elk 日志收集系统

同步时间

[root@localhost ~]# yum -y install ntpdate
[root@localhost ~]# ntpdate ntp1.aliyun.com

安装java-1.8

[root@localhost ~]# yum install java-1.8.0-openjdk -y

修改打开文件最大数

[root@localhost ~]# cat /etc/sysctl.conf
					vm.max_map_count = 655360
[root@localhost ~]# sysctl -p					

部署es

[root@localhost ~]# rpm -ivh elasticsearch-6.4.1.rpm 
[root@localhost ~]# grep '^[a-Z]' /etc/elasticsearch/elasticsearch.yml

cluster.name: elk          #集群名称
node.name: elk-01                   #节点名称
node.master: true                   #当前节点为集群master
node.data: true                 #当前为数据节点
path.data: /var/lib/elasticsearch    #数据存放位置
path.logs: /var/log/elasticsearch   #日志存放位置
network.host:  192.168.220.172         #监听的IP地址
http.port: 9200                 #监听的端口
discovery.zen.ping.unicast.hosts: ["elk-01"]  #集群节点的主机名或IP地址

[root@localhost ~]# systemctl start elasticsearch.service
[root@localhost ~]# systemctl enable elasticsearch.service
[root@localhost ~]# curl '192.168.220.172:9200/_cluster/health?pretty'

部署kibana

[root@localhost ~]# rpm -ivh kibana-6.4.1-x86_64.rpm 
[root@localhost ~]# vim /etc/kibana/kibana.yml 

server.port: 5601                               #kibana监听的端口
server.host: "192.168.220.172"                      #kibana监听的IP地址
elasticsearch.url: "http://192.168.220.172:9200"        #kibana连接ES集群master节点地址

[root@localhost ~]# systemctl enable kibana
[root@localhost ~]# systemctl start kibana.service 
[root@localhost ~]# firefox 192.168.220.172:5601

部署filebeat

[root@localhost ~]# rpm -ivh filebeat-6.4.1-x86_64.rpm 
[root@localhost ~]# vim /etc/filebeat/filebeat.yml 

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/messages
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
setup.kibana:
output.elasticsearch:
  hosts: ["192.168.220.172:9200"]

[root@localhost ~]# systemctl start filebeat
[root@localhost ~]# systemctl enable filebeat

配置ka展示日志