ELK搭建

1. 准备文件：ElasticSearch 6.3.2    Logstash 6.3.2  Kibana 4.3.1    JDK 1.8.0_251

    ElasticSearch、Logstash、Kibana  版本保持一致。

    单台机器搭建

    java8环境搭建

    创建用户 elk

2. Elasticsearch 搭建

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.3.2.tar.gz
tar -xzvf elasticsearch-6.3.2.tar.gz
mv elasticsearch-6.3.2 elasticsearch
vim elasticsearch/config/elasticsearch.yml
修改
network.host: ip
http.port: 9200

运行 bin/elasticsearch

填坑：

1. max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
解决方法：
#切换到root用户修改
vim /etc/security/limits.conf
# 在最后面追加下面内容
elk hard nofile 65536
elk soft nofile 65536
2. max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
解决方法 提高vm.max_map_count 的大小
# 切换到root用户
vim /etc/sysctl.conf
# 在最后面追加下面内容
vm.max_map_count=262144
# 使用 sysctl -p 查看修改后的结果
sysctl -p

3. Logstash 搭建

wget https://artifacts.elastic.co/downloads/logstash/logstash-6.3.2.tar.gz
tar -zxvf logstash-6.3.2.tar.gz 
mv logstash-6.3.2.tar.gz logstash

vim /home/elk/logstash/test.conf

input {
  file {
    path => "/home/elk/log-31-280-RUN_20200715200044.log"（自己去找个日志文件，注意路径）
    type => "system"
    start_position => "beginning"

  }
}

output {
     elasticsearch {
            hosts => ["elasticsearch的ip:9200"]
            index => "system-%{+YYYY.MM.dd}"
        }
}

注：filter没写

运行 bin/logstash -f test.conf

如需要安装插件修改gem源

vim logstash/Gemfile

修改source "https://mirrors.aliyun.com/rubygems/"

4. Kibana 搭建

wget https://artifacts.elastic.co/downloads/kibana/kibana-6.3.2-linux-x86_64.tar.gz
tar -xzvf kibana-6.3.2-linux-x86_64.tar.gz
mv kibana-6.3.2-linux-x86_64.tar.gz kibana

vim kibana/config/kibana.yml
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.url: "http://ip:9200"    
kibana.index: ".kibana"

运行 bin/kibana