ELK日志实时分析系统

Posted 2020-07-14

logstash:https://download.elastic.co/logstash/logstash/logstash-2.2.2.tar.gz

elasticsearch:https://download.elasticsearch.org/elasticsearch/release/org/elasticsearch/distribution/tar/elasticsearch/2.2.0/elasticsearch-2.2.0.tar.gz

kibana:https://download.elastic.co/kibana/kibana/kibana-4.4.0-linux-x64.tar.gz

安装JDK环境

yum install -y java-1.8.0-openjdk

关闭防火墙

service iptables stop

安装elasticsearch

elasticsearch要用非root用户运行

groupadd hadoop

useradd -g hadoop hadoop

wget https://download.elasticsearch.org/elasticsearch/release/org/elasticsearch/distribution/tar/elasticsearch/2.2.0/elasticsearch-2.2.0.tar.gz

下载插件

./bin/plugin install mobz/elasticsearch-head

./bin/plugin install lmenezes/elasticsearch-kopf

修改elasticsearch.yml配置

cluster.name: es_cluster
node.name: node-1
path.data: /home/hadoop/elasticsearch/data
path.logs: /home/hadoop/elasticsearch/logs
network.host: 192.168.233.131
network.port: 9200

检测安装是否成功

curl http://192.168.233.131:9200/

打开http://ip:9200/_plugin/head、http://ip:9200/_plugin/kopf可查看集群状态

 

安装kibana

wget https://download.elastic.co/kibana/kibana/kibana-4.4.0-linux-x64.tar.gz

修改kibana.yml配置（主要修改elasticsearch的IP）

打开ip:5601查看是否安装成功

安装logstash

wget https://download.elastic.co/logstash/logstash/logstash-2.2.2.tar.gz

简单的logstash配置

input { stdin{}}
output {
elasticsearch { hosts=> ‘192.168.233.131‘ }
}

 

 

注意：1、logstash要有数据传到elasticsearch才能在kibana中创建索引

　　　2、elasticsearch集群变成yellow状态，可用以下命令处理

curl -XPUT "http://localhost:9200/_settings" -d‘
{
"number_of_replicas" : 0
}‘