一、ES安装
1 官网下载安装elasticsearch-7.6.2-linux-x86_64.tar.gz包
2 mkdir -p /usr/local/es/ 并且上传到此目录
3 tar -zxvf elasticsearch-7.6.2-linux-x86_64.tar.gz
4
修改配置为文件memeory config/jvm.options 大小设置为-Xmx108m
修改配置为文件网络 config/elasticsearch.yml network.host: 0.0.0.0
修改配置 bin/elasticsearch-env 添加JAVA_HOME="/usr/local/es/elasticsearch-7.6.2/jdk"
修改配置 config/elasticsearch.yml discovery.seed_hosts:["139.224.234.236"]
cluster.initial_master_nodes: ["139.224.234.236"]
5 增加es用户 useradd es
6 赋权es用户 chown -Rf es /usr/local/es/
7 es用户 启动es ,cd /usr/local/es/elasticsearch-7.6.2/bin ./elasticsearch -d(后台启动)
linux安装es
vim /etc/sysctl.conf
vm.max_map_count=655360
sysctl -p
mkdir -p /soft/es
cd /soft/es
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.15.2-linux-x86_64.tar.gz
tar -zxvf elasticsearch-7.15.2-linux-x86_64.tar.gz
vim /soft/es/elasticsearch-7.15.2/config/elasticsearch.yml
增加以下内容:
network.host: 0.0.0.0
node.name: node-1
cluster.initial_master_nodes: ["node-1"]
修改配置为文件memeory config/jvm.options 大小设置为-Xmx108m -Xms108m
修改配置为文件网络 config/elasticsearch.yml network.host: 0.0.0.0
修改配置 bin/elasticsearch-env 添加JAVA_HOME=" /soft/es/elasticsearch-7.15.2/config/jdk"
修改配置 config/elasticsearch.yml discovery.seed_hosts:["139.224.234.236"]
cluster.initial_master_nodes: ["139.224.234.236"]
useradd es
chown -R es:es /soft
su es
cd /soft/es/elasticsearch-7.15.2/bin
./elasticsearch
二、kibana安装
linux安装kibana
mkdir -p /soft/kibana
chown -R es:es /soft/kibana
cd /soft/kibana
wget https://artifacts.elastic.co/downloads/kibana/kibana-7.15.2-linux-x86_64.tar.gz
tar -zxvf kibana-7.15.2-linux-x86_64.tar.gz
su es
cd /soft/kibana/kibana-7.15.2-linux-x86_64
vim config/kibana.yml
server.host: "0.0.0.0"
nohup ./bin/kibana &
三、安装logstash
linux安装logstash
mkdir -p /soft/logstash
cd /soft/logstash
wget https://artifacts.elastic.co/downloads/logstash/logstash-7.15.2-linux-x86_64.tar.gz
tar -zxvf logstash-7.15.2-linux-x86_64.tar.gz
cd /soft/logstash/logstash-7.15.2
nohup ./bin/logstash -f /soft/logstash/logstash-7.15.2/config/logstash-sample.conf &
–logstash-sample.conf可以自定义
四、安装filebeat
linux安装filebeat
mkdir -p /soft/filebeat
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.9.3-linux-x86_64.tar.gz
tar -zxvf filebeat-7.9.3-linux-x86_64
修改filebeat.yml
nohup ./filebeat -e -c filebeat.yml >/dev/null 2>&1 &
五、日志采集方式:
1、Filebeat-Es-Kibana
filebeat服务:
根据配置的filebeat.yml,配置采集的日志文件路径,配置日志输出到Es中去
filebeat.inputs:
- type: log
enabled: true
paths:
- /usr/myapp/logs/info.log
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
# hosts: ["11111:9200"]
# index: "u-%{+yyyy.MM.dd}"
Es服务:服务正常即可
Kibana服务:修改kibana.yml
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://139.224.234.236:9200"]
2、logstash-Es-Kibana
logstash服务:
根据配置的logstash-sample.conf,配置采集的日志文件路径,配置日志输出到Es中去
input {
file{
path => ['/soft/*.log']
type => 'user_log'
start_position => "beginning"
}
}
output {
elasticsearch {
hosts => ["http://139.224.234.236:9200"]
index => "ubs-%{+YYYY.MM.dd-HH}"
#user => "elastic"
#password => "changeme"
}
}
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
# hosts: ["11111:9200"]
# index: "u-%{+yyyy.MM.dd}"
Es服务:服务正常即可
Kibana服务:修改kibana.yml
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://139.224.234.236:9200"]
3、Filebeat-logstash-Es-Kibana
filebeat服务:
根据配置的filebeat.yml,配置采集的日志文件路径,配置日志输出到logstash中去
filebeat.inputs:
- type: log
enabled: true
paths:
- /soft/logs/*.log
- /soft/logs/error.log
output.logstash:
hosts: ["10.103.30.233:8035","10.103.30.233:8036"]
loadbalance: true
logstash服务:
input {
beats {
port => 8035
codec => "json"
}
}
output {
elasticsearch {
hosts => ["http://139.224.234.236:9200"]
index => "ubs-%{+YYYY.MM.dd-HH}"
#user => "elastic"
#password => "changeme"
}
}
Es服务:服务正常即可
Kibana服务:修改kibana.yml
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://139.224.234.236:9200"]