实验环境
centos7
jdk8
EL(F)K7.8.0
ELK包下载
下载地址:https://www.elastic.co/cn/downloads/
例为filebeat下载,其他es、logstash、kibana类似下载rpm64版本
安装前准备
网络设备配置:配置syslog接收服务器的ip即端口(安装logstash或者filebeat的服务器IP,端口例为514/udp)
关闭selinux:
setenforce 0
sed --follow-symlinks -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config
关闭防火墙或开启ELK端口
关闭防火墙:systemctl stop firewalld(不建议)
或仅开启相应端口:本例为kibana端口和514/udp
firewall-cmd --permanent --add-port=5601/tcp
firewall-cmd --permanent --add-port=514/udp
firewall-cmd --reload
Java环境安装
centos7yum安装java默认为8版本:yum install java -y
安装部署
ELK安装
rpm -ivh elasticsearch-7.8.0-x86_64.rpm logstash-7.8.0.rpm kibana-7.8.0-x86_64.rpm filebeat-7.8.0-x86_64.rpm filebeat-7.8.0-x86_64.rpm
es配置启动:
vim /etc/elasticsearch/elasticsearch.yml
node.name: node-1 #集群IP,默认注释,可默认配置
path.data: /var/lib/elasticsearch #存储路劲
path.logs: /var/log/elasticsearch #日志路径
network.host: 192.168.0.1 #主机IP,根据实际配置,默认注释,为本机127.0.0.1访问
http.port: 9200 #端口,默认9200
systemctl start elasticsearch.service #启动服务
systemctl enable elasticsearch.service #配置开机自启动
查看端口是否正常启动:netstart -lntup
kibana配置启动:
vim /etc/kibana/kibana.yml
server.port: 5601 #端口
server.host: "0.0.0.0" #主机IP
elasticsearch.hosts: ["http://127.0.0.1:9200"] #ES地址
systemctl start kibana #启动服务
systemctl enable kibana #配置开机自启动
查看端口是否正常启动:netstart -lntup
日志收集服务配置:logstash或filebeat任选其一配置启动即可
logstash配置启动:
vim /etc/logstash/conf.d/usg.conf
input{
udp{
port => 514 #用于接收交换机和路由器的日志的服务器端口
type => "USG"
}
}
output{
elasticsearch{
hosts => ["127.0.0.1:9200"] #ES地址
index => "system-log-%{+YYYY.MM}" #每月索引,每天为(system-log-%{+YYYY.MM.DD})
}
}
直接启动会遇到报错
解决办法,修改服务启动用户,以root用户启动:
vim /etc/systemd/system/logstash.service
systemctl daemon-reload #服务配置生效
systemctl start logstash.service #启动服务
systemctl enable logstash.service #配置开机自启动
查看端口是否正常监听:netstart -lntup
filebeat配置启动:
vim /etc/filebeat/filebeat.yml
#修改filebeat.inputs
filebeat.inputs:
- type: udp
host: "0.0.0.0:514"
tags: ["syslog"]
#修改output.elasticsearch
output.elasticsearch:
hosts: ["127.0.0.1:9200"]
index: system-log-%{+yyyy.MM.dd} #配置index后下面两项必须配置,不然会报错,格式顶格
setup.template.name: "filebeattest"
setup.template.pattern: "filebeattest-*"
注意:配置index参数必须配置下面两项配置,不然报错Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch(/var/log/messages查看具体报错为:Exiting: setup.template.name and setup.template.pattern have to be set if index name is modified)
systemctl start filebeat.service #启动服务器
systemctl enable filebeat.service #配置开机自启动
查看端口是否正常监听:netstart -lntup
kibana访问
访问地址:http://ip:5601
简单引用查询es数据
-----------日常记录---------------