JDK8
[root@wallet01 ~]# yum remove -y java-1.7.0-openjdk
[root@wallet01 ~]# yum remove -y java-1.6.0-openjdk
[root@wallet01 ~]# tar zxvf jdk-8u161-linux-x64.tar.gz -C /usr/local/
[root@wallet01 ~]# vi /etc/profile
JAVA_HOME=/usr/local/jdk1.8.0_161
JAVA_BIN=/usr/local/jdk1.8.0_161/bin
PATH=$PATH:$JAVA_BIN
CLASSPATH=$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
export JAVA_HOME JAVA_BIN PATH CLASSPATH
[root@wallet01 ~]# source /etc/profile
[root@wallet01 ~]# java -version
java version "1.8.0_161"
Java(TM) SE Runtime Environment (build 1.8.0_161-b12)
Java HotSpot(TM) 64-Bit Server VM (build 25.161-b12, mixed mode)
ElasticSearch
[root@wallet01 ~]# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
[root@wallet01 ~]# vim /etc/yum.repos.d/elasticsearch.repo
[elasticsearch-6.x]
name=Elasticsearch repository for 6.x packages
baseurl=https://artifacts.elastic.co/packages/6.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
[root@wallet01 ~]# yum install -y elasticsearch
[root@wallet01 ~]# vim /etc/elasticsearch/elasticsearch.yml
cluster.name: my-application
node.name: wallet01
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
bootstrap.memory_lock: true
bootstrap.system_call_filter: false
network.host: 192.168.1.201
http.port: 9200
discovery.zen.ping.unicast.hosts: ["wallet01"]
[root@wallet01 ~]# vi /etc/security/limits.conf
* soft nofile 65536
* hard nofile 65536
* soft nproc 4096
* hard nproc 4096
* soft memlock unlimited
* hard memlock unlimited
[root@wallet01 ~]# vim /etc/security/limits.d/90-nproc.conf
* soft nproc 4096
root soft nproc unlimited
[root@wallet01 ~]# /etc/init.d/elasticsearch start
[root@wallet01 ~]# /etc/init.d/elasticsearch status
elasticsearch (pid 18338) is running...
[root@wallet01 ~]# cat /var/log/elasticsearch/my-application.log
[root@wallet01 ~]# curl http://192.168.1.201:9200/
{
"name" : "wallet01",
"cluster_name" : "elk-cluster",
"cluster_uuid" : "oGuBJsi3SZyYnCT4PvuNgA",
"version" : {
"number" : "5.6.8",
"build_hash" : "688ecce",
"build_date" : "2018-02-16×××6:46:30.010Z",
"build_snapshot" : false,
"lucene_version" : "6.6.1"
},
"tagline" : "You Know, for Search"
}
Logstash
[root@wallet01 ~]# yum install -y logstash
[root@wallet01 ~]# ln -s /usr/share/logstash/bin/logstash /bin/
[root@wallet01 ~]# mkdir -p /usr/share/logstash/config/
[root@wallet01 ~]# chown -R logstash:logstash /usr/share/logstash/config/
[root@wallet01 ~]# ln -s /etc/logstash/* /usr/share/logstash/config
[root@wallet01 ~]# vim /etc/logstash/conf.d/elk.conf
input {
syslog {
port => "514"
}
}
output {
elasticsearch {
hosts => ["192.168.1.201:9200"]
index => "syslog-%{+YYYY.MM.dd}"
}
}
[root@wallet01 ~]# logstash -f /etc/logstash/conf.d/elk.conf&
[root@wallet01 ~]# cat /var/log/logstash/logstash-plain.log
[root@wallet01 ~]# netstat -tunlp | grep 514
tcp 0 0 :::514 :::* LISTEN 18713/java
udp 0 0 :::514 :::* 18713/java
Kibana
[root@wallet01 ~]# yum install -y kibana
[root@wallet01 ~]# vim /etc/kibana/kibana.yml
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.url: "http://192.168.1.201:9200"
[root@wallet01 ~]# /etc/init.d/kibana start
kibana started
[root@wallet01 ~]# /etc/init.d/kibana status
kibana is running
客户端
[root@wallet02 ~]# vi /etc/rsyslog.conf
*.* @192.168.1.201:514
[root@wallet02 ~]# vi /etc/bashrc
export PROMPT_COMMAND='{ msg=$(history 1 | { read x y; echo $y; });logger "[euid=$(whoami)]":$(who am i):[`pwd`]"$msg"; }'
[root@wallet02 ~]# service rsyslog restart
转载于:https://blog.51cto.com/13598811/2074326