基本环境
属性 | 参数 |
---|---|
操作系统 | OpenEuler22.09 |
JDK | 8u181 |
ElasticSearch | 6.8.23 |
Kibana | 6.8.23 |
Logstash | 6.8.23 |
备注:提前关闭防火墙和内核保护!所需软件包需提前下载好并解压至指定目录
# 运行软件时需要切换至非root用户才能正常运行
$ groupadd ela 创建ela组
$ useradd -g ela ela 创建ela用户,并且加入ela组
$ passwd ela 为ela用户设定登录密码
JDK安装
备注:root环境下可操作
$ tar -zxvf /opt/jdk-8u181-linux-x64.tar.gz
$ vi /etc/bashrc #root下操作
# elasticsearch self jdk
export JAVA_HOME=/opt/jdk1.8.0_181
export JRE_HOME=${JAVA_HOME}/jre
export CLASSPATH=.:${JAVA_HOME}/lib/dt.JAVA_HOME/lib/tools.jar:${JRE_HOME}/lib
export PATH=${JAVA_HOME}/bin:${PATH}
$ java -version
ElasticSearch 安装与配置
1、解压软件(可root下的操作)
$ tar zxvf elasticsearch-6.8.23.tar.gz -C /opt/elk
2、配置(可root下的操作)
vi /opt/elk/elasticsearch-6.8.23/config/elasticsearch.yml
cluster.name: elk
node.name: node-1
path.data: /data/elk/elkdata
path.logs: /var/log/elkdata
network.host: 0.0.0.0
3、设置文件夹的权限给指定用户(可root下的操作)
chown -R ela /opt/elk
chown -R ela /data/elk/elkdata
chown -R ela /var/log/elkdata
4、后台运行(非root下的操作)
$ /opt/elk/elasticsearch-6.8.23/bin/elasticsearch -d
5、验证
浏览器中输入地址:
http://<IP地址>:9200
6、解决异常(需root下的操作)
如果出现如下问题,需要对jdk所在文件目录授权,未出现可跳过此步!
[otroot1@monitoring ~]$ Java HotSpot(TM) 64-Bit Server VM warning: Cannot open file logs/gc.log due to Permission denied
Exception in thread "main" org.elasticsearch.bootstrap.BootstrapException: java.nio.file.AccessDeniedException: /opt/elk/elasticsearch-6.8.23/config/elasticsearch.keystore
Likely root cause: java.nio.file.AccessDeniedException: /opt/elk/elasticsearch-6.8.23/config/elasticsearch.keystore
at sun.nio.fs.UnixException.translateToIOException(UnixException.java:84)
chwon -R ela /opt/jdk1.8.0_181/
Kibana 安装与配置
1、解压(可root下的操作)
$ tar zxvf kibana-6.8.23-linux-x86_64.tar.gz -C /opt/elk
2、配置(可root下的操作)
$ vi /opt/elk/kibana-6.8.23-linux-x86_64/config/kibana.yml
#端口
server.port: 5601
#服务器IP
server.host: "10.10.114.4"
#elasticsearch服务器
elasticsearch.host: "http://10.10.114.4:9200"
3、后台运行(非root下的操作)
$ /opt/elk/kibana-6.8.23-linux-x86_64/bin/kibana &
4、验证
浏览器中输入地址:
http://<IP地址>:5601/
Logstash 安装与配置
1、解压(可root下的操作)
$ tar zxvf logstash-6.8.23.tar.gz -C /opt/elk
2、配置(可root下的操作)
$ cp /opt/elk/logstash-6.8.23/config/logstash-sample.conf /opt/elk/logstash-6.8.23/config/logstash.conf
$ vi /opt/elk/logstash-6.8.23/config/logstash.conf
# /opt/logstash-6.8.23/config/logstash.conf
# 如下内容需根据需要进行配置,如若不知可将input、filter、output设置为空,及{}
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.
input {
beats {
port => 5044
}
}
output {
elasticsearch {
hosts => ["http://monitoring:9200"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
#user => "elastic"
#password => "changeme"
}
}
3、后台运行(非root下的操作)
# 测试配置文件的正确性,并给出错误信息
$ /opt/elk/logstash-6.8.23/bin/logstash -f /opt/elk/logstash-6.8.23/config/logstash.conf --config.test_and_exit
Sending Logstash logs to /opt/elk/logstash-6.8.23/logs which is now configured via log4j2.properties
[2024-03-11T22:24:42,110][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.queue", :path=>"/opt/elk/logstash-6.8.23/data/queue"}
[2024-03-11T22:24:42,122][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.dead_letter_queue", :path=>"/opt/elk/logstash-6.8.23/data/dead_letter_queue"}
[2024-03-11T22:24:42,353][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
Configuration OK
[2024-03-11T22:24:45,885][INFO ][logstash.runner ] Using config.test_and_exit mode. Config Validation Result: OK. Exiting Logstash
# 如果可用,会输出 OK ,之后可以通过下面的命令来启动logstash
$ /opt/elk/logstash-6.8.23/bin/logstash -f /opt/elk/logstash-6.8.23/config/logstash.conf &
查看运行
可查看进程号与名称,杀掉进程请用如下命令:
$ kil -9 <进程号>
[otroot1@monitoring ~]$ jps
2410 Logstash
2042 Elasticsearch
2444 Jps