ELK安装

准备两台centos7的mini
配置：2核心2G内存
规划如下：
ip地址：
192.168.10.130：
jdk
kibana
elasticsearch

192.168.10.131:
jdk
logstash

1: 关闭防火墙

[root@localhost src]# systemctl stop firewalld
[root@localhost src]# setenforce 0

2：时间同步

[root@localhost src]# yum -y install ntpdate
[root@localhost src]# ntpdate pool.ntp.org

3：安装jdk

[root@localhost ELK]# rpm -ivh jdk-8u131-linux-x64_.rpm
验证：
[root@localhost ELK]# java -version

4：安装elasticsearch

[root@localhost ELK]# rpm -ivh elasticsearch-6.6.2.rpm
主配置文件：elasticsearch.yml
[root@localhost elasticsearch]# pwd
/etc/elasticsearch
[root@localhost elasticsearch]# cat elasticsearch.yml |grep -v “^#”
cluster.name: huazai007
node.name: node-1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 192.168.10.130
http.port: 9200
运行es服务:
systemctl enable elasticsearch
systemctl start elasticsearch

验证服务是否正常运行：
[root@localhost elasticsearch]# tailf /var/log/elasticsearch/huazai007.log

5：安装logstash

[root@localhost ELK]# rpm -ivh logstash-6.6.0.rpm

5.1 收集/var/log/messages日志
[root@localhost conf.d]# pwd
/etc/logstash/conf.d

[root@localhost conf.d]# cat msg.conf
input{
file{
path => “/var/log/messages”
type => ‘msg-log’
start_position => “beginning”
}
}

output{
elasticsearch{
hosts => “192.168.10.130:9200”
index => “msg_log-%{+YYYY.MM.dd}”
}
}

启动服务：
[root@localhost conf.d]# systemctl start logstash
验证端口：
[root@localhost conf.d]# netstat -lptnu|grep 9600
tcp6 0 0 127.0.0.1:9600 ::: * LISTEN 13879/java
验证索引index是否创建成功：
方法1：
[root@localhost elasticsearch]# tailf /var/log/elasticsearch/huazai007.log
[2020-09-15T11:49:22,715][INFO ][o.e.c.m.MetaDataCreateIndexService] [node-1] [msg_log-2020.09.15] creating index, cause [auto(bulk api)], templates [], shards [5]/[1], mappings []
方法2：
[root@localhost elasticsearch]# curl -X GET http://192.168.10.130:9200/_cat/indices?v

报错处理：
[2020-09-15T11:47:02,447][WARN ][filewatch.tailmode.handlers.createinitial] failed to open /var/log/messages: #<Errno::EACCES: Permission denied - /var/log/messages>, [“org/jruby/RubyFile.java:366:in initialize'", "org/jruby/RubyIO.java:1154:inopen’”, “/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-input-file-4.1.9/lib/filewatch/watched_file.rb:198:in `open’”]
如何处理报错：
chmod 777 /var/log -R

6 安装kibana

[root@localhost ELK]# rpm -ivh kibana-6.6.2-x86_64.rpm
[root@localhost kibana]# pwd
/etc/kibana
编辑配置文件：
[root@localhost kibana]# cat kibana.yml |grep -v ‘^#’|sed ‘/^$/d’
server.port: 5601
server.host: “192.168.10.130”
elasticsearch.hosts: [“http://192.168.10.130:9200”]

[root@localhost kibana]# systemctl start kibana
[root@localhost kibana]# netstat -lptnu|grep 5601
tcp 0 0 192.168.10.130:5601 0.0.0.0:* LISTEN 16590/node

7：收集secure日志

7.1 编辑secure.conf
[root@localhost logstash]# cat /etc/logstash/conf.d/secure.conf
input{
file{
path => “/var/log/secure”
type => ‘sec-log’
start_position => “beginning”
}
}

output{
elasticsearch{
hosts => “192.168.10.130:9200”
index => “sec_log-%{+YYYY.MM.dd}”
}
}

8：编辑pipeline.yaml

• pipeline.id: msg
  path.config: “/etc/logstash/conf.d/msg.conf”
• pipeline.id: sec
  path.config: “/etc/logstash/conf.d/secure.conf”