ELK

Posted blogscc

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了ELK相关的知识,希望对你有一定的参考价值。

1、 java 安装 环境变量设置

jdk 下载地址 https://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html

下载 解压 放到 /usr/local/java 目下下

环境变量设置, 最后面添加如下三行
vim /etc/profile

export JAVA_HOME=/usr/local/java/ export CLASSPATH=.:$JAVA_HOME/jre/lib/rt.jar:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar export PATH=$JAVA_HOME/bin:$PATH

source /etc/profile

 

测试

[[email protected] ~]# java -version
java version "1.8.0_181"
Java(TM) SE Runtime Environment (build 1.8.0_181-b13)
Java HotSpot(TM) 64-Bit Server VM (build 25.181-b13, mixed mode)

 

 

2、elasticsearch 搭建

wget wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.3.2.tar.gz
tar -zxf elasticsearch-6.3.2.tar.gz
mv elasticsearch-6.3.2 /usr/local/
ln -s elasticsearch-6.3.2/ elasticsearch

创建一个 非root 用户 elastic 启动服务

useradd elastic
chown -R /usr/local/elasticsearch-6.3.2/

启动elasticsearch

/usr/local/elasticsearch/bin/elasticsearch

 

报错1

[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

解决

vim /etc/security/limits.conf

elastic hard nofile 65536
elastic soft nofile 65536

 

报错2

 [2]memory locking requested for elasticsearch process but memory is not locked

解决:

elastic        soft    memlock          unlimited
elastic        hard    memlock          unlimited

 

报错3

[1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解决:

vim /etc/sysctl.conf
vm.max_map_count=655360
wq
sysctl -p 生效

 














以上是关于ELK的主要内容,如果未能解决你的问题,请参考以下文章

ELK 启动报错

elk日志分析搭建使用记录

elk日志分析搭建使用记录

ELK 平台收集Tomcat日志记录

elk日志分析搭建使用记录

elk日志分析搭建使用记录