logstash+elasticsearch+kibana快速搭建日志平台

centos6.5

elasticsearch-1.4.2

logstash-1.4.2

kibana-3.1.2

这三个版本是兼容较好

关闭http防火墙

1:  service iptables stop

2:  安装jdk

3:安装ElasticSearch

mkdir -p /opt/software && cd /opt/software
wget https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-1.4.2.tar.gz
tar -zxvf elasticsearch-1.4.2.tar.gz -C /usr/local/
ln -s /usr/local/elasticsearch-1.4.2 /usr/local/elasticsearch

修改配置文件

vi /usr/local/elasticsearch/config/elasticsearch.yml

在尾部添加代码

http.cors.enabled: true

4: 启动ElasticSearch

wget https://github.com/elasticsearch/elasticsearch-servicewrapper/archive/master.tar.gz
tar -zxvf master
mv /opt/software/elasticsearch-servicewrapper-master/service /usr/local/elasticsearch/bin/
/usr/local/elasticsearch/bin/service/elasticsearch start

5:安装Logstash

wget https://download.elasticsearch.org/logstash/logstash/logstash-1.4.2.tar.gz
tar -zxvf logstash-1.4.2.tar.gz -C /usr/local/
ln -s /usr/local/logstash-1.4.2 /usr/local/logstash

6:增加logstash配置文件

mkdir -p /usr/local/logstash/etc

vim /usr/local/logstash/etc/hello_search.conf

将下面代码复制到conf中（该配置log4j,logback同样适用）
input {
  log4j {
    mode => "server"
    host => "192.168.160.37"
    port => 4560
  }
}


output {
  elasticsearch {
    host => "192.168.160.37"
    port => 9300
  }
}

7:启动logstash（适用log4j或logback记录日志后边有记录）

/usr/local/logstash/bin/logstash -f /usr/local/logstash/etc/hello_search.conf

8:安装kibana（将kibana移动到apache服务的目录下）

wget https://download.elasticsearch.org/kibana/kibana/kibana-3.1.2.tar.gz
tar -zxvf kibana-3.1.2.tar.gz
mv kibana-3.1.2 /usr/local/web/apache/htdocs

9:修改kibana配置文件

vi /usr/local/web/apache/htdocs/kibana/kibana-3.1.2/config.js

找到elasticsearch，并将IP改为你elasticsearch的安装IP地址: "http://192.168.160.92:9200"

10:启动apache服务

service httpd start

11:打开kibana(apache服务端口不能为80)

http://192.168.160.92:8080/kibana/kibana-3.1.2/index.html

log4j配置

在log4j配置文件中加入下列代码

log4j.appender.logstash=org.apache.log4j.net.SocketAppender
log4j.appender.logstash.port=4560
log4j.appender.logstash.remoteHost=192.168.160.37 #(这里是你logstash设置的服务ip和端口)

在rootLogger尾部追加logstash

log4j.rootLogger=debug,stdout,file,logstash

logback配置

加入maven依赖如果没有则下载jar包

 <dependency>
            <groupId>net.logstash.logback</groupId>
            <artifactId>logstash-logback-encoder</artifactId>
            <version>4.7</version>
</dependency>

在logback.xml加入appender

<appender name="stash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <remoteHost>192.168.160.92</remoteHost>
        <port>4560</port>
        <encoder class="net.logstash.logback.encoder.LogstashEncoder"/>
</appender>

并在root节点加入

<appender-ref ref="stash"/>