同步时间
[root@localhost ~]# yum -y install ntpdate
[root@localhost ~]# ntpdate ntp1.aliyun.com
安装java-1.8
[root@localhost ~]# yum install java-1.8.0-openjdk -y
修改打开文件最大数
[root@localhost ~]# cat /etc/sysctl.conf
vm.max_map_count = 655360
[root@localhost ~]# sysctl -p
部署es
[root@localhost ~]# rpm -ivh elasticsearch-6.4.1.rpm
[root@localhost ~]# grep '^[a-Z]' /etc/elasticsearch/elasticsearch.yml
cluster.name: elk #集群名称
node.name: elk-01 #节点名称
node.master: true #当前节点为集群master
node.data: true #当前为数据节点
path.data: /var/lib/elasticsearch #数据存放位置
path.logs: /var/log/elasticsearch #日志存放位置
network.host: 192.168.220.172 #监听的IP地址
http.port: 9200 #监听的端口
discovery.zen.ping.unicast.hosts: ["elk-01"] #集群节点的主机名或IP地址
[root@localhost ~]# systemctl start elasticsearch.service
[root@localhost ~]# systemctl enable elasticsearch.service
[root@localhost ~]# curl '192.168.220.172:9200/_cluster/health?pretty'
部署kibana
[root@localhost ~]# rpm -ivh kibana-6.4.1-x86_64.rpm
[root@localhost ~]# vim /etc/kibana/kibana.yml
server.port: 5601 #kibana监听的端口
server.host: "192.168.220.172" #kibana监听的IP地址
elasticsearch.url: "http://192.168.220.172:9200" #kibana连接ES集群master节点地址
[root@localhost ~]# systemctl enable kibana
[root@localhost ~]# systemctl start kibana.service
[root@localhost ~]# firefox 192.168.220.172:5601
部署filebeat
[root@localhost ~]# rpm -ivh filebeat-6.4.1-x86_64.rpm
[root@localhost ~]# vim /etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/messages
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 3
setup.kibana:
output.elasticsearch:
hosts: ["192.168.220.172:9200"]
[root@localhost ~]# systemctl start filebeat
[root@localhost ~]# systemctl enable filebeat
配置ka展示日志