elk部署文檔(離線)

部署elasticsearch#安裝rpm—ivhelasticsearch—6.2.3.rpm#查找安裝路徑rpm-qlelasticsearch一般是裝在/usr/share/elasticsearch/下。設(shè)置data的#創(chuàng)建/data/es-data目錄，用于elasticsearch數(shù)據(jù)的存放mkdir-p/data/es-data#修改該目錄的擁有者為elasticsearchchown-Relasticsearch:elasticsearch/data/es-data設(shè)?log的#創(chuàng)建/data/es-log目錄，用于elasticsearch日志的存放mkdir-p/log/es-log#修改該目錄的擁有者為elasticsearchchown-Relasticsearch:elasticsearch/log/es-log修改配置文件elasticsearch.ymlvim/etc/elasticsearch/elasticsearch.yml根據(jù)下面的內(nèi)容進(jìn)行修改，wq保存。#設(shè)置data存放的路徑為/data/es-datapath.data:/data/es-data#設(shè)置logs日志的路徑為/log/es-logpath.logs:/log/es-log

#設(shè)置內(nèi)存不使用交換分區(qū)bootstrap.memory_lock:false#配置了bootstrap.memory_lock為true時(shí)反而會(huì)引發(fā)9200不會(huì)被監(jiān)聽，原因不明#設(shè)置允許所有ip可以連接該elasticsearchnetwork.host:#開啟監(jiān)聽的端口為9200http.port:9200#增加新的參數(shù)，為了讓elasticsearch-head插件可以訪問es（5.x版本，如果沒有可以自己手動(dòng)加）http.cors.enabled:truehttp.cors.allow-origin:“*〃3.5啟動(dòng)elasticsearch#啟動(dòng)systemctlstartelasticsearch#查看狀態(tài)systemctlstatuselasticsearch#設(shè)置開機(jī)啟動(dòng)systemctlenableelasticsearch3.6開啟9200端口firewall-cmd--add-port二9200/tcp--permanentfirewall-cmd——reload3.7測(cè)試安裝是否成功#檢查9200是否有監(jiān)聽netstat-antp|grep92001[poot^1ocaIhost?]#netstat-antpItcpG00Froctftlocalhostgrep9200!:i*LISTEN117B2/java

curl:9200有下面類似的內(nèi)容才說明elasticsearch正常啟動(dòng)。[root^localhostcurlhttp://127.0.&.l;9200<"namab,:'--fQFIxV'^"clu5ter_na[DE":11elasticsearch","cluster_uuid":''qWSkaVxUQx69GQ]wDrIfjA"T"version":{''number":"G.1.0P\"bud：lcl_h￥h“：■'caclbaa1,"build_d日七寸:"20171212T12:32:54.550Z","bui]d_5napshot":false,''liJccne_verEicn'':n7.1.0""mlnimum_wire_ccnnpatibllity_versiDn":115.6.0","minimum_index_CDmpa'tnbi1ity_uersion":"5.0.0''Ji"taglineq:"YouKno叭fairSearch''}[roo■七七…]#部署logstash#安裝rpm-ivhlogstash-6.2.3rpm設(shè)置data的目錄#創(chuàng)建/data/ls-data目錄，用于logstash數(shù)據(jù)的存放mkdir-p/data/ls-data#修改該目錄的擁有者為logstashchown-Rlogstash:logstash/data/ls-data設(shè)置log的目錄#創(chuàng)建/data/ls-log目錄，用于logstash日志的存放mkdir-p/log/ls-log#修改該目錄的擁有者為logstashchown-Rlogstash:logstash/log/ls-log修改配置文件logstash.ymlvim/etc/logstash/logstash.yml

根據(jù)下面的內(nèi)容進(jìn)行修改，wq保存。#設(shè)置數(shù)據(jù)的存儲(chǔ)路徑為/data/ls-datapath.data:/data/ls-data#設(shè)置管道配置文件路徑為/etc/logstash/conf.dpath.config:/etc/logstash/conf.d#設(shè)置日志文件的存儲(chǔ)路徑為/log/ls-logpath.logs:/log/ls-log4.5啟動(dòng)logstash#啟動(dòng)systemctlstartlogstash#查看狀態(tài)systemctlstatuslogstash#設(shè)置開機(jī)啟動(dòng)systemctlenablelogstash4.6測(cè)試安裝是否成功#查看下logstash的安裝目錄rpm-qllogstash#創(chuàng)建一個(gè)軟連接，每次執(zhí)行命令的時(shí)候不用在寫安裝路徑（yum安裝是在/usr/share下）ln-s/usr/share/logstash/bin/logstash/bin/#執(zhí)行l(wèi)ogstash的命令logstash-e'input{stdin{}}output{stdout{}}'等待片刻后出現(xiàn)“Thestdinpluginisnowwaitingforinput:”，輸入“abc”回車，有返回的輸出。[roDtjfilocalhost?]#logstash-e1input{stdin{}}output{stdout{}}"WARNING:Couldnotfindlo-gs七呂￡乩丫?1utiichis七ypicallylocated才門$LS_HQME/cQrifigor/etc/logs七啟呂!！.Vouc&n5pecifythepathusing--path?5巴上七匚口占5?Co-ntinuineusingthedefaultsCouldnotfindj2configurationaitpmth/usr/share/logstash/comfig/l!Dg4;j2?properties?UsingdefoultconfigwhichlogserrorstothEconsoleThestdiftpluginisriowMaltingfarinpui::abc2&L7-12-25T06:52]19a745Zlocallhost11ocaldorwainabc

ctrl+c退出。如果標(biāo)準(zhǔn)輸出還有elasticsearch中都需要保留，看下面#6是試驗(yàn)elk的ip/usr/share/logstash/bin/logstash-e'input{stdin{}}output{elasticsearch{hosts=>["6:9200"]}stdout{codec=>rubydebug}}'等待片刻后出現(xiàn)“Thestdinpluginisnowwaitingforinput:”，輸入“test”回車，返回下面標(biāo)準(zhǔn)的輸出。[rootjffllo匚日]|.11口5七血]#/usr/share/1ogstash/bin/logst-ash-e1input{5七din{}}output{elas七匚匚{hosts=>[-,192--1216[920BHJ}stdoLit{codec=>rubydebug}}"^lARNING::Couldnotfind1ogstash.yntlwhichistypicallylocatedintLS_HOME/comfigor/etc/lDgstash.Youcanspecifythepathiusing--path.settings?ContinuingusingthedefaultsCouldnotfindlog4ji2conifigur■曰tiQinatpath/usr/share/1ogstash/canfig/1Dg^j2?properties?Usingdefanitconfig討hi匚hlogserrors七口theconsoleThestdinpluginisnewwaitingforinput!：test{"host"=>"lo-calhast.localdonain111'*message11=>J,+est","^tlmestaimp*4=>2017-12-25T07:02-27.79BZ?'■g￥ersionR=>"I"部署kibana#安裝rpm—ivhkibana—6.1.0—x86_64.rpm修改kibana.yml#搜索rpm包rpm—qlkibana默認(rèn)是裝在/usr/share/kib