ELK安装使用

一、ES安装

1 官网下载安装elasticsearch-7.6.2-linux-x86_64.tar.gz包

2 mkdir -p /usr/local/es/ 并且上传到此目录

3 tar -zxvf elasticsearch-7.6.2-linux-x86_64.tar.gz

4

    修改配置为文件memeory config/jvm.options     大小设置为-Xmx108m
  	修改配置为文件网络     config/elasticsearch.yml    network.host: 0.0.0.0     
    修改配置 bin/elasticsearch-env  添加JAVA_HOME="/usr/local/es/elasticsearch-7.6.2/jdk"
	修改配置     config/elasticsearch.yml  discovery.seed_hosts:["139.224.234.236"]
                              cluster.initial_master_nodes: ["139.224.234.236"]

5 增加es用户 useradd es

6 赋权es用户 chown -Rf es /usr/local/es/

7 es用户 启动es ,cd /usr/local/es/elasticsearch-7.6.2/bin ./elasticsearch -d(后台启动)

linux安装es

vim /etc/sysctl.conf

vm.max_map_count=655360

sysctl -p

mkdir -p /soft/es

cd /soft/es

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.15.2-linux-x86_64.tar.gz

tar -zxvf elasticsearch-7.15.2-linux-x86_64.tar.gz

vim /soft/es/elasticsearch-7.15.2/config/elasticsearch.yml
增加以下内容：

network.host: 0.0.0.0
node.name: node-1
cluster.initial_master_nodes: ["node-1"]

   修改配置为文件memeory config/jvm.options     大小设置为-Xmx108m -Xms108m 
	  	修改配置为文件网络     config/elasticsearch.yml    network.host: 0.0.0.0     
	    修改配置 bin/elasticsearch-env  添加JAVA_HOME=" /soft/es/elasticsearch-7.15.2/config/jdk"
  		修改配置     config/elasticsearch.yml  discovery.seed_hosts:["139.224.234.236"]
	                              cluster.initial_master_nodes: ["139.224.234.236"]

useradd es

chown -R es:es /soft

su es

cd /soft/es/elasticsearch-7.15.2/bin

./elasticsearch

二、kibana安装

linux安装kibana

mkdir -p /soft/kibana
chown -R es:es /soft/kibana
cd /soft/kibana

wget https://artifacts.elastic.co/downloads/kibana/kibana-7.15.2-linux-x86_64.tar.gz

tar -zxvf kibana-7.15.2-linux-x86_64.tar.gz

su es

cd  /soft/kibana/kibana-7.15.2-linux-x86_64

vim config/kibana.yml

	server.host: "0.0.0.0"
nohup ./bin/kibana &

三、安装logstash

linux安装logstash

mkdir -p /soft/logstash

cd /soft/logstash

wget https://artifacts.elastic.co/downloads/logstash/logstash-7.15.2-linux-x86_64.tar.gz

tar -zxvf logstash-7.15.2-linux-x86_64.tar.gz

cd /soft/logstash/logstash-7.15.2

nohup ./bin/logstash -f /soft/logstash/logstash-7.15.2/config/logstash-sample.conf &

–logstash-sample.conf可以自定义

四、安装filebeat

linux安装filebeat
mkdir -p /soft/filebeat
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.9.3-linux-x86_64.tar.gz
tar -zxvf filebeat-7.9.3-linux-x86_64
修改filebeat.yml

nohup ./filebeat -e -c filebeat.yml >/dev/null 2>&1 &

五、日志采集方式：

1、Filebeat-Es-Kibana
filebeat服务：
根据配置的filebeat.yml，配置采集的日志文件路径，配置日志输出到Es中去

filebeat.inputs:

- type: log
  enabled: true

  paths:
    - /usr/myapp/logs/info.log
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
#  hosts: ["11111:9200"]
#  index: "u-%{+yyyy.MM.dd}"

Es服务：服务正常即可
Kibana服务：修改kibana.yml

server.host: "0.0.0.0"
elasticsearch.hosts: ["http://139.224.234.236:9200"]

2、logstash-Es-Kibana
logstash服务：
根据配置的logstash-sample.conf，配置采集的日志文件路径，配置日志输出到Es中去

input {
    file{
    path => ['/soft/*.log']
    type => 'user_log'
    start_position => "beginning"
  }
}
          
output { 
  elasticsearch {
    hosts => ["http://139.224.234.236:9200"]
    index => "ubs-%{+YYYY.MM.dd-HH}"
    #user => "elastic"
    #password => "changeme" 
  }   
}

# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
#  hosts: ["11111:9200"]
#  index: "u-%{+yyyy.MM.dd}"

Es服务：服务正常即可
Kibana服务：修改kibana.yml

server.host: "0.0.0.0"
elasticsearch.hosts: ["http://139.224.234.236:9200"]

3、Filebeat-logstash-Es-Kibana

filebeat服务：
根据配置的filebeat.yml，配置采集的日志文件路径，配置日志输出到logstash中去

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /soft/logs/*.log
    - /soft/logs/error.log
    
output.logstash:
  hosts: ["10.103.30.233:8035","10.103.30.233:8036"]
  loadbalance: true

logstash服务：

input {
  beats {
    port => 8035
    codec => "json"
  }
}
          
output { 
  elasticsearch {
    hosts => ["http://139.224.234.236:9200"]
    index => "ubs-%{+YYYY.MM.dd-HH}"
    #user => "elastic"
    #password => "changeme" 
  }   
}

Es服务：服务正常即可
Kibana服务：修改kibana.yml

server.host: "0.0.0.0"
elasticsearch.hosts: ["http://139.224.234.236:9200"]