环境准备:
A配置主机名
B配置/etc/hosts
systemctl stop firewalld.service
setenforce 0
Node1:
Node2:
hostname node2
192.168.100.11 node1
192.168.100.13 node2
一、安装Elasticsearch
rpm -ivh elasticsearch-5.5.0.rpm
systemctl enable elasticsearch.service
systemctl daemon-reload
守护进程
开机自启
修改配置文件
17 cluster.name: my-elk-cluster
23 node.name: node2
33 path.data: /data/elk_data
37 path.logs: /var/log/elasticsearch
43 bootstrap.memory_lock: false
55 network.host: 0.0.0.0
59 http.port: 9200
68 discovery.zen.ping.unicast.hosts: [“node1”, “node2”]
二、安装Elasticsearch-head 插件
必须在/root/elasticsearch-head下:
三、 安装logstash
mount /dev/cdrom /benet/
yum list
rpm -ivh logstash-5.5.1.rpm
ln -s /usr/share/logstash/bin/logstash /usr/local/bin/
yum -y install httpd
echo ‘
this is web!! you look like a pig!!
’ > /var/www/html/index.html![在这里插入图片描述](https://i-blog.csdnimg.cn/blog_migrate/1b4ad6916e6efae1c4e378490ef4a8e2.png)
![在这里插入图片描述](https://i-blog.csdnimg.cn/blog_migrate/df50a21d8b34b110f3f33011ed48797f.png)
systemctl restart httpd
![在这里插入图片描述](https://i-blog.csdnimg.cn/blog_migrate/a44027f2d487cc9b5609f51c5c3aff84.png)
touch apache_log.conf
![在这里插入图片描述](https://i-blog.csdnimg.cn/blog_migrate/69000032b18c9a876db995a5f9261eaf.png)
配置logstash文件
vim apache_log.conf
input {
file{
path => “/etc/httpd/logs/access_log”
type => “access”
start_position => “beginning”
}
file{
path => “/etc/httpd/logs/error_log”
type => “error”
start_position => “beginning”
}
}
output {
if [type] == “access” {
elasticsearch {
hosts => [“192.168.100.11:9200”]
index => “apache_access-%{+YYYY.MM.dd}”
}
}
if [type] == “error” {
elasticsearch {
hosts => [“192.168.100.11:9200”]
index => “apache_error-%{+YYYY.MM.dd}”
}
}
}
/usr/share/logstash/bin/logstash -f apache_log.conf (最后要 Ctrl+c)
systemctl restart logstash.service
四 、 安装kibana
2 server.port: 5601
7 server.host: “0.0.0.0”
21 elasticsearch.url: “http://192.168.100.11:9200”
30 kibana.index: “.kibana”