ubuntu环境下的elk安装指南（草稿）

修改ubuntu的软件源

• 替换掉文件：/etc/apt/source.list中的内容，使用阿里源

  deb http://mirrors.aliyun.com/ubuntu/ vivid main restricted universe multiverse
  deb http://mirrors.aliyun.com/ubuntu/ vivid-security main restricted universe multiverse
  deb http://mirrors.aliyun.com/ubuntu/ vivid-updates main restricted universe multiverse
  deb http://mirrors.aliyun.com/ubuntu/ vivid-proposed main restricted universe multiverse
  deb http://mirrors.aliyun.com/ubuntu/ vivid-backports main restricted universe multiverse
  deb-src http://mirrors.aliyun.com/ubuntu/ vivid main restricted universe multiverse
  deb-src http://mirrors.aliyun.com/ubuntu/ vivid-security main restricted universe multiverse
  deb-src http://mirrors.aliyun.com/ubuntu/ vivid-updates main restricted universe multiverse
  deb-src http://mirrors.aliyun.com/ubuntu/ vivid-proposed main restricted universe multiverse
  deb-src http://mirrors.aliyun.com/ubuntu/ vivid-backports main restricted universe multiverse
  

• 更新源

  sudo apt-get update && sudo apt-get upgrade
  

安装jdk

sudo apt-get install openjdk-8-jdk

logstash

• 安装

  wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
  sudo apt-get install apt-transport-https
  echo "deb http://artifacts.elastic.co/packages/5.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-5.x.list
  sudo apt-get update && sudo apt-get install logstash
  

  使用这种方式安装logstash后，路径默认是在/usr/share/logstash。

• 使用脚本启动

  我们在logstash目录下编写一个配置文件logstash.conf，用于启动logstash:

  input {
      stdin { }
  }
  output {
      stdout {
          codec => rubydebug
      }
  }
  

  执行以下命令：

  sudo /usr/share/logstash/bin/logstash -f logstash.conf 
  

  等待启动成功，控制台会等待我们的输入，此时我们输入：byebye world，得到如下的响应，则代表已经启动成功了：

  {
      "@timestamp" => 2017-08-19T08:20:22.089Z,
        "@version" => "1",
            "host" => "ubuntu",
         "message" => "byebye world"
  }
  

• 使用服务的方式启动

  查看服务列表：/etc/systemd/system，已经存在了logstash.service,启动该服务

  systemctl start logstash
  

  或者（旧的服务启动方式）

  service logstash start
  

  使用 ps -ef|grep logstash可以查看进程是否启动成功