Elasticsearch and kibana and filebeat 轻量级日志监控系统

Posted 2020-10-31

Elasticsearch and kibana and filebeat Elasticsearch and kibana and filebeat 轻量级日志监控系统 说明： elasticsearch 依赖java Logstash 依赖于JVM，内存消耗比较高 filebeat go语言轻量级日志监控系统 安装 elasticsearch-6.2.3.tar.gz filebeat-6.2.3-linux-x86_64.tar.gz kibana-6.2.3-linux-x86_64.tar.gz jdk-8u161-linux-x64.tar.gz # tar -zxvf jdk-8u161-linux-x64.tar.gz -C /usr/local # vi /etc/profile export JAVA_HOME=/usr/local/jdk1.8.0_161/ export CLASSPATH=.:$JAVA_HOME/jre/lib/rt.jar:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar export PATH=$JAVA_HOME/bin:$PATH # java -version # tar -zxvf elasticsearch-6.2.3.tar.gz -C /usr/local # vi /etc/security/limits.conf * soft nofile 65536 * hard nofile 131072 # vi /etc/sysctl.conf vm.max_map_count=262144 # vi /usr/local/elasticsearch-6.2.3/conf/elasticsearch.yml network.host: 0.0.0.0 http.port: 9200 # useradd elastic # chow -R elastic.elastic /usr/local/elasticsearch-6.2.3 # su - elastic # /usr/local/elasticsearch-6.2.3/bin/elasticsearch -d # curl 127.0.0.1:9200 { "name" : "8Wd9C8n", "cluster_name" : "elasticsearch", "cluster_uuid" : "9zevQvrfSMCuPFv-4eb3zw", "version" : { "number" : "6.2.3", "build_hash" : "c59ff00", "build_date" : "2018-03-13T10:06:29.741383Z", "build_snapshot" : false, "lucene_version" : "7.2.1", "minimum_wire_compatibility_version" : "5.6.0", "minimum_index_compatibility_version" : "5.0.0" }, "tagline" : "You Know, for Search" } # tar -zxvf kibana-6.2.3-linux-x86_64.tar.gz -C /usr/local # mv /usr/local/kibana-6.2.3-linux-x86_64 /usr/local/kibana-6.2.3 # vi /usr/local/kibana-6.2.3/config/kibana.yml server.host: "0.0.0.0" elasticsearch.url: "http://127.0.0.1:9200" # /usr/local/kibana-6.2.3/bin/kibana & # tar -zxvf filebeat-6.2.3-linux-x86_64.tar.gz -C /usr/local/ # mv /usr/local/filebeat-6.2.3-linux-x86_64 /usr/local/filebeat-6.2.3 # vi /usr/local/filebeat-6.2.3/filebeat.yml filebeat.prospectors: - type: log paths: - /var/log/* output.elasticsearch: hosts: ["127.0.0.1:9200"] # /usr/local/filebeat-6.2.3/filebeat & 通过浏览器输入 IP+5601 192.168.1.1:5601 managenment > index patterns > filebeat-* > create