elk的安装部署
简介:
ELK是elasticsearch、logstash、kibana三个开源软件的缩写,用于日志收集查看分析
1、从官网下载安装包elasticsearch、logstash、kibana,版本尽量保持一致
elasticsearch:https://www.elastic.co/cn/downloads/past-releases#elasticsearch
logstash:https://www.elastic.co/cn/downloads/past-releases#logstash
filebeat:https://www.elastic.co/cn/downloads/past-releases#filebeat
kibana:https://www.elastic.co/cn/downloads/past-releases#kibana
2、安装java环境
3、配置系统参数
echo "vm.max_map_count=262144" >> /etc/sysctl.conf
sysctl -p
vim /etc/security/limits.conf
* hard nofile 65535
* soft nofile 65535
4、新建elk用户,设置密码,并切换用户
useradd -d /home/elk -m elk
passwd elk
su - elk
5、开始部署elasticsearch,先解压,然后修改配置文件
vim config/elasticsearch.yml
![复制代码](https://common.cnblogs.com/images/copycode.gif)
cluster.name: my-application node.name: node-1 cluster.initial_master_nodes: ["node-1"] path.data: /home/elk/elasticsearch/data path.logs: /home/elk/elasticsearch/logs network.host: 0.0.0.0 http.port: 9200
![复制代码](https://common.cnblogs.com/images/copycode.gif)
6、启动elasticsearch
./bin/elasticsearch -d
注:默认的启动堆栈是4g,如果系统配置不高可以适当减少
vim config/jvm.options
-Xms500M -Xmx500M
7、浏览器输入:http://ip:9200/,如果显示json包含版本等信息即部署成功
8、开始部署logstash,先解压,然后修改配置文件
vim config/logstash-sample.conf(input是收集日志的目录,可以有多个file{})
![复制代码](https://common.cnblogs.com/images/copycode.gif)
input { file { path => ['/home/elk/logs/*.log'] } } output { elasticsearch { hosts => ["http://ip:9200/"] index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" } }
![复制代码](https://common.cnblogs.com/images/copycode.gif)
注:默认的启动堆栈是4g,如果系统配置不高可以适当减少
vim config/jvm.options
-Xms400M -Xmx400M
9、启动logstash
nohup ./bin/logstash -f /home/elk/logstash/config/logstash-sample.conf &
10、开始部署kibana,先解压,然后修改配置文件
vim config/kibana.yml
server.port: 5601 server.host: "ip" elasticsearch.hosts: ["http://ip:9200/"]
11、启动kibana
nohuo ./bin/kibana &
12、浏览器打开输入ip:5601就可以访问了,测试下是否可以成功访问elasticsearch
下面是扩展内容
一、注:官方还推荐使用filebeat,其占用资源少,只负责收集日志,没有其他性能开销
可配置filebeat收集日志后直接输出到elasticsearch,也可以配置输出到logstash
安装步骤如下:
1、先解压缩包,然后修改配置文件
vim filebeat.yml
#直接输出到elasticsearch output.elasticsearch: # Array of hosts to connect to. hosts: ["localhost:9200"]
或
#输出到logstash output.logstash: # The Logstash hosts hosts: ["localhost:5044"]
如果是配置输出到logstash,还需要相应的修改logstash的配置文件
vim config/logstash-sample.conf
input { beats { path => 5044 } }
然后启动filebeat,logstash
nohup ./filebeat -e -c filebeat.yml >/dev/null 2>&1 &
nohup ./bin/logstash -f /home/elk/logstash/config/logstash-sample.conf &
二、安装elasticsearch-head插件,有两种方法:
1、容器部署
elasticsearch-head:docker run -d -v -p 9100:9100 --name es-head mobz/elasticsearch-head:5
2、源码部署
yum install npm
git clone git://github.com/mobz/elasticsearch-head.git
cd elasticsearch-head
npm install
npm run start
三、为避免给elasticsearch造成过大的压力,可以安装redis/kafka作缓冲
标签:elk,部署,kibana,vim,elasticsearch,config,logstash From: https://www.cnblogs.com/xkcp008/p/17822324.html