ELK高可用开源全文检索和分析组件
安装环境:
系统:centos7
IP1:192.168.100.128
IP2:192.168.100.130
组件
JDK
elasticsearch
logstash
kibana
1.安装JDK
2.安装elasticsearch
部署主机: 192.168.100.128
yum -y install elasticsearch-6.6.2.rpm
[root@centos7-1 ~]# cat /etc/elasticsearch/elasticsearch.yml |grep -v '^#'
cluster.name: sun_jl
node.name: node-1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 192.168.100.128
http.port: 9200
[root@centos7-1 ~]# ll /var/log/elasticsearch/
总用量 84
-rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:19 elasticsearch_access.log
-rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:19 elasticsearch_audit.log
-rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:19 elasticsearch_deprecation.log
-rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:19 elasticsearch_index_indexing_slowlog.log
-rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:19 elasticsearch_index_search_slowlog.log
-rw-r--r--. 1 elasticsearch elasticsearch 9020 7月 9 14:23 elasticsearch.log
-rw-r--r--. 1 elasticsearch elasticsearch 64207 7月 9 14:34 gc.log.0.current
-rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:23 sun_jl_access.log
-rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:23 sun_jl_audit.log
-rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:23 sun_jl_deprecation.log
-rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:23 sun_jl_index_indexing_slowlog.log
-rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:23 sun_jl_index_search_slowlog.log
-rw-r--r--. 1 elasticsearch elasticsearch 7133 7月 9 14:24 sun_jl.log
[root@centos7-1 ~]# netstat -anlp |grep java
tcp6 0 0 192.168.100.128:9300 :::* LISTEN 4624/java
tcp6 0 0 192.168.100.128:9200 :::* LISTEN 4624/java
unix 2 [ ] STREAM CONNECTED 48840 4624/java
unix 2 [ ] STREAM CONNECTED 50676 4624/java
3.安装logstash
部署:192.168.100.128
yum -y install logstash-6.6.0.rpm
编辑配置文件
[root@centos7-1 ~]# vim /etc/logstash/conf.d/messages.conf
[root@centos7-1 ~]# cat /etc/logstash/conf.d/messages.conf
input {
file {
path => "/var/log/messages"
type => "messages-log"
start_position => "beginning"
}
}
output {
elasticsearch {
hosts => "192.168.100.128:9200"
index => "messages_log-%{+YYYY.MM.dd}"
}
}
启动与权限
[root@centos7-1 ~]# systemctl start logstash.service
[root@centos7-1 ~]# chmod -R 777 /var/log/
[root@centos7-1 ~]# ll /var/log/logstash/
总用量 4
-rwxrwxrwx. 1 logstash logstash 3783 7月 9 14:47 logstash-plain.log
-rwxrwxrwx. 1 logstash logstash 0 7月 9 14:47 logstash-slowlog-plain.log
4.安装kibana
部署:192.168.100.130
yum -y install kibana-6.6.2-x86_64.rpm
修改配置文件
[root@centos7 ~]# vim /etc/kibana/kibana.yml
[root@centos7 ~]# cat /etc/kibana/kibana.yml |grep -v "^#"|sed '/^$/d'
server.port: 5601
server.host: "192.168.100.130"
elasticsearch.hosts: ["192.168.100.128:9200"]
[root@centos7 ~]# systemctl start kibana
[root@centos7 ~]# netstat -anlp | grep 5601
tcp 0 0 192.168.100.130:5601 0.0.0.0:* LISTEN 2912/node