ELK的安装教程 20190426

思路：先安装elasticsearch:储存、索引，后安装kibana:展示，准备环境：三台物理机172.18.9.200,172.18.9.201,172.18.9.202，做elasticsearch集群：为保证效果特额外添加一块单独的500G的数据磁盘并格式化挂载到/esdata

一、检测Java版本，需在1.8.0以上方可！
[root@200/201/202 ~]#java -version
openjdk version "1.8.0_181"
OpenJDK Runtime Environment (build 1.8.0_181-b13)
OpenJDK 64-Bit Server VM (build 25.181-b13, mixed mode)

二、[root@/200/201/202 src]#yum -y install elasticsearch-6.5.4.rpm
三、[root@200/201/202 src]#mkdir /esdata #创建存放path的目录
四、[root@200/201/202 ~]#vim /etc/elasticsearch/elasticsearch.yml
cluster.name:linux35 #三台name要一致，否则创建集群失败
node.name: node1 2 3
path.data: /esdata/data
path.logs: /esdata/logs
network.host: 0.0.0.0 #可以指定IP，也可以所以IP
http.port: 9200
discovery.zen.ping.unicast.hosts: ["172.18.9.200", "172.18.9.201","172.18.9.202"]

五、[root@200/201/202 ~]#fdisk -l #可知新建磁盘在/dev/sdb目录
Disk /dev/sdb: 21.5 GB, 21474836480 bytes, 41943040 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
[root@200/201/202 ~]# mkfs.xfs /dev/sdb #格式化新建磁盘
meta-data=/dev/sdb isize=512 agcount=4, agsize=32768000 blks
= sectsz=512 attr=2, projid32bit=1
= crc=1 finobt=0, sparse=0
data = bsize=4096 blocks=131072000, imaxpct=25
= sunit=0 swidth=0 blks
naming =version 2 bsize=4096 ascii-ci=0 ftype=1
log =internal log bsize=4096 blocks=64000, version=2
= sectsz=512 sunit=0 blks, lazy-count=1
realtime =none extsz=4096 blocks=0, rtextents=0

六、挂载至新建目录中，此时只要elasticsearch一旦启动，数据会写入/esdata/中，也就是写入/dev/sdb中
[root@200/201/202 ~]#mount /dev/sdb /esdata/
[root@200/201/202 ~]#

七、确保开机自动挂载：[root@200/201/202 ~]#vim /etc/fstab
/dev/sdb /esdata xfs defaults 0 0

八、此时还有可能会启动失败，可能是elasticsearch的权限导致的，所以修改权限：
[root@200/201/202 ~]#id elasticsearch
uid=988(elasticsearch) gid=982(elasticsearch) groups=982(elasticsearch)
[root@200/201/202 ~]#chown elasticsearch.elasticsearch /esdata/ -R #保证用户对/esdata/有读写权限

九、启动elasticsearch服务并访问，此时/esdata文件会有数据生成，(若没生成就是权限设置问题)：
[root@centos7 ~]#systemctl start elasticsearch
[root@centos7 ~]#ll /esdata/
total 0
drwxr-xr-x 3 elasticsearch elasticsearch 19 May 9 13:33 data
drwxr-xr-x 2 elasticsearch elasticsearch 195 May 9 13:33 logs
[root@centos7 ~]#ss -ntl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 :::9200 :::
LISTEN 0 128 :::9300 :::

十、调整内存为2G:[root@200/201/202 ~]#vim /etc/elasticsearch/jvm.options
-Xms2g
-Xmx2g
[root@200/201/202 ~]#systemctl restart elasticsearch

十一、安装elasticsearch插件之head：
[root@200/201/202 ~]#vim /etc/elasticsearch/elasticsearch.yml
http.cors.enabled: true
http.cors.allow-origin: "*" #在文末添加！
[root@200/201/202 ~]#systemctl restart elasticsearch

十二、使用docker镜像安装head：
[root@200 yum.repos.d]#wget https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
在此处我的yum源配置有问题，所以我在某度上找到答案：安装了17.03版的docker：
[root@200 yum.repos.d]# yum install docker-ce-17.03.2.ce-1.el7.centos
[root@200 src]#ls
elasticsearch-head-docker.tar.gz #将docker的head包上传至src文件：
[root@200 src]#docker load -i /usr/local/src/elasticsearch-head-docker.tar.gz
b6ca02dfe5e6: Loading layer 128.9 MB/128.9 MB
60a0858edcd5: Loading layer 45.19 MB/45.19 MB
53c779688d06: Loading layer 126.6 MB/126.6 MB
0a5e2b2ddeaa: Loading layer 330.5 MB/330.5 MB
fa18e5ffd316: Loading layer 352.3 kB/352.3 kB
604c78617f34: Loading layer 113.7 kB/113.7 kB
cf2eea3d6e04: Loading layer 50.16 MB/50.16 MB
d556e03b8284: Loading layer 2.56 kB/2.56 kB
95ea76455b84: Loading layer 12.72 MB/12.72 MB
ce5705289a91: Loading layer 4.096 kB/4.096 kB
d09533ddfc0d: Loading layer 143.3 MB/143.3 MB
eb415bbb4658: Loading layer 23.71 MB/23.71 MB
Loaded image: mobz/elasticsearch-head:5
[root@200 src]#docker images #查看镜像
REPOSITORY TAG IMAGE ID CREATED SIZE
mobz/elasticsearch-head 5 b19a5c98e43b 2 years ago 824 MB
[root@200 src]#docker run -d -it -p 9100:9100 mobz/elasticsearch-head:5
cd3d8ea58d5c9656492a33881057236869c3dbfcb6e62c39c09f9af15d2bb86f
[root@200 src]#docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
cd3d8ea58d5c mobz/elasticsearch-head:5 "/bin/sh -c 'grunt..." 13 seconds ago Up 9 seconds 0.0.0.0:9100->9100/tcp optimistic_aryabhata

十三、此时去访问172.18.9.200的9100的端口：

十四、在172.18.9.201主机安装kibana:(可以与elasticsearch不在一起)：
[root@201 ~]#yum install -y kibana-6.5.4-x86_64.rpm
[root@201 ~]#vim /etc/kibana/kibana.yml
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.url: "http://172.18.9.200:9200" #可以是200主机的IP.
[root@201 ~]#systemctl start kibana
[root@201 ~]#systemctl enable kibana
Created symlink from /etc/systemd/system/multi-user.target.wants/kibana.service to /etc/systemd/system/kibana.service.
[root@201 ~]#ss -ntl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 :5601 :*

十五、访问kibana的页面：

十六、再看elasticsearch-head：

转载于:https://blog.51cto.com/14128387/2391917