先下载安装包,也是需要安装jdk和logstash。
[root@node6 ~]#wget http://192.168.137.53/yum/Elasticsearch/jdk-8u191-linux-x64.rpm
[root@node6 ~]#wget http://172.20.7.53/yum/Elasticsearch/logstash-6.4.3.rpm
安装jdk、logstash
[root@node6 ~]#yum -y install logstash-6.4.3.rpm jdk-8u191-linux-x64.rpm
检查logstash是否正常,只要能正常显示帮助信息即可。
[root@node7 ~]#/usr/share/logstash/bin/logstash --help
-n 指定当前节点的名称
-f 指定配置文件的路径
-e 标准输入的方式来配置
-t 测试语法
测试logstash
[root@node7 ~]#/usr/share/logstash/bin/logstash -e 'input { stdin{}} output {stdout{}}'
# 看到最后这句话说明已经成功启动,在后续输入字符后格式化之后输出显示结果
[INFO ] 2018-11-29 12:56:06.194 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
# 手动输入
hello world
{
"host" => "node7.dklwj.com",
"@version" => "1",
"@timestamp" => 2018-11-29T04:58:26.160Z,
"message" => "hello world"
}
[INFO ] 2018-11-29 12:56:06.194
{
"host" => "node7.dklwj.com",
"@version" => "1",
"@timestamp" => 2018-11-29T04:59:10.752Z,
"message" => "[INFO ] 2018-11-29 12:56:06.194"
}
输出到文件里面,需要手动输入字符才会生成相对应的文件
[root@node7 ~]#/usr/share/logstash/bin/logstash -e 'input { stdin{}} output {file { path => "/tmp/output.txt" }}'
[INFO ] 2018-11-29 13:11:42.870 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
1
1
1[INFO ] 2018-11-29 13:12:10.300 [Ruby-0-Thread-6: :1] file - Opening file {:path=>"/tmp/output.txt"}
fdfd
dfd
dfa
dfa
fa
dfa
# 新打开一个终端用tail -f 动态加载这个文件然后在另一端继续输入文字
[root@node7 ~]#tail -f /tmp/output.txt
{"message":"1","host":"node7.dklwj.com","@version":"1","@timestamp":"2018-11-29T05:12:10.094Z"}
{"message":"1","host":"node7.dklwj.com","@version":"1","@timestamp":"2018-11-29T05:12:09.843Z"}
{"message":"1","host":"node7.dklwj.com","@version":"1","@timestamp":"2018-11-29T05:12:10.365Z"}
{"message":"fdfd","host":"node7.dklwj.com","@version":"1","@timestamp":"2018-11-29T05:12:24.298Z"}
{"message":"dfd","host":"node7.dklwj.com","@version":"1","@timestamp":"2018-11-29T05:12:25.027Z"}
{"message":"dfa","host":"node7.dklwj.com","@version":"1","@timestamp":"2018-11-29T05:12:25.412Z"}
{"message":"dfa","host":"node7.dklwj.com","@version":"1","@timestamp":"2018-11-29T05:12:25.749Z"}
{"message":"fa","host":"node7.dklwj.com","@version":"1","@timestamp":"2018-11-29T05:12:26.097Z"}
{"message":"dfa","host":"node7.dklwj.com","@version":"1","@timestamp":"2018-11-29T05:12:26.394Z"}
输出到elk服务器上去
启动之后在后面输入一些测试内容,然后它是不会在当前终端上显示出来,需要用浏览器打开elk服务器的地址+9100端口
[root@node7 ~]#/usr/share/logstash/bin/logstash -e 'input { stdin{}} output {elasticsearch { hosts => ["172.20.7.50:9200"] index => "test-%{+YYYY.MM.dd}"}}'
[INFO ] 2018-11-29 13:23:15.698 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
hello world
接下来开始安装前端展示kibana图形
还是跟elk-head安装一样,跑在docker里面
先下载打包好的kibana镜像文件
[root@node1 ~]#wget http://192.168.3.53/yum/Elasticsearch/kibana_docker-image_6.4.3.tar.gz
把下载好的镜像文件导入到docker images里面去
[root@node1 ~]#docker load -i kibana_docker-image_6.4.3.tar.gz
f972d139738d: Loading layer 208.8MB/208.8MB
bf4884a66d65: Loading layer 27.92MB/27.92MB
fd1a35685127: Loading layer 2.56kB/2.56kB
24d0eaf4a529: Loading layer 559.9MB/559.9MB
96d0c6a3b847: Loading layer 4.096kB/4.096kB
a55297057152: Loading layer 9.216kB/9.216kB
d80d8e5025ea: Loading layer 7.68kB/7.68kB
17579ca9208b: Loading layer 8.704kB/8.704kB
3c3df3ec2abb: Loading layer 306.7kB/306.7kB
Loaded image: kibana:6.4.3
在宿主机上创建一个配置文件,用于后续起容器时绑定配置文件
[root@node1 ~]#vim kibana.yml
---
#Default Kibana configuration from kibana-docker.
server.name: kibana
server.host: "0"
elasticsearch.url: http://192.168.3.50:9200
xpack.monitoring.ui.container.elasticsearch.enabled: true
启动kibana容器,绑定配置文件、把kibana的5601端口号暴露出来
[root@node1 ~]#docker run --name kibana -d -p 15601:5601 -v /root/kibana.yml:/usr/share/kibana/config/kibana.yml kibana:6.4.3
087da7310c1fc722bd932a904987922d177374f2b7a03c4568ddd5f571564d52
查看已有的容器
通过浏览器访问 宿主机的IP+容器暴露时使用的端口来访问kibana的默认界面
转载于:https://blog.51cto.com/dklwj/2362858