ELK安装(ubuntu)

Posted 2021-01-18 geek power

一.安装jdk8

经过我测试logstash5.x不支持java10和11，所以安装java8

 

加入LinuxUprising Java PPA

sudo add-apt-repository ppa:webupd8team/java

sudo apt-get update

 

安装java8(Long Term Support)

sudo apt-get install oracle-java8-installer

查看java是否安装成功

java -version

 

设置java11为默认

sudo apt-get install oracle-java8-set-default

 

二.新建用户

因为安全问题elasticsearch 不让用root用户直接运行，创建新用户

adduser elk 输入两次密码

passwd elk 输入两次密码

root给elk赋权限，chown -R elk /opt/elasticsearch-5.6.11

 

三.安装elastcisearch

卸载elastcisearch

sudo systemctl stop elasticsearch

sudo apt-get --purge autoremove elasticsearch

rm -rf /var/lib/elasticsearch

rm -rf /etc/elasticsearch

 

安装

由于目前IK Analysis插件5.x的最高版本为5.6.11，所以elk我们也安装5.6.11

wget -P /opt/downloads https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.6.11.tar.gz

sudo tar zxvf /opt/downloads/elasticsearch-5.6.11.tar.gz -C /opt

 

进入配置文件

sudo vim /opt/elasticsearch-5.6.11/config/elasticsearch.yml

修改network.host的值

network.host: 192.168.x.x 自身ip，限制为内网访问

network.host: 0.0.0.0 也可以不限制ip

http.port: 9200

 

删除lock

rm -rf /opt/elasticsearch-5.6.11/data/nodes/0/node.lock

切换到elk用户，守护进程启动es

su - elk -c "/opt/elasticsearch-5.6.11/bin/elasticsearch -d"

 

若启动不成功，日志文件报max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

sudo sysctl -w vm.max_map_count=262144

查看是否修改成功

more /proc/sys/vm/max_map_count

再启动es即可

 

测试es是否正常运行

curl -X GET http://127.0.0.1:9200

 

关闭代码为

jps|grep Elasticsearch

显示 xxxx Elasticsearch

kill -9 xxxx

 

 

 

四、安装Logstash

卸载deb版本的logstash

sudo systemctl stop logstash

dpkg -P logstash或sudo apt-get --purge autoremove logstash

rm -rf /usr/share/logstash

rm -rf /var/lib/logstash

rm -rf /var/log/logstash

 

安装

wget -P /opt/downloads https://artifacts.elastic.co/downloads/logstash/logstash-5.6.11.tar.gz

sudo tar zxvf /opt/downloads/logstash-5.6.11.tar.gz -C /opt

错误提示：Unrecognized VM option ‘UseParNewGC‘ 

解决办法：把/opt/logstash/config/jvm.options配置文件中的-XX:UseParNewGC注释掉

错误提示：could not create the java virtual machine或找不到主类

解决办法：把/opt/logstash/bin/logstash.bat中%CLASSPATH%没有加双引号的都加上双引号。

 

修改数据文件夹读写权限：

sudo chmod 777 /opt/logstash-5.6.11/data

 

测试是否成功启动

/opt/logstash-5.6.11/bin/logstash -e ‘input{stdin{}}output{stdout{codec=>rubydebug}}‘

 

修改配置

略

 

启动

cd /opt/elasticsearch-head

nohup npm run start &

 

五、安装Kibana

卸载deb版本的kibana

sudo systemctl stop kibana

dpkg -P kibana或sudo apt-get --purge autoremove kibana

rm -rf /var/lib/kibana

 

安装

wget -P /opt/downloads https://artifacts.elastic.co/downloads/kibana/kibana-5.6.11-linux-x86_64.tar.gz

sudo tar zxvf /opt/downloads/kibana-5.6.11-linux-x86_64.tar.gz -C /opt

 

修改配置

vim /opt/kibana-5.6.11-linux-x86_64/config/kibana.yml

#配置本机ip

server.host: "0.0.0.0"

#配置es集群url

elasticsearch.url: "http://localhost:9200"

 

后台启动kibana

nohup /opt/kibana-5.6.11-linux-x86_64/bin/kibana &

然后按任意键返回到shell

 

关闭

netstat -anltp|grep 5601

显示LISTEN xxxx/java

kill -9 xxxx

 

六、安装Elasticsearch-head

cd /opt

git clone git://github.com/mobz/elasticsearch-head.git

 

修改配置

vim /opt/elasticsearch-head/_site/app.js

this.base_uri = this.config.base_uri || this.prefs.get("app-base_uri") || "http://localhost:9200";修改为当前es地址，默认es在本机localhost:9200不用修改

vim /opt/elasticsearch-head/Gruntfile.js

在原有的connect:server:options节点上加上hostname: ‘*‘,

 

修改es配置

sudo vim /opt/elasticsearch-5.6.11/config/elasticsearch.yml

network.host: 0.0.0.0

http.cors.enabled: true

http.cors.allow-origin: "*"

 

安装node

sudo apt-get install nodejs

安装npm

sudo apt-get install npm

安装grunt和grunt-cli

sudo npm install -g grunt

sudo npm install -g grunt-cli

安装模块依赖

sudo npm install

 

后台启动head

cd /opt/elasticsearch-head

nohup npm run start &

按任意键回车退回到shell

 

客户端浏览器打开x.x.x.x:9100

若显示未连接修改http://localhost:9200为es服务器ip:port

 

关闭

netstat -anltp|grep 9100

显示LISTEN xxxx/grunt

kill -9 xxxx

 

 

七、安装IK Analysis插件

/opt/elasticsearch-5.6.11/bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v5.6.11/elasticsearch-analysis-ik-5.6.11.zip

 

重启服务

jps|grep Elasticsearch

显示 xxxx Elasticsearch

kill -9 xxxx (xxxx为)

su - elk -c "/opt/elasticsearch-5.6.11/bin/elasticsearch -d"