elk部署文檔離線

部署elasticsearch安裝rpm-ivhelasticsearch-6.2.3.rpm查找安裝路徑rpm-qlelasticsearch一般是裝在/usr/share/elasticsearch/下。設(shè)置data的目錄創(chuàng)建/data/es-data目錄，用于elasticsearch數(shù)據(jù)的存放mkdir-p/data/es-data修改該目錄的擁有者為elasticsearchchown-Relasticsearch:elasticsearch/data/es-data設(shè)置log的目錄創(chuàng)建/data/es-log目錄，用于elasticsearch日志的存放mkdir-p/log/es-log修改該目錄的擁有者為elasticsearchchown-Relasticsearch:elasticsearch/log/es-log修改配置文件elasticsearch.ymlvim/etc/elasticsearch/elasticsearch.yml根據(jù)下面的內(nèi)容進行修改，wq保存。電#設(shè)置data存放的路徑為/data/es-datapath.data:/data/es-data#設(shè)置10gs日志的路徑為/log/es-logpath.logs:/log/es-log

#設(shè)置內(nèi)存不使用交換分區(qū)bootstrap.memory_lock:false#配置了bootstrap.memory_lock為true時反而會引發(fā)9200不會被監(jiān)聽，原因不明#設(shè)置允許所有ip可以連接該elasticsearchnetwork.host:#開啟監(jiān)聽的端口為9200http.port:9200#增加新的參數(shù)，為了讓elasticsearch-head插件可以訪問es（5.x版本，如果沒有可以自己手動加）http.cors.enabled:truehttp.cors.allow-origin:〃*〃電3.5啟動elasticsearch#啟動systemctlstartelasticsearch#查看狀態(tài)systemctlstatuselasticsearch#設(shè)置開機啟動systemctlenableelasticsearch開啟9200端口firewall-cmd--add-port=9200/tcp--permanentfirewall-cmd——reload測試安裝是否成功#檢查9200是否有監(jiān)聽netstat-antp|grep9200[poot^localhostnetstat-antp|grep9200ItcpGLISTEN11782/java

ItcpGcurlhttp:〃:9200有下面類似的內(nèi)容才說明elasticsearch正常啟動。[root@lc?calho5tcurl 9200{"namab,:“fQF工"clu5ter_na[DE";11elasticsearch","cluster_uuid":''qWSkaVxUQx69GQ]wDrifjA"T"version":{''number":"6.1.0P\"bjild-hash":''c0clba0"?"build-date":"20171212T12;32:54.550Z","bui]d_5napshot":false,,,liJccne_ver,Eicn'':n7.1.0""mlnimum_wire_'Ccnnpatibllity_ver51or";115.6.0","minimum_index_CDmpa-tnbi1ity_uersion":"5.0.0''Ji"taglineq:"YouKnow,forSearch''}[roo■七@1口工與Ihos七?1#部署logstash#安裝rpm-ivhlogstash-6.2.3rpm設(shè)置data的目錄#創(chuàng)建/data/ls-data目錄，用于logstash數(shù)據(jù)的存放mkdir-p/data/ls-data#修改該目錄的擁有者為logstashchown-Rlogstash:logstash/data/ls-data設(shè)置log的目錄#創(chuàng)建/data/ls-log目錄，用于logstash日志的存放mkdir-p/log/ls-log#修改該目錄的擁有者為logstashchown-Rlogstash:logstash/log/ls-log修改配置文件logstash.ymlvim/etc/logstash/logstash.yml

根據(jù)下面的內(nèi)容進行修改，wq保存。設(shè)置數(shù)據(jù)的存儲路徑為/data/ls-datapath.data:/data/ls-data設(shè)置管道配置文件路徑為/etc/logstash/conf.dpath.config:/etc/logstash/conf.d設(shè)置日志文件的存儲路徑為/log/ls-logpath.logs:/log/ls-log電啟動logstash啟動systemctlstartlogstash查看狀態(tài)systemctlstatuslogstash設(shè)置開機啟動systemctlenablelogstash測試安裝是否成功查看下logstash的安裝目錄rpm-qllogstash創(chuàng)建一個軟連接，每次執(zhí)行命令的時候不用在寫安裝路徑（yum安裝是在/usr/share下）ln-s/usr/share/logstash/bin/logstash/bin/執(zhí)行l(wèi)ogstash的命令logstash-e,input{stdin{}}output{stdout{}}'等待片刻后出現(xiàn)“Thestdinpluginisnowwaitingforinput:",輸入''abc"回車，有返回的輸出。[roDtjfilocalhost川]耶logstash-e1input{stdin{}}output{stdout{1WARNING:Couldnotfindlo-gst-ash.yntlutiichistypicallylocatedin$LS_HQME/cQrifigor/etc/logst.ash.Voucan5pecifythepathusing--poth.settin>e5.ContinuingusingthedefaultsCouldnotfindlog4j2configurationaitpath/usr/share/logstash/comfig/l!Dg4;perties■Usingdefoultconfigwhichlogs-errorstotheconsoleThestdiftpluginis.riowMaltingfari力put:abc20-L7-12-25T06:52]19a745Zlocallhost11ocaIdorwainabc

ctrl+c退出。如果標準輸出還有elasticsearch中都需要保留，看下面#6是試驗elk的ip/usr/share/logstash/bin/logstash-e'input{stdin{}}output{elasticsearch{hosts=>["192,168.12.16:9200"]}stdout{codec=>rubydebug}}'等待片刻后出現(xiàn)“Thestdinpluginisnowwaitingforinput:",輸入''test”回車，返回下面標準的輸出。[rootjfflloc-ailhost&]#/usr/share/1[rootjfflloc-ailhost&]#/usr/share/1ogstash/bir/logstaslh-e1input{stdin{}}output{elasticsearch{hosts=>[-,192- -1216[920BHJ}stdoLit{codec=>rubydebug}}*^lARNING!：Couldnotfind1ogstash.ynluthiclhistypi匚HllylocatedintLS_HOME/comfigor/etc/lDgstash.Youcanspecifythepatlnusing--path.settings.ContinuingusingthedefaultsCouldnotfindlog4jiZconifig□rationatpath/usr/share/1ogstash/canfig/1Dg^j2?properties.UsingdefaultconfigwhichThestdinplugintestlogserrors-totheconsoleisnoL/vjaitingforinput!："host11^message1""gversion"=>""host11^message1""gversion"=>2017-12-25T07:02-27.79BZ?部署kibana#安裝rpm-ivhkibana-6.1.0-x86_64.rpm修改kibana.yml#搜索rpm包rpm-qlkibana默認是裝在/usr/share/kibana/下。#修改kibana的配置文件vim/etc/kibana/kibana.yml#修改kibana.xml下面的內(nèi)容，wq保存。

電#kibana頁面映射在5601端口server.port:5601#允許所有ip訪問5601端口server.host:""#elasticsearch所在的ip及監(jiān)聽的地址elasticsearch.url:"HYPERLINK"http://