Centos7.9安装Elasticsearch, Logstash, and Kibana (ELK Stack)

1.elashticsearch禁止使用root账户启动

通过SSH登录服务器

useradd elk

passwd elk

chmod 640 /etc/sudoers

vi /etc/sudoers

chmod 440 /etc/sudoers

2.安装OpenJDK 8 Java

sudo yum -y install java-1.8.0-openjdk

java -version

3.添加Elasticsearch存储库

sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

cd /etc/yum.repos.d/

vi elasticsearch.repo

[elasticstack]

name=Elastic repository for 7.x packages

baseurl=https://artifacts.elastic.co/packages/7.x/yum

gpgcheck=1

gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch

enabled=1

autorefresh=1

type=rpm-md

sudo yum -y update

4.安装和设置Elasticsearch

sudo yum -y install elasticsearch

vi /etc/elasticsearch/jvm.options

-Xms4g

-Xmx4g

5.配置Elasticsearch

sudo vi /etc/elasticsearch/elasticsearch.yml

network.host: localhost

http.port: 9200

discovery.seed_hosts: ["0.0.0.0"]

sudo reboot

6.配置Elasticsearch

root用户启用服务报错

su - elk

sudo systemctl start elasticsearch

sudo systemctl enable elasticsearch

7.测试 Elasticsearch

curl -X GET "localhost:9200"

8.安装Kibana

sudo yum -y install kibana

kibana页面设置成中文

#vim /etc/kibana/kibana.yml       #默认路径

i18n.locale: "zh-CN"                 #文档最后输入，注意冒号后面的空格

9.设置Kibana

sudo vi /etc/kibana/kibana.yml

server.port: 5601

server.host: "0.0.0.0"

elasticsearch.hosts: ["http://172.18.8.201:9200"]

启动并启用Kibana

sudo systemctl start kibana

sudo systemctl enable kibana

10.测试Kibana

http://172.18.8.201:5601/app/home#/

11.安装Logstash

sudo yum -y install logstash

sudo systemctl start logstash

sudo systemctl enable logstash

12.安装Filebeat

sudo yum -y install filebeat

添加系统模块该模块将检查本地系统日志

sudo filebeat modules enable system

运行Filebeat设置系统会做一些工作扫描你的系统并连接到Kibana仪表盘

sudo filebeat setup

启动Filebeat服务

sudo service filebeat start

点击Log——Stream可以看到本地日志文件的实时数据流

13.安装Metricbeat

sudo rpm -vi metricbeat-7.14.0-x86_64.rpm

sudo metricbeat modules enable system

sudo metricbeat setup

sudo service metricbeat start