elk搭建

sys1.关闭防火墙
systemctl stop firewalld
setenforce 0

2.临时修改
ulimit -SHn 65535

3.永久修改
vim /etc/securitry/limits.conf
在最后一行加上（soft软限制 hard是硬限制）

• soft nofile 65535（最大打开文件数）
• hard nofile 65535

---

• soft nproc 65535（最大打开进程数）
• hard nproc 65535

4.安装jdk
rpm -ivh jdk-8u131-linux-x64_.rpm

5.验证是否安装成功
java -version

6.安装elasticsearch-6.6.0.rpm
rpm -ivh elasticsearch-6.6.0.rpm
sudo systemctl enable elasticsearch.service
sudo systemctl start elasticsearch.service
查看端口是否存在
netstat -lnpt|grep java
修改配置文件
vim /etc/elasticsearch/elasticsearch.yml
找127 往上四五行
改成0.0.0.0在55行
network.host: 0.0.0.0
重启一下
sudo systemctl restart elasticsearch.service

7.查看日志
tailf /var/log/elasticsearch/elasticsearch.log

8.如果没有telnet安装一下
yum -y install telnet
telnet 本机ip 9200

9.安装logstash-6.6.0.rpm
rpm -ivh logstash-6.6.0.rpm
cd /etc/logstash/conf.d中编辑一个system.conf
vim system.conf
input {
file {
path => “/var/log/messages”
type => “system-log”
start_position => “beginning”
}
}

output {
elasticsearch {
hosts => “192.168.189.128:9200”
index => “system_log-%{+YYYY.MM.dd}”
}
}

10.给日志路径授权
chmod 777 /var/log/messages

11.启动logstash
systemctl start logstash

12.安装kibana
rpm -ivh kibana-6.6.0-x86_64.rpm
vim etc/kibana/kibana.yml
server.port: 5601
server.host: “0.0.0.0”
elasticsearch.hosts: [“http://0.0.0.0:9200”]