Centos 7 安装 ELK 5.6.8 及基础的配置
Posted 晚来秋
tags:
篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了Centos 7 安装 ELK 5.6.8 及基础的配置相关的知识,希望对你有一定的参考价值。
下载
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.6.8.rpm
wget https://artifacts.elastic.co/downloads/logstash/logstash-5.6.8.rpm
wget https://artifacts.elastic.co/downloads/kibana/kibana-5.6.8-x86_64.rpm
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.6.8-x86_64.rpm
安装
yum install ./*.rpm
再安装一个redis作为filebeat与logstash间的缓冲,这里是从epel直接yum安装的,版本是:3.2.10
yum install redis
另外还需要安装好jdk8,这里的路径是:/mydata/jdk1.8.0_111
基础配置
(下文中蓝色文字为修改的内容,绿色为注释,其他是命令)
redis
mkdir -p /mydata/redis
chown -R redis:redis /mydata/redis
vim /etc/redis.conf
bind 0.0.0.0
dir /mydata/redis
systemctl start redis
systemctl enable redis
filebeat
vim /etc/filebeat/filebeat.yml 先把该文件中预设的配置全部注释掉,然后加上下面的 filebeat.prospectors: - input_type: log paths: - /root/test.log 从一个测试文件中获取数据 output.redis: 输出到redis队列 enabled: true hosts: ["127.0.0.1:6379"] db: 1 key: "elk_test_list" systemctl start filebeat systemctl enable filebeat
logstash
logstash在安装了rpm包后,还需再安装一下:
vim /etc/logstash/startup.options
JAVACMD=${JAVA_HOME}/bin/java
cd /usr/share/logstash/bin
./system-install
然后再进行基础配置:
mkdir -p /mydata/logstash chown -R logstash:logstash /mydata/logstash vim /etc/logstash/logstash.yml path.data: /mydata/logstash cd /etc/logstash/conf.d vim test.conf input { redis { 从redis队列读数据,要与上面filebeat的配置一致 host => "127.0.0.1" port => 6379 db => 1 data_type => "list" key => "elk_test_list" threads => 3 } } filter { 解析内容,这里用一个IP和一个字符串作测试 grok { match => { "message" => \'^%{IP:myip} %{DATA:myname}$\' } } } output { elasticsearch { 输出到elasticsearch hosts => ["127.0.0.1:9200"]
index => "test-log-%{+YYYY.MM.dd}" } } systemctl start logstash systemctl enable logstash
elasticsearch
vim /etc/sysconfig/elasticsearch
JAVA_HOME=/mydata/jdk1.8.0_111
vim /etc/elasticsearch/elasticsearch.yml
path.data: /mydata/elasticsearch
network.host: 0.0.0.0
mkdir -p /mydata/elasticsearch
chown -R elasticsearch:elasticsearch /mydata/elasticsearch
systemctl start elasticsearch
systemctl enable elasticsearch
kibana
vim /etc/kibana/kibana.yml server.host: "0.0.0.0" systemctl start kibana systemctl enable kibana
进行测试
touch /root/test.log
echo \'127.0.0.1 张三\' >> /root/test.log
echo \'127.0.0.2 李四\' >> /root/test.log
浏览器访问kibana(http://[your url]:5601),创建一个索引模板(test-log-*),进入Discover就可以看到:
over
以上是关于Centos 7 安装 ELK 5.6.8 及基础的配置的主要内容,如果未能解决你的问题,请参考以下文章
如何在CentOS 7 / Fedora 31/30/29上安装ELK Stack