[root@node1 ~]# vim /etc/hosts //配置解析名
192.168.80.128 node1
192.168.80.129 node2
[root@node1 ~]# java -version //查看是Java是否安装
[root@node1 ~]# mount.cifs //192.168.80.2/LNMP-C7 /mnt/
Password for root@//192.168.80.2/LNMP-C7:
[root@node1 mnt]# cd /mnt/elk/
[root@node1 elk]# rpm -ivh elasticsearch-5.5.0.rpm //安装
[root@node1 elk]# systemctl daemon-reload //重载守护进程
[root@node1 elk]# systemctl enable elasticsearch.service //开机自动启动
[root@node1 elk]# cd /etc/elasticsearch/
[root@node1 elasticsearch]# cp elasticsearch.yml elasticsearch.yml.bak //备份
[root@node1 elasticsearch]# vim elasticsearch.yml //修改配置文件
cluster.name: my-elk-cluster //集群名
node.name: node1 //节点名，第二个节点为node2
path.data: /data/elk_data //数据存放位置
path.logs: /var/log/elasticsearch/ //日志存放位置
bootstrap.memory_lock: false //不在启动时锁定内存
network.host: 0.0.0.0 //提供服务绑定的IP地址，为所有地址
http.port: 9200 ##端口号为9200
discovery.zen.ping.unicast.hosts: ["node1", "node2"] //集群发现通过单播实现
[root@node1 elasticsearch]# mkdir -p /data/elk_data //创建数据存放点
[root@node1 elasticsearch]# chown elasticsearch.elasticsearch /data/elk_data/ //给权限
[root@node1 elasticsearch]# systemctl start elasticsearch.service //开启服务
[root@node1 elasticsearch]# netstat -ntap | grep 9200 //查看开启情况
tcp6 0 0 :::9200 :::* LISTEN 2166/java
[root@node1 elasticsearch]# yum install gcc gcc-c++ make -y //安装编译工具
[root@node1 elasticsearch]# cd /mnt/elk/
[root@node1 elk]# tar zxvf node-v8.2.1.tar.gz -C /opt/ //解压插件
[root@node1 elk]# cd /opt/node-v8.2.1/
[root@node1 node-v8.2.1]# ./configure //配置
[root@node1 node-v8.2.1]# make && make install //编译安装[root@node1 elk]# tar jxvf phantomjs-2.1.1-linux-x86_64.tar.bz2 -C /usr/local/src/ //解压到/usr/local/src下
[root@node1 elk]# cd /usr/local/src/phantomjs-2.1.1-linux-x86_64/bin/
[root@node1 bin]# cp phantomjs /usr/local/bin/ //编译系统识别[root@node1 bin]# cd /mnt/elk/
[root@node1 elk]# tar zxvf elasticsearch-head.tar.gz -C /usr/local/src/ //解压
[root@node1 elk]# cd /usr/local/src/elasticsearch-head/
[root@node1 elasticsearch-head]# npm install //安装[root@node1 elasticsearch-head]# vim /etc/elasticsearch/elasticsearch.yml //末行加入
http.cors.enabled: true //开启跨域访问支持，默认为false
http.cors.allow-origin: "*" //跨域访问允许的域名地址
[root@node1 elasticsearch-head]# systemctl restart elasticsearch.service //重启
[root@node1 elasticsearch-head]# cd /usr/local/src/elasticsearch-head/
[root@node1 elasticsearch-head]# npm run start & //后台运行数据可视化服务
[1] 82515
[root@node1 elasticsearch-head]# netstat -ntap | grep 9100
tcp 0 0 0.0.0.0:9100 0.0.0.0:* LISTEN 82525/grunt
[root@node1 elasticsearch-head]# netstat -ntap | grep 9200
tcp6 0 0 :::9200 :::* LISTEN 82981/java
[root@node2 ~]# curl -XPUT 'localhost:9200/index-demo/test/1?pretty&pretty' -H 'content-Type: application/json' -d '{"user":"zhangsan","mesg":"hello world"}'
[root@apache ~]# yum install httpd -y //安装服务
[root@apache ~]# systemctl start httpd.service //启动服务
[root@apache ~]# java -version
[root@apache ~]# mount.cifs //192.168.100.8/LNMP-C7 /mnt/ //挂载
Password for root@//192.168.100.8/LNMP-C7:
[root@apache ~]# cd /mnt/elk/
[root@apache elk]# rpm -ivh logstash-5.5.1.rpm //安装logstash
[root@apache elk]# systemctl start logstash.service
[root@apache elk]# systemctl enable logstash.service //设置开机自启
[root@apache elk]# ln -s /usr/share/logstash/bin/logstash /usr/local/bin/ //便于系统识别
[root@apache elk]# logstash -e 'input { stdin{} } output { stdout{} }' //标准输入输出
The stdin plugin is now waiting for input:
16:58:11.145 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9600}
www.baidu.com //输入
2019-12-19T08:58:35.707Z apache www.baidu.com
www.sina.com.cn //输入
2019-12-19T08:58:42.092Z apache www.sina.com.cn
[root@apache elk]# logstash -e 'input { stdin{} } output { stdout{ codec=>rubydebug } }' //使用rubydebug显示详细输出，codec为一种编解码器
The stdin plugin is now waiting for input:
17:03:08.226 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9600}
www.baidu.com //格式化的处理
{
"@timestamp" => 2019-12-19T09:03:80.267Z,
"@version" => "1",
"host" => "apache",
"message" => "www.baidu.com"
}
[root@apache elk]# logstash -e 'input { stdin{} } output { elasticsearch { hosts=>["192.168.80.129:9200"] } }'
##使用logstach将信息写入elasticsearch中
The stdin plugin is now waiting for input:
17:06:46.846 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9600}
www.baidu.com //输入信息
www.sina.com.cn
[root@apache elk]# chmod o+r /var/log/messages //给其他用户读权限
[root@apache elk]# vim /etc/logstash/conf.d/system.conf //创建文件
input {
file{
path => "/var/log/messages" //输出目录
type => "system"
start_position => "beginning"
}
}
output {
elasticsearch {
#输入地址指向node1节点
hosts => ["192.168.80.129:9200"]
index => "system-%{+YYYY.MM.dd}"
}
}
[root@apache elk]# systemctl restart logstash.service //重启服务
[root@node1 ~]# cd /mnt/elk/
[root@node1 elk]# rpm -ivh kibana-5.5.1-x86_64.rpm //安装
[root@node1 elk]# cd /etc/kibana/
[root@node1 kibana]# cp kibana.yml kibana.yml.bak //备份
[root@node1 kibana]# vim kibana.yml //修改配置文件
server.port: 5601 //端口号
server.host: "0.0.0.0" //监听任意网段
elasticsearch.url: "http://192.168.80.129:9200" //本机节点地址
kibana.index: ".kibana" //索引名称
[root@node1 kibana]# systemctl start kibana.service //开启服务
[root@node1 kibana]# systemctl enable kibana.service
[root@apache elk]# vim /etc/logstash/conf.d/apache_log.conf //创建配置文件
input {
file{
path => "/etc/httpd/logs/access_log" //输入信息
type => "access"
start_position => "beginning"
}
file{
path => "/etc/httpd/logs/error_log"
type => "error"
start_position => "beginning"
}
}
output {
if [type] == "access" { //根据条件判断输出信息
elasticsearch {
hosts => ["192.168.80.129:9200"]
index => "apache_access-%{+YYYY.MM.dd}"
}
}
if [type] == "error" {
elasticsearch {
hosts => ["192.168.80.129:9200"]
index => "apache_error-%{+YYYY.MM.dd}"
}
}
}
[root@apache elk]# logstash -f /etc/logstash/conf.d/apache_log.conf //根据配置文件配置logstach
另外有需要云服务器可以了解下创新互联cdcxhl.cn，海内外云服务器15元起步，三天无理由+7*72小时售后在线，公司持有idc许可证，提供“云服务器、裸金属服务器、高防服务器、香港服务器、美国服务器、虚拟主机、免备案服务器”等云主机租用服务以及企业上云的综合解决方案，具有“安全稳定、简单易用、服务可用性高、性价比高”等特点与优势，专为企业上云打造定制，能够满足用户丰富、多元化的应用场景需求。
