下载:
ES和Kibana:https://www.elastic.co/cn/start?elektra=home&&storm=banner
Logstash:https://www.elastic.co/cn/downloads/logstash
启动顺序:
0、配置JAVA_HOME和JRE_HOME,指向c:\jdk18
启动顺序:ES->Logstash->Kibana
1、启动es:D:\sbf\elk\elasticsearch-7.0.0\bin\elasticsearch.bat
2、启动Logstash:
Create a file named "first-pipeline.conf" and save it in the same directory as Logstash.
input {
beats {
port => "5044"
}
}
output {
elasticsearch {
hosts => ["127.0.0.1:9200"]
manage_template => true
template_overwrite => true
#index => "apache_elastic_example"
index => "es-message-%{+YYYY.MM.dd}"
#template => "./apache_template.json"
template_name => "apahce_elastic_example"
}
stdout {
codec => rubydebug
}
}
执行命令:logstash -f first-pipeline.conf --config.reload.automatic
3、启动Kibana
参考:https://blog.csdn.net/ling811/article/details/74999880
调整kibanna相关参数;
###启动
./bin/kibana &
访问:http://localhost:5601
4、下载filebeat-7.0.0-windows-x86_64,由filebeat读取文件--》logstash-》elasticsearch-》kibana展示
Filebeat是本地文件的日志数据采集器。 作为服务器上的代理安装,Filebeat监视日志目录或特定日志文件,tail file,并将它们转发给Elasticsearch或Logstash进行索引、kafka 等
安装:https://www.elastic.co/cn/downloads/beats/filebeat ,按页面配置
5、监控nginx的access.log,新增一行,得到:
http://localhost:9200/_cat/indices?v
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
yellow open es-message-2019.05.02 vQDwVHmNSYumN2sxGHzQxA 1 1 1 0 18.7kb 18.7kb
green open .kibana_task_manager 0WcfWNuhTqydRacI7uuA7A 1 0 2 0 46.4kb 46.4kb
yellow open apache_elastic_example lxqYpPtAQlCI_J-Rb3qsBg 1 1 1 0 18.8kb 18.8kb
yellow open filebeat-7.0.0-2019.04.30-000001 nIuNetxOSXWVtUol3nuowQ 1 1 0 0 283b 283b
yellow open logstash-2019.04.30-000001 cz7on7WVQhWw-UpQhSar-g 1 1 10 0 168.8kb 168.8kb
yellow open test 6O5jGT27TBaECW9zG6EKSQ 1 1 2 0 37.4kb 37.4kb
green open .kibana_1 3WU4duRURtG5LH2QHMHZSA 1 0 614 52 402.9kb 402.9kb
http://localhost:9200/es-message-2019.05.02/_search
{"took":2,"timed_out":false,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0},"hits":{"total":{"value":1,"relation":"eq"},"max_score":1.0,"hits":[{"_index":"es-message-2019.05.02","_type":"_doc","_id":"kLaHeGoB4xywh91DNcug","_score":1.0,"_source":{"@timestamp":"2019-05-02T12:31:24.556Z","ecs":{"version":"1.0.0"},"host":{"name":"zy","hostname":"zy","architecture":"x86_64","os":{"name":"Windows 10 Pro","build":"17763.437","platform":"windows","version":"10.0","family":"windows","kernel":"10.0.17763.437 (WinBuild.160101.0800)"},"id":"67630411-0570-40f4-bf0a-b34f2b392beb"},"message":"127.0.0.1 - - [08/Apr/2019:11:38:49 +0800] \"GET /index1.html HTTP/1.1\" 200 1691 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36\"","agent":{"type":"filebeat","version":"7.0.0","id":"debbb419-bbdd-4bd4-b717-a61ca267cc37","ephemeral_id":"229fea9e-06d8-41dc-9fd1-eff656cd5e0c","hostname":"zy"},"log":{"offset":25598,"file":{"path":"D:\\sbf\\nginx-1.14.1\\logs\\access.log"}},"input":{"type":"log"},"@version":"1","tags":["beats_input_codec_plain_applied"]}}]}}
6、上面说明手工添加的一行access.log数据已经到了elasticsearch存储了。kibana如何展示呢?
在kibana中Dev Tools 中: GET _cat/indices,执行后可以得到第5步骤的值;
GET es-message-2019.05.02
7、配置kibana
Kibana->Management->index Patterns-->Create index patterns-->按提示两部完成配置;
在Discover中选择新建的es-messsage-*,选择时间,就会查询到一笔数据;