ELK日志分析系统

1 环境准备：
A:配置主机名hostname node1
vim /etc/hosts
192.168.100.110 node1
192.168.100.111 node2
systemctl stop firewalld.service
setenforce 0

scp /etc/hosts root@192.168.100.111:/etc/
B配置主机名hostname node2
vim /etc/hosts
bash
systemctl stop firewalld.service
setenforce 0

2 安装Elasticsearch
A:rpm -ivh elasticsearch-5.5.0.rpm
systemctl start elasticsearch.service
systemctl enable elasticsearch.service
systemctl daemon-reload

3 修改配置文件
A :vim /etc/elasticsearch/elasticsearch.yml
set nu
17myELK
23node1
33 /data/elk_data
37/var/log/elasticsearch/
43 false
55 192.168.100.110
59 9200
68 [node1/node2]

A :mkdir -p /data/elk_data
chown elasticsearch:elasticsearch /data/elk_data
systemctl restart elasticsearch.service
netstat -naptu |grep 9200

4 安装Elasticsearch-head 插件
A : ll
tar xf node-v8.2.2
cd node-v8.2.1/
./configure && make && make install
B:tar xf node-v8.2.1.tar.gz
cd node-v8.2.1/
./configure && make && make install

B phantomjs
tar xf phantomjs-2.1.1-linux-x86_64.tar.bz2
cp phantomjs-2.1.1-linux-x86_64/bin/phantomjs /usr/local/bin/

C 安装 elasticsearch-head.tar.gz

A tar xf elasticsearch-head.tar.gz
cd elasticsearch-head/
npm install

D修改配置文件
vim /etc/elasticsearch/elasticsearch.yml
http.cors.enabled: true
http.cors.allow-origin: “*”

systemctl restart elasticsearch.service
npm run start &
netstat -naptu |grep 9200
netstat -naptu |grep 9100
B vim /etc/elasticsearch/elasticsearch.yml
systemctl restart elasticsearch.service
netstart -naptu |grep 9200