Elasticsearch日志服务器

阅读本文需要 10 分钟

下载JDK

 # 找到对应的下载包
 1. yum search java | grep jdk
 # 下载安装
 2. yum install java-11-openjdk.x86_64

配置JDK

1. vi /etc/profile

# 根据下载的JDK修改 JAVA_HOME, 追加以下内容到 /etc/profile
#set java environment 
JAVA_HOME=/usr/lib/jvm/java-11-openjdk-11.0.7.10-4.el7_8.x86_64
JRE_HOME=$JAVA_HOME/jre 
CLASS_PATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar:$JRE_HOME/lib 
PATH=$PATH:$JAVA_HOME/bin:$JRE_HOME/bin 
export JAVA_HOME JRE_HOME CLASS_PATH PATH 

读取新配置

1. source /etc/profile

# 验证有效性
2. java -version

# 由于 ElasticSearch 不允许root执行，所以增加一个用户和用户组
1. groupadd elsearch
2. useradd elsearch -g elsearch -p elasticsearch
# 更改elasticsearch文件夹及内部文件的所属用户及组为elsearch:elsearch
3. chown -R elsearch:elsearch  elasticsearch

下载Elasticsearch

# 找到对应的下载包 https://www.elastic.co/cn/downloads/elasticsearch
1. wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.8.0-linux-x86_64.tar.gz
# 解压
2. tar -xzf elasticsearch-7.8.0-linux-x86_64.tar.gz
# 切换用户
3. su elsearch
# 启动
4. cd elasticsearch-7.8.0 && ./bin/elasticsearch

# 如果出现 Could not find or load main class org.elasticsearch.tools.java_version_checker.JavaVersionChecker 报错
# 请检查当前目录是否在root用户下，将整个目录mv到elsearch即可执行

下载Kibana

# 新开一个窗口
# 找到对应的下载包 https://www.elastic.co/cn/downloads/kibana
1. wget https://artifacts.elastic.co/downloads/kibana/kibana-7.8.0-linux-x86_64.tar.gz
# 解压
2. tar -xzf kibana-7.8.0-linux-x86_64.tar.gz

修改Kibana配置

1. vi kibana-7.8.0-linux-x86_64/config/kibana.yml

2. 修改以下配置
server.host: "0.0.0.0" # 允许所有ip访问
elasticsearch.hosts: ["http://localhost:9200"] # Elasticsearch地址，若无修改，开启即可
i18n.locale: "zh-CN"
elasticsearch.username: "elastic"
elasticsearch.password: "*****"

启动 Kibana

1. cd kibana-7.8.0-linux-x86_64 && ./bin/kibana --allow-root

# 默认地址 http://localhost:5601

下载 Filebeat

# 找到对应的下载包 https://www.elastic.co/cn/downloads/beats/filebeat
1. wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.8.0-linux-x86_64.tar.gz
# 按需要启动 modules.d 下对应的配置文件 教程 http://ec2-54-93-166-1.eu-central-1.compute.amazonaws.com/instructions/labs.html

2. 解压
tar -xzf  filebeat-7.8.0-linux-x86_64.tar.gz

3. 配置 filebeat.yml

  1 filebeat.inputs:
  2 - type: log
  3   enabled: true
  4   paths:
  5     - /home/wwwlogs/*.log
  6     - /home/wwwroot/cock/storage/logs/*.log
  7 filebeat.config.modules:
  8   path: ${path.config}/modules.d/*.yml
  9   reload.enabled: false
 10 setup.template.settings:
 11   index.number_of_shards: 1
 12 tags: ["cock"]
 13 setup.kibana:
 14   host: "localhost:9478"
 15 output.elasticsearch:
 16   hosts: ["localhost:9200"]
 17   username: "elastic"
 18   password: "*****"
 19 processors:
 20   - add_host_metadata: ~
 21   - add_cloud_metadata: ~
 22   - add_docker_metadata: ~
 23   - add_kubernetes_metadata: ~

# 加载
4. cd filebeat-7.8.0-linux-x86_64 && ./filebeat setup

# 启动
5. ./filebeat -e

参考文章 ：

1. Elasticsearch7开启x-pack验证