环境:
CentOS 7,JDK1.8,Elasticsearch6.3.2,Logstash6.3.2,Kibana6.3.2
摘要说明:
前面几节已经简单的介绍了elk各个组件之间的作用及基础使用,这里在总结下服务器无网下的安装及配置实例
步骤:
一.下载ELK
由于无网情况下,且jdk为1.8这里选择6.3.2:
https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.3.2.tar.gz
https://artifacts.elastic.co/downloads/logstash/logstash-6.3.2.tar.gz
https://artifacts.elastic.co/downloads/kibana/kibana-6.3.2-linux-x86_64.tar.gz
二、安装elasticsearch
1、解压elasticsearch;
tar -zxvf elasticsearch-6.3.2.tar.gz
目录如下:
2、修改配置:
vi config/elasticsearch.yml
修改内容如下:
path.data: /app/elk/path/to/data
path.logs: /app/elk/path/to/logs
network.host: 0.0.0.0
http.port: 9200
3、启动:
cd bin
nohup ./elasticsearch &
4.访问http://ip:9200/查看是否完成配置
三、安装logstash
1、解压logstash
tar -zxvf logstash-6.3.2.tar.gz
创建config.d:
2、下面是监控多个日志文件输入,将日志输出到elasticsearch并指定多个index
input {
file {
type => "app"
path => ["/home/appuser/app/logs/info.log","/home/appuser/app/logs/error.log"]
start_position => "end"
ignore_older => 0
codec => multiline {
pattern => "^\["
negate => true
what => "previous"
}
sincedb_path => "/dev/null"
}
file {
type => "claim"
path => ["/home/appuser/claimPlatform/logs/info.log","/home/appuser/claimPlatform/logs/error.log"]
start_position => "end"
ignore_older => 0
codec => multiline {
pattern => "^\["
negate => true
what => "previous"
}
sincedb_path => "/dev/null"
}
}
filter {
mutate {
rename => { "[host][name]" => "host" }
}
}
output {
stdout { codec => "rubydebug" }
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "%{type}-%{+YYYY.MM.dd}"
action => "index"
template_name => "%{type}"
}
}
3、启动logstash;
cd bin
nohup ./logstash -f /app/logstash-6.3.2/config.d/ &
三、安装Kibana
1、解压Kibana
tar -zxvf kibana-6.3.2-linux-x86_64.tar.gz
2、修改配置
vi config/kibana.yml
修改配置如下:
server.port: 5601
server.host: "xxx.xxx.xxx.xxx"
elasticsearch.url: "http://localhost:9200"
3、启动
cd bin
nohup ./kibana &
4、访问:http://ip:5601配置index:
5、搜索日志,注意说明输入整词匹需添加””:
四、总结
1、jdk版本决定elk版本;
2、elk版本需要一致;
3、搜索日志整词需要使用“”;