需求背景
ELK 介绍
- Elasticsearch:搜索、分析和存储数据
- Logstash :采集日志、格式化、过滤,最后将数据推送到Elasticsearch存储
- Kibana:数据可视化
- Beats :集合了多种单一用途数据采集器,用于实现从边缘机器向 Logstash 和
ELK 架构
Filebeat将指定的日志采集,采集到之后推送到logstash,logstash负责对数据格式化处理。然后以键值的形式存储到es里面。Kibana负责对数据进行展示分析。
后面采集使用filebeat使得logstash专注于日志的格式化,过滤,采集还是使用filebeat更加轻量级。因为logstash太重了,消耗的资源是filebeat的几倍。所以使用filebeat代替logstash进行日志采集。
Elasticsearch
Elasticsearch(简称ES)是一个分布式、RESTful 风格的搜索和数据分析引擎, 用于集中存储日志数据。
- Index:索引是多个文档的集合
- Document:Index里每条记录称为Document,若干文档构建一个Index
- Type:一个Index可以定义一种或多种类型,将Document逻辑分组
- Field:ES存储的最小单元
如果你的日志每天上百G,那么es使用集群去部署,日志低于20G找个高性能的服务器跑个单实例也就够了。生产环境如果机器比较富裕使用三台独立的机器去部署三个节点的es。
Logstash不要和es部署在一块,因为logstash是非常消耗资源的。
Elasticsearch 集群可以干嘛?
在生产环境可以支撑起订单搜索,商品推荐,日志管理,风险控制,it运维,安全监控等不同领域的服务。
Elasticsearch可以做什么
是一款非常强大的开源搜索引擎,可以帮你从海量的数据当中找到你所想要的内容。比如你在gthub上进行搜索,它不仅可以帮助你找到相关的代码仓库,还可以帮助你实现代码级的搜索以及高亮显示。
当你在网上购物的时候,它可以帮助你做商品的推荐。
当你下班打车回家,elasticsearch可以帮助你定位附近的乘客和司机,帮助平台优化调度。
除了搜索结合kibana logstash beats。Elastic stack还被广泛应用在大数据实时分析的领域,包括了日志分析,指标监控,信息安全得多个领域。
它可以帮助你探索海量的结构化的,非结构化的数据。按需创建可视化的报表。对监控数据设置报警阈值,甚至使用机器学习技术自动识别异常的情况,及时发出警报。
ES 集群环境配置
(1)采用二进制部署
[root@localhost ~]# ls
anaconda-ks.cfg elasticsearch-7.10.0-linux-x86_64.tar.gz
[root@localhost ~]# tar xf elasticsearch-7.10.0-linux-x86_64.tar.gz
[root@localhost ~]# ls
anaconda-ks.cfg elasticsearch-7.10.0 elasticsearch-7.10.0-linux-x86_64.tar.gz
[root@localhost ~]# mv elasticsearch-7.10.0 /usr/local/elasticsearch
[root@localhost ~]# cd /usr/local/elasticsearch/
[root@localhost elasticsearch]# ls
bin config jdk lib LICENSE.txt logs modules NOTICE.txt plugins README.asciidoc
下面操作三台es上面全部修改
(2)创建es普通账号
Es是使用java语言开发的,意味着需要配置jdk,因为es包里面包含的jdk,就不要需要单独去安装了
[root@localhost elasticsearch]# ls jdk/
bin conf include jmods legal lib man release
出于安全考虑是不能使用root启动的,因此需要创建普通账号让es去使用
[root@localhost bin]# ./elasticsearch
Caused by: java.lang.RuntimeException: can not run elasticsearch as root
创建es账号,并且修改权限
[root@localhost elasticsearch]# useradd es
[root@localhost elasticsearch]# su - es
[es@localhost ~]$ cd /usr/local/elasticsearch/bin/
[es@localhost bin]$ ./elasticsearch
could not find java in bundled jdk at /usr/local/elasticsearch/jdk/bin/java
[es@localhost bin]$ ll /usr/local/elasticsearch/jdk/bin/java
ls: cannot access /usr/local/elasticsearch/jdk/bin/java: Permission denied
[root@localhost ~]# chown -R es.es /usr/local/elasticsearch/
可以看到有权限读取到了
[es@localhost bin]$ ll /usr/local/elasticsearch/jdk/bin/java
-rwxr-xr-x. 1 es es 12808 Nov 5 10:50 /usr/local/elasticsearch/jdk/bin/java
(3)配置系统相关参数,对系统有一定要求
- 整进程最大打开文件数数量
[2020-12-05T11:08:07,809][WARN ][o.e.b.BootstrapChecks ] [localhost.localdomain] max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]
查看当前用户最大可用文件描述符
[es@localhost bin]$ ulimit -n
1024
临时生效
[root@localhost ~]# ulimit -n 65535
[root@localhost ~]# ulimit -n
65535
永久生效
[root@localhost ~]# vim /etc/security/limits.conf
* hard nofile 65535
* soft nofile 65535
- 调整最大虚拟内存区域数量
2020-12-05T11:08:07,809][WARN ][o.e.b.BootstrapChecks ] [localhost.localdomain] max number of threads [2940] for user [es] is too low, increase to at least [4096]
[2020-12-05T11:08:07,812][WARN ][o.e.b.BootstrapChecks ] [localhost.localdomain] max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
临时设置
[root@localhost ~]# sysctl -w vm.max_map_count=262144
vm.max_map_count = 262144
永久生效写在配置文件里面,重启也生效
[root@localhost ~]# echo "vm.max_map_count=262144" >> /etc/sysctl.conf
[root@localhost ~]# sysctl -p
vm.max_map_count = 262144
ES mater节点部署
因为要搭建集群,所以需要给集群取名,三个节点保持统一
cluster.name: elk-cluster
监听所有网络地址
network.host: 0.0.0.0
数据端口9200,客户端向es里面写数据使用9200端口
http.port: 9200
集群配置主要有两个参数
这个是发现集群其他节点,也就是集群节点列表
#discovery.seed_hosts: ["host1", "host2"]
修改为
discovery.seed_hosts: ["192.168.179.102", "192.168.179.103","192.168.179.104"]
当你第一次搭建集群的时候,启动第一个节点指定的master
cluster.initial_master_nodes: ["node-1"]
不经过选举使用node-1作为master,这样就完成了master节点配置,master配置如下
[root@localhost ~]# cat /usr/local/elasticsearch/config/elasticsearch.yml | grep -v "#"
cluster.name: elk-cluster
node.name: node-1
network.host: 0.0.0.0
http.port: 9200
discovery.seed_hosts: ["192.168.179.102", "192.168.179.103","192.168.179.104"]
cluster.initial_master_nodes: ["node-1"]
[root@localhost ~]# cat /usr/lib/systemd/system/elasticsearch.service
[Unit]
Description=elasticsearch
[Service]
User=es
LimitNOFILE=65535
ExecStart=/usr/local/elasticsearch/bin/elasticsearch
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
[Install]
WantedBy=multi-usertarget
启动并且观察es master的日志
[root@localhost ~]# systemctl daemon-reload
[root@localhost ~]# systemctl enable elasticsearch
[root@localhost ~]# systemctl start elasticsearch
[root@localhost ~]# systemctl status elasticsearch
?.elasticsearch.service - elasticsearch
Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled; vendor preset: disabled)
Active: active (running) since Sat 2020-12-05 20:09:27 CST; 51s ago
可以看启动过程是否异常
[root@localhost ~]# journalctl -u elasticsearch.service
-- Logs begin at Sat 2020-12-05 19:15:09 CST, end at Sat 2020-12-05 20:10:24 CST. --
Dec 05 20:09:27 localhost.localdomain systemd[1]: Started elasticsearch.
Dec 05 20:09:27 localhost.localdomain systemd[1]: Starting elasticsearch...
Dec 05 20:09:36 localhost.localdomain elasticsearch[1141]: 2020-12-05 20:09:36,334 main ERROR RollingFileManager (/usr/local/elasticsearch/logs
Dec 05 20:09:36 localhost.localdomain elasticsearch[1141]: at java.base/java.io.FileOutputStream.open0(Native Method)
Dec 05 20:09:36 localhost.localdomain elasticsearch[1141]: at java.base/java.io.FileOutputStream.open(FileOutputStream.java:291)
Dec 05 20:09:36 localhost.localdomain elasticsearch[1141]: at java.base/java.io.FileOutputStream.<init>(FileOutputStream.java:234)
Dec 05 20:09:36 localhost.localdomain elasticsearch[1141]: at java.base/java.io.FileOutputStream.<init>(FileOutputStream.java:155)
Dec 05 20:09:36 localhost.localdomain elasticsearch[1141]: at org.apache.logging.log4j.core.appender.rolling.RollingFileManager$Roll
[root@localhost ~]# ps -ef | grep java
es 1141 1 7 20:09 ? 00:00:55 /usr/local/elasticsearch/jdk/bin/java -Xshare:auto -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -XX:+ShowCodeDetailsInExceptionMessages -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dio.netty.allocator.numDirectArenas=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.locale.providers=SPI,COMPAT -Xms1g -Xmx1g -XX:+UseG1GC -XX:G1ReservePercent=25 -XX:InitiatingHeapOccupancyPercent=30 -Djava.io.tmpdir=/tmp/elasticsearch-18297922288182705720 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=data -XX:ErrorFile=logs/hs_err_pid%p.log -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m -XX:MaxDirectMemorySize=536870912 -Des.path.home=/usr/local/elasticsearch -Des.path.conf=/usr/local/elasticsearch/config -Des.distribution.flavor=default -Des.distribution.type=tar -Des.bundled_jdk=true -cp /usr/local/elasticsearch/lib/* org.elasticsearch.bootstrap.Elasticsearch
root 1332 835 0 20:21 pts/0 00:00:00 grep --color=auto java
[root@localhost ~]# netstat -tpln | grep -wE "9200|9300"
tcp6 0 0 127.0.0.1:9200 :::* LISTEN 1141/java
tcp6 0 0 ::1:9200 :::* LISTEN 1141/java
tcp6 0 0 127.0.0.1:9300 :::* LISTEN 1141/java
tcp6 0 0 ::1:9300 :::* LISTEN 1141/java
9300是集群节点通信端口 9200是数据端口
- 9200:9200 作为 Http 协议,主要用于外部通讯
- 9300:9300 作为 Tcp 协议,jar 之间就是通过 tcp 协议通讯。ES 集群之间是通过 9300 进行通讯。
ES slave节点部署
其余两个节点和上面差不多的操作,其余节点不要启用该参数。这个在第一个个节点配置指定master
#cluster.initial_master_nodes: ["node-1", "node-2"]
配置systectl启动
[root@localhost ~]# vim /usr/lib/systemd/system/elasticsearch.service
[Unit]
Description=elasticsearch
[Service]
User=es
LimitNOFILE=65535
ExecStart=/usr/local/elasticsearch/bin/elasticsearch
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
[Install]
WantedBy=multi-usertarget
备1
[root@localhost bin]# cat /usr/local/elasticsearch/config/elasticsearch.yml | grep -v "#"
cluster.name: elk-cluster
node.name: node-2
network.host: 0.0.0.0
http.port: 9200
discovery.seed_hosts: ["192.168.179.102", "192.168.179.103","192.168.179.104"]
备2
[root@localhost ~]# cat /usr/local/elasticsearch/config/elasticsearch.yml | grep -v "#"
cluster.name: elk-cluster
node.name: node-3
network.host: 0.0.0.0
http.port: 9200
discovery.seed_hosts: ["192.168.179.102", "192.168.179.103","192.168.179.104"]
验证集群状态
查看集群节点,*号代表master节点 负责整个集群管理的
[root@localhost ~]# curl -XGET 'http://127.0.0.1:9200/_cat/nodes?pretty'
192.168.179.102 19 95 1 0.06 0.16 0.22 cdhilmrstw * node-1
192.168.179.103 24 95 1 0.10 0.20 0.32 cdhilmrstw - node-2
192.168.179.104 28 95 2 0.32 0.78 0.54 cdhilmrstw - node-3
访问api接口查看集群状态
[root@localhost ~]# curl -XGET 'http://127.0.0.1:9200/_cluster/health?pretty'
{
"cluster_name" : "elk-cluster", 集群名称
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 3, 几个节点
"number_of_data_nodes" : 3, 几个数据节点
"active_primary_shards" : 0,
"active_shards" : 0,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
除了上面api可以查看集群状态,也可以安装图形界面管理es,下篇博客见