一、系统环境配置
1、JDK检查
java -version
2、yum源配置
cat >> /etc/yum.repos.d/ELK.repo << "EOF"
[ELK]
name=ELK-Elasticstack
baseurl=https://mirrors.tuna.tsinghua.edu.cn/elasticstack/yum/elastic-6.x/
gpgcheck=0
enabled=1
EOF
二、elasticsearch部署
1、ES1:
yum -y install elasticsearch
# 修改系统配置文件属性
cat >> /etc/security/limits.conf << "EOF"
elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited
elasticsearch soft nofile 65535
elasticsearch hard nofile 65535
EOF
#修改配置文件
sed -i 's/^path.data/#path.data/' /etc/elasticsearch/elasticsearch.yml
sed -i 's/^path.logs/#path.logs/' /etc/elasticsearch/elasticsearch.yml
cat >> /etc/elasticsearch/elasticsearch.yml << "EOF"
#添加集群名称
cluster.name: els
#添加节点名称
node.name: els-1
#修改数据存放路径
path.data: /data/els_data
#修改日志存放路径
path.logs: /data/log/els
#锁定jvm.options指定的内存,不交换swap内存
#bootstrap.memory_lock: true
#添加绑定IP地址
network.host: 172.25.190.48
#添加端口号
http.port: 9200
#配置集群配置,填写集群节点,会自动发现节点
discovery.zen.ping.unicast.hosts: ["172.25.190.48", "172.25.190.50"]
# 集群配置 只需要修改节点名,和绑定ip地址即可
EOF
# vim /etc/elasticsearch/jvm.options
#-Xms1g #指定占用内存大小,两个数字要一致 都是1g
#-Xmx1g
#创建数据目录
mkdir -p /data/els_data
mkdir -p /data/log/els
chown -R elasticsearch.elasticsearch /data/els_data
chown -R elasticsearch.elasticsearch /data/log/els
PS:如提示找不到JAVA_HOME
在/etc/sysconfig/elasticsearch中添加JAVA_HOME=/usr/local/install/jdk-11.0.7
2、部署其他ES节点
yum -y install elasticsearch
# 修改系统配置文件属性
cat >> /etc/security/limits.conf << "EOF"
elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited
elasticsearch soft nofile 65535
elasticsearch hard nofile 65535
EOF
#??
#elasticsearch soft nproc 4096
#elasticsearch hard nproc 4096
#修改配置文件
sed -i 's/^path.data/#path.data/' /etc/elasticsearch/elasticsearch.yml
sed -i 's/^path.logs/#path.logs/' /etc/elasticsearch/elasticsearch.yml
cat >> /etc/elasticsearch/elasticsearch.yml << "EOF"
#添加集群名称
cluster.name: els
#添加节点名称
node.name: els-2
#修改数据存放路径
path.data: false
#修改日志存放路径
path.logs: /data/log/els
#锁定jvm.options指定的内存,不交换swap内存
#bootstrap.memory_lock: true
#添加绑定IP地址
network.host: 172.25.190.49
#添加端口号
http.port: 9200
#配置集群配置,填写集群节点,会自动发现节点
discovery.zen.ping.unicast.hosts: ["172.25.190.48", "172.25.190.50","172.25.190.49"]
# 集群配置 只需要修改节点名,和绑定ip地址即可
EOF
# vim /etc/elasticsearch/jvm.options
-Xms1g #指定占用内存大小,两个数字要一致 都是1g
-Xmx1g
#创建数据目录
mkdir -p /data/els_data
mkdir -p /data/log/els
chown -R elasticsearch.elasticsearch /data/els_data
chown -R elasticsearch.elasticsearch /data/log/els
三、kibana部署
yum -y install kibana
#配置Kibana
cat >> /etc/kibana/kibana.yml << "EOF"
server.port: 5610
server.host: "0.0.0.0"
elasticsearch.url: "http://172.25.190.48:9200"
kibana.index: ".kibana"
# 配置kibana日志输出到哪里
logging.dest: /data/log/kibana/kibana.log
i18n.locale: "zh-CN"
EOF
# 创建日志目录文件
mkdir -p /data/log/kibana/
touch /data/log/kibana/kibana.log
chmod o+rw /data/log/kibana/kibana.log
四、logstash部署
1、JDK检查
2、yum源配置
cat >> /etc/yum.repos.d/ELK.repo << "EOF"
[ELK]
name=ELK-Elasticstack
baseurl=https://mirrors.tuna.tsinghua.edu.cn/elasticstack/yum/elastic-6.x/
gpgcheck=0
enabled=1
EOF
3、安装
yum -y install logstash
4、修改配置文件
cat >> /etc/logstash/logstash.yml << "EOF"
http.host: "127.0.0.1"
http.port: 9600-9700
EOF
cat >> /etc/logstash/conf.d/message.conf << "EOF"
input {
file {
type =>"message-info-log"
path => ["/mnt/qx/message/logs/info/*.log"]
start_position => "beginning"
sincedb_path => "/dev/null"
}
file {
type =>"message-error-log"
path => ["/mnt/qx/message/logs/error/*.log"]
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
output {
if [type] == "message-info-log" {
elasticsearch {
hosts => ["172.25.190.48:9200"]
index => "message-info-log-%{+YYYY.MM}"
}
}
else if [type] == "message-error-log"{
elasticsearch {
hosts => ["172.25.190.48:9200"]
index => "message-error-log-%{+YYYY.MM}"
}
}
}
EOF
PS:日志收集及索引建立请另行参考logstash配置