改配置 D:\Deploy\Elastic\search\8.6.2\bin\elasticsearch-env 8.6.2及以后版本不需要，之前版本未测试
if [ ! -z "$JAVA_HOME" ]; then JAVA="$JAVA_HOME/bin/java" JAVA_TYPE="JAVA_HOME" 改为 if [ ! -z "$ES_JAVA_HOME" ]; then JAVA="$ES_JAVA_HOME/bin/java" JAVA_TYPE="ES_JAVA_HOME"
3.修改配置 D:\Deploy\Elastic\search\8.6.2\config\elasticsearch.yml
#设置快照存储地址 path.repo: ["D:\\Deploy\\Elastic\\search\\8.6.2\\backup"] #数据存放路径（可不设置，默认就是如下地址） path.data: D:/Deploy/Elastic/search/8.6.2/datas #日志存放路径 path.logs: D:/Deploy/Elastic/search/8.6.2/logs #节点名称 node.name: node-1 #节点列表 discovery.seed_hosts: ["127.0.0.1"] #初始化时master节点的选举列表 cluster.initial_master_nodes: ["node-1"] #集群名称 cluster.name: es-main #对外提供服务的端口 http.port: 9200 #内部服务端口 transport.port: 9300 #启动地址，如果不配置，只能本地访问 network.host: 127.0.0.1 #跨域支持 http.cors.enabled: true #跨域访问允许的域名地址 http.cors.allow-origin: "*"
4.修改 JVM 内存（按需） D:\Deploy\Elastic\search\8.6.2\config\jvm.options
#需在将 ElasticSearch 安装为服务前设置，否则安装服务后再改，重启也不会生效。
#-Xms和-Xmx属性值需相同，否则在启动服务的时出错，导致启动 ElasticSearch 服务失败。
#设置最小内存 -Xms2g #设置最大内存 -Xmx2g
# 5.安装 ElasticSearch 服务
sc stop elasticsearch-service-x64 && sc delete elasticsearch-service-x64
cd /D D:\Deploy\Elastic\search\8.6.2\bin && elasticsearch-service.bat install
执行输出如下：
C:\Users\Administrator>cd /D D:\Deploy\Elastic\search\8.6.2\bin && elasticsearch-service.bat install Installing service : elasticsearch-service-x64 Using ES_JAVA_HOME : D:\Deploy\Elastic\search\8.6.2\jdk [2023-04-01 10:48:38] [info] ( prunsrv.c:2002) [30124] Apache Commons Daemon procrun (1.3.1.0 64-bit) started. [2023-04-01 10:48:38] [debug] ( prunsrv.c:772 ) [30124] Installing service... [2023-04-01 10:48:38] [info] ( prunsrv.c:829 ) [30124] Installing service 'elasticsearch-service-x64' name 'Elasticsearch 8.6.2 (elasticsearch-service-x64)'. [2023-04-01 10:48:38] [debug] ( prunsrv.c:857 ) [30124] Setting service description 'Elasticsearch 8.6.2 Windows Service - https://elastic.co'. [2023-04-01 10:48:38] [debug] ( prunsrv.c:862 ) [30124] Setting service user 'LocalSystem'. [2023-04-01 10:48:38] [info] ( prunsrv.c:879 ) [30124] Service 'elasticsearch-service-x64' installed. [2023-04-01 10:48:38] [info] ( prunsrv.c:2086) [30124] Apache Commons Daemon procrun finished. The service 'elasticsearch-service-x64' has been installed
6.启动 ElasticSearch 服务
sc start elasticsearch-service-x64
7.配置 SSL 证书（可选）
7.1.执行命令：cd /D D:\Deploy\Elastic\search\8.6.2\bin && elasticsearch-certutil ca
7.2.输入证书地址：D:\Deploy\Elastic\search\8.6.2\certs\elastic-stack-ca.p12
7.3.输入证书密码：password
#集群证书
7.4.输入证书命令：cd /D D:\Deploy\Elastic\search\8.6.2\bin && elasticsearch-certutil cert --ca D:\Deploy\Elastic\search\8.6.2\certs\elastic-stack-ca.p12
7.5.输入证书密码：password（步骤3设置的密码）
7.6.输入集群证书地址：D:\Deploy\Elastic\search\8.6.2\certs\elastic-stack-ca.p12
7.7.输入集群证书密码：password
7.7.1.1输入命令：cd /D D:\Deploy\Elastic\search\8.6.2\bin && elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
7.7.1.2输入密码：password（步骤7设置的密码）
7.7.2.1输入命令：cd /D D:\Deploy\Elastic\search\8.6.2\bin && elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password
7.7.2.2输入密码：password（步骤7设置的密码）
7.8.将生成的证书拷贝到 D:\Deploy\Elastic\search\8.6.2\config\certs
7.9.在 D:\Deploy\Elastic\search\8.6.2\config\elasticsearch.yml 文件中增加配置：
#开启xpack xpack.security.enabled: true xpack.license.self_generated.type: basic xpack.security.transport.ssl.enabled: true #证书配置 xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.client_authentication: required xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12
8.重启服务
sc stop elasticsearch-service-x64 && sc start elasticsearch-service-x64
9.设置账户密码
执行命令：cd /D D:\Deploy\Elastic\search\8.6.2\bin && elasticsearch-setup-passwords interactive
输入每个账户的密码和确认密码：password
执行输出如下：
D:\Deploy\Elastic\search\8.6.2\bin>cd /D D:\Deploy\Elastic\search\8.6.2\bin && elasticsearch-setup-passwords interactive ****************************************************************************** Note: The 'elasticsearch-setup-passwords' tool has been deprecated. This command will be removed in a future release. ****************************************************************************** Initiating the setup of passwords for reserved users elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user. You will be prompted to enter passwords as the process progresses. Please confirm that you would like to continue [y/N]y Enter password for [elastic]: Reenter password for [elastic]: Enter password for [apm_system]: Reenter password for [apm_system]: Enter password for [kibana_system]: Reenter password for [kibana_system]: Passwords do not match. Try again. Enter password for [kibana_system]: Reenter password for [kibana_system]: Enter password for [logstash_system]: Reenter password for [logstash_system]: Enter password for [beats_system]: Reenter password for [beats_system]: Enter password for [remote_monitoring_user]: Reenter password for [remote_monitoring_user]: Changed password for user [apm_system] Changed password for user [kibana_system] Changed password for user [kibana] Changed password for user [logstash_system] Changed password for user [beats_system] Changed password for user [remote_monitoring_user] Changed password for user [elastic]
10.访问elasticsearch：http://127.0.0.1:9200，输入账户和密码(elastic/password(步骤9设置的密码))，输出如下
{
"name" : "node-1",
"cluster_name" : "es-main",
"cluster_uuid" : "DbPc6HE5Rs6s9isnyO9tJw",
"version" : {
"number" : "8.6.2",
"build_flavor" : "default",
"build_type" : "zip",
"build_hash" : "2d58d0f136141f03239816a4e360a8d17b6d8f29",
"build_date" : "2023-02-13T09:35:20.314882762Z",
"build_snapshot" : false,
"lucene_version" : "9.4.2",
"minimum_wire_compatibility_version" : "7.17.0",
"minimum_index_compatibility_version" : "7.0.0"
},
"tagline" : "You Know, for Search"
}
kibana 安装配置
1.更改配置 D:\Deploy\Elastic\kibana\8.6.2\config\kibana.yml 文件，在文件末尾增加如下配
#设置中文显示 i18n.locale: "zh-CN" #设置访问用户 #elasticsearch.username: "elastic" #用此账号打不开：[FATAL][root] Error: [config validation of [elasticsearch].username]: value of "elastic" is forbidden. This is a superuser account that cannot write to system indices that Kibana needs to function. Use a service account token instead. Learn more: https://www.elastic.co/guide/en/elasticsearch/reference/8.0/service-accounts.html elasticsearch.username: "kibana" #访问时若提示”Kibana 服务器尚未准备就绪。“等会再访问即可 #设置访问密码 elasticsearch.password: "password" #elasticsearch步骤9设置的密码 #ElasticSearch连接地址 elasticsearch.hosts: ["http://127.0.0.1:9200"] #IP访问地址和端口号 server.host: "0.0.0.0" server.port: 5601 #server.publicBaseUrl: "http://127.0.0.1:5601/"
2.安装 kibana 服务(用nssm.exe,路径D:\Deploy\Elastic\kibana\8.6.2\bin\kibana.bat)
sc stop elastic.kibana && sc delete elastic.kibana
cd /D D:\Deploy\tools\nssm-2.2.4\win64 && nssm install elastic.kibana
3.启动 kibana 服务
sc start elastic.kibana
4.访问kibana：http://127.0.0.1:5601，输入账户和密码(elastic/password(elasticsearch步骤9设置的密码))
filebeat 安装配置
1.更改配置filebeat.yml
filebeat.inputs: - type: log enabled: true paths: - D:\Deploy\logs\* #- /var/log/*.log #- c:\programdata\elasticsearch\logs\* output.elasticsearch: hosts: ["127.0.0.1:9200"] username: "beats_system" password: "password" #elasticsearch步骤9设置的密码 #/var/log/*.log：获取/var/log目录下所有以.log结尾的文件。 #/var/log/*/*.log：获取/var/log的子文件夹下所有的以.log结尾的文件。不会从/var/log文件夹本身抓取，不可能递归地抓取指定目录的子目录下文件。
2.直接启动filebeat
cd /d D:\Deploy\Elastic\filebeat\8.6.2 && filebeat -c filebeat.yml -e
3.以服务方式运行：filebeat
sc create elastic.filebeat binpath= "D:\\Deploy\\Elastic\\filebeat\\8.6.2\\filebeat.exe -c D:\\Deploy\\Elastic\\filebeat\\8.6.2\\filebeat.yml -e" start= auto
或sc create elastic.filebeat binpath= ""D:\Deploy\Elastic\filebeat\8.6.2\filebeat.exe" -c "D:\Deploy\Elastic\filebeat\8.6.2\filebeat.yml" -e" start= auto
sc start elastic.filebeat
4.再补张图，filebeat启动后，访问kibana：Analytics-Discover页，日志已经出来了
参考：
https://www.cnblogs.com/qubernet/p/16849818.html
https://www.cnblogs.com/vipsoft/p/14808573.html
