sys1.关闭防火墙
systemctl stop firewalld
setenforce 0
2.临时修改
ulimit -SHn 65535
3.永久修改
vim /etc/securitry/limits.conf
在最后一行加上(soft软限制 hard是硬限制)
- soft nofile 65535(最大打开文件数)
- hard nofile 65535
- soft nproc 65535(最大打开进程数)
- hard nproc 65535
4.安装jdk
rpm -ivh jdk-8u131-linux-x64_.rpm
5.验证是否安装成功
java -version
6.安装elasticsearch-6.6.0.rpm
rpm -ivh elasticsearch-6.6.0.rpm
sudo systemctl enable elasticsearch.service
sudo systemctl start elasticsearch.service
查看端口是否存在
netstat -lnpt|grep java
修改配置文件
vim /etc/elasticsearch/elasticsearch.yml
找127 往上四五行
改成0.0.0.0在55行
network.host: 0.0.0.0
重启一下
sudo systemctl restart elasticsearch.service
7.查看日志
tailf /var/log/elasticsearch/elasticsearch.log
8.如果没有telnet安装一下
yum -y install telnet
telnet 本机ip 9200
9.安装logstash-6.6.0.rpm
rpm -ivh logstash-6.6.0.rpm
cd /etc/logstash/conf.d中编辑一个system.conf
vim system.conf
input {
file {
path => “/var/log/messages”
type => “system-log”
start_position => “beginning”
}
}
output {
elasticsearch {
hosts => “192.168.189.128:9200”
index => “system_log-%{+YYYY.MM.dd}”
}
}
10.给日志路径授权
chmod 777 /var/log/messages
11.启动logstash
systemctl start logstash
12.安装kibana
rpm -ivh kibana-6.6.0-x86_64.rpm
vim etc/kibana/kibana.yml
server.port: 5601
server.host: “0.0.0.0”
elasticsearch.hosts: [“http://0.0.0.0:9200”]