ELK日志分析系统

1.[root@centos03 ~]# mount /dev/cdrom /mnt
[root@centos03 ~]# tar zxvf /mnt/elasticsearch-head.tar.gz -C /usr/src/
[root@centos03 ~]# tar zxvf /mnt/node-v8.2.1.tar.gz -C /usr/src/
[root@centos03 ~]#tar jxvf /mnt/phantomjs-2.1.1-linux-x86_64.tar.bz2 -C /usr/src/
2.指定安装位置：
[root@centos03 ~]# mv /usr/src/elasticsearch-head/ /usr/local/
3.安装node：
[root@centos03 ~]# mv /usr/src/node-v8.2.1/ /usr/local/node
[root@centos03 node]# ./configure && make && make install
4.安装phantomjs：
[root@centos03 ~]# mv /usr/src/phantomjs-2.1.1-linux-x86_64/bin/phantomjs /usr/local/bin/
5.安装配置elasticsearch
[root@centos03 ~]# rpm -ivh /mnt/elasticsearch-5.5.0.rpm
[root@centos03 ~]#vim /etc/hosts
192.168.100.30 centos03
192.168.100.40 centos04
[root@centos03 ~]#scp /etc/hosts/ root@192.168.100.40:/etc/
[root@centos03~]#cp /etc/elasticsearch/elasticsearch.yml / etc/elasticsearch/elast
icsearch.yml.bak
[root@centos03 ~]# vim /etc/elasticsearch/elasticsearch.yml
17 cluster.name: my-elk
23 node.name: centos03
43 bootstrap.memory_lock: false
55 network.host: 192.168.100.30
59 http.port: 9200
68 discovery.zen.ping.unicast.hosts: [“centos03”, “centos04”]
[root@centos03 ~]# systemctl daemon-reload
[root@centos03 ~]# systemctl enable elasticsearch.service
[root@centos03 ~]# systemctl start elasticsearch.service



6.配置elasticsearch-head
配置elasticsearch-head
[root@centos03 ~]# cd /usr/local/elasticsearch-head/
[root@centos03 elasticsearch-head]# npm install

修改elasticsearch主配置文件
[root@centos03 ~]# vim /etc/elasticsearch/elasticsearch.yml
60 http.cors.enabled: true
61 http.cors.allow-origin: ""
[root@centos03 ~]# systemctl daemon-reload
[root@centos03 ~]# systemctl restart elasticsearch
修改elasticsearch-head配置文件
[root@centos03 ~]# vim /usr/local/elasticsearch-head/_site/app.js
4329 this.base_uri = this.config.base_uri || this.prefs.get(“app-base_uri”) || “http://192.168.100.30:9200”;
修改elasticsearch-head 监听
[root@centos03 ~]# vim /usr/local/elasticsearch-head/Gruntfile.js
93 hostname:‘192.168.100.30’,
启动服务
[root@centos03 ~]# cd /usr/local/elasticsearch-head/
[root@centos03 elasticsearch-head]# npm run start&



7.安装logstansh
[root@centos05 ~]# yum -y install httpd
[root@centos05 ~]# systemctl start httpd
[root@centos05 ~]# systemctl enable httpd
[root@centos05 ~]# rpm -ivh /mnt/logstash-5.5.1.rpm
[root@centos05 ~]# ln -s /usr/share/logstash/bin/ /usr/local/bin/
[root@centos05 ~]# logstash -e ‘input {stdin { } } output { stdout {}}’
[root@centos05 ~]# logstash -e ‘input { stdin {} } output {elasticsearch { hosts=>[“192.168.100.30”]}}’

[root@centos05 ~]# vim /etc/logstash/conf.d/apache_access_log.conf
input {
file {
path => “/var/log/httpd/access_log”
type => “access”
start_position => “beginning”
}
}
output {
if [type] == “access” {
elasticsearch {
hosts => [“192.168.100.30:9200”]
index => “apache_access-%{+YYYY.MM.dd}”
}
}
}

[root@centos05 ~]# chmod +X /etc/logstash/conf.d/apache_access_log.conf
[root@centos05 ~]# logstash -f /etc/logstash/conf.d/apache_access_log.conf
6）设置服务开机自动启动
[root@centos05 ~]# systemctl enable logstash
[root@centos05 ~]# systemctl start logstash
8.安装配置kibana
[root@centos03 ~]# rpm -ivh /mnt/kibana-5.5.1-x86_64.rpm
[root@centos03 ~]# vim /etc/kibana/kibana.yml
3 server.port: 5601
9 server.host: “192.168.100.30”
24 elasticsearch.url: “http://192.168.100.30:9200”
[root@centos03 ~]# systemctl start kibana
[root@centos03 ~]# systemctl enable kibana