安装filebeat服务(在需要收集日志的主机安装filebeat)
下载和安装key文件
rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch
创建yum源文件(版本要和elasticsearch和kibana一样)
[root@localhost ~]# vim /etc/yum.repos.d/elk-elasticsearch.repo [elastic-5.x] name=Elastic repository for 5.x packages baseurl=https://artifacts.elastic.co/packages/5.x/yum gpgcheck=1 gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch enabled=1 autorefresh=1 type=rpm-md
开始安装并启动服务
yum install filebeat systemctl start filebeat systemctl status filebeat
收集日志
[root@localhost ~]# grep "^\s*[^# \t].*$" /etc/filebeat/filebeat.yml filebeat.prospectors: - type: log enabled: true paths: - /var/xxx/*.log - /var/xxx/*.out multiline.pattern: ^\[ //multiline这三行是读取多行日志的,不把注释去掉,在kibana查看日志格式会很乱 multiline.negate: true //false改为true multiline.match: after setup.kibana: host: "192.168.1.191:5601" output.elasticsearch: hosts: ["192.168.1.191:9200"]
重启服务
systemctl restart filebeat
安装Kibana
安装
docker pull docker.io/kibana:5.6.12 docker run -it -d -e ELASTICSEARCH_URL=http://192.168.1.191:9200 --name kibana --restart=always -p 5601:5601 kibana:5.6.12