修改时区
cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
yum install ntpdate -y
ntpdate time.windows.com
配置YUM仓库,后面安装都用这个库:
rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch
vi /etc/yum.repos.d/elastic.repo
[elastic-6.x]
name=Elastic repository for 6.x packages
baseurl=https://artifacts.elastic.co/packages/6.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
1、安装elasticsearch
yum install elasticsearch -y
vim /etc/elasticsearch/elasticsearch.yml
#节点1
cluster.name: elk-cluster
node.name: node-1
#node.master: true或fase #是否作为主节点
path.data: /home/es/es_data
network.host: 192.168.1.195
http.port: 9200
discovery.zen.ping.unicast.hosts: ["192.168.1.195", "192.168.1.196", "192.168.1.197"]
discovery.zen.minimum_master_nodes: 2
#节点2
cluster.name: elk-cluster
node.name: node-2
path.data: /home/es/es_data
network.host: 192.168.1.196
http.port: 9200
discovery.zen.ping.unicast.hosts: ["192.168.1.195", "192.168.1.196", "192.168.1.197"]
discovery.zen.minimum_master_nodes: 2
#节点3
cluster.name: elk-cluster
node.name: node-3
path.data: /home/es/es_data
network.host: 192.168.1.197
http.port: 9200
discovery.zen.ping.unicast.hosts: ["192.168.1.195", "192.168.1.196", "192.168.1.197"]
discovery.zen.minimum_master_nodes: 2
cluster.name # 集群名称
node.name # 节点名称
path.data # 数据目录。可以设置多个路径,这种情况下,所有的路径都会存储数据。
集群主要关注两个参数:
discovery.zen.ping.unicast.hosts # 单播,集群节点IP列表。提供了自动组织集群,自动扫描端口9300-9305连接其他节点。无需额外配置。
discovery.zen.minimum_master_nodes # 最少主节点数
为防止数据丢失,这个参数很重要,如果没有设置,可能由于网络原因脑裂导致分为两个独立的集群。为避免脑裂,应设置符合节点的法定人数:(nodes / 2 ) + 1
换句话说,如果集群节点有三个,则最小主节点设置为(3/2) + 1 或2
查看集群节点:
curl -XGET 'http://127.0.0.1:9200/_cat/nodes?pretty'
查看集群健康状态:
curl -i -XGET http://127.0.0.1:9200/_cluster/health?pretty
安装Elasticsearch – head插件
安装npm软件
tar -zxvf node-v4.4.7-linux-x64.tar.gz
vi /etc/profile
NODE_HOME=/usr/local/node-v4.4
PATH=$NODE_HOME/bin:$PATH
export NODE_HOME PATH
source /etc/profile
安装elasticsearch-head
git clone git://github.com/mobz/elasticsearch-head.git
cd elasticsearch-head
vi Gruntfile.js
options: {
port: 9100,
base: '.',
keepalive: true,
hostname: '*'
}
npm install
npm run start
2、安装logstash
yum install logstash -y
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/test.conf
input {
file {
path => "/var/log/messages"
type => "system"
start_position => "beginning"
}
}
output {
elasticsearch {
hosts => ["192.168.1.202:9200"]
index => "system-%{+YYYY.MM.dd}"
}
}
下面是我的配置文件例子
cat yuejiaxiao.conf
input {
file {
path => ["/data/docker-yuejiaxiao/logs/certification/certification-provider.info.log"]
type => "certification-info"
start_position => "beginning"
}
file {
path => ["/data/docker-yuejiaxiao/logs/certification/certification-provider.error.log"]
type => "certification-error"
start_position => "beginning"
}
}
filter {
date {
match => ["timestamp","yyyy-MM-dd HH:mm:ss"]
remove_field => "timestamp"
}
}
output {
if [type] == "certification-info" {
elasticsearch {
hosts => ["http://172.16.86.215:9200"]
index => "certification-info-%{+YYYY.MM.dd}"
}
}
if [type] == "certification-error" {
elasticsearch {
hosts => ["http://172.16.86.215:9200"]
index => "certification-error-%{+YYYY.MM.dd}"
}
}
}
中间的filter配置,是为了解决拉取的日志时间和本地系统时间不一致的问题。
3、安装kibana
yum install kibana –y
vi /etc/kibana/kibana.yml
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.url: http://localhost:9200
systemctl start kibana
systemctl enable kibana
elk搭建好了,elasticsearch(搜索引擎)、logstash(搜集),kibana(可视化平台),这是kibana平台地址http://ip:5601
kibana中文汉化解决
将Kibana_Hanization-master.zip上传至kibana服务器
unzip Kibana_Hanization-master.zip
拷贝此项目中的translations文件夹到您的kibana目录下的src/legacy/core_plugins/kibana/目录
cd Kibana_Hanization-master/
cp -r translations/ /usr/share/kibana/src/legacy/core_plugins/kibana/
修改您的kibana配置文件kibana.yml中的配置项:i18n.locale: “zh-CN”
vim /etc/kibana/kibana.yml
#i18n.locale: "en"
i18n.locale: "zh-CN"
重启Kibana,汉化完成
systemctl restart kibana