ELK+filebeat单机版搭建

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12

5）重启ES，配置密码

/usr/local/ElasticSearch/bin/elasticsearch-setup-passwords interactive

Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
 
You will be prompted to enter passwords as the process progresses.
 
Please confirm that you would like to continue [y/N]y
 
Enter password for [elastic]:
 
Reenter password for [elastic]:
 
Enter password for [apm_system]:
 
Reenter password for [apm_system]:
 
Enter password for [kibana]:
 
Reenter password for [kibana]:
 
Enter password for [logstash_system]:
 
Reenter password for [logstash_system]:
 
Enter password for [beats_system]:
 
Reenter password for [beats_system]:
 
Enter password for [remote_monitoring_user]:
 
Reenter password for [remote_monitoring_user]:
 
Changed password for user [apm_system]
 
Changed password for user [kibana]
 
Changed password for user [logstash_system]
 
Changed password for user [beats_system]
 
Changed password for user [remote_monitoring_user]
 
Changed password for user [elastic]

6）登录验证

6、完整elasticsearch.yml

cluster.name: elk-cluster

node.name: elk-node1

node.data: true

node.master: true

network.bind_host: 0.0.0.0

network.publish_host: 192.168.18.151

bootstrap.memory_lock: false

http.cors.enabled: true

http.cors.allow-origin: "*"

http.cors.allow-headers: Authorization,X-Requested-With,Content-Length,Content-Type

http.port: 9201

transport.port: 9301

discovery.seed_hosts: ["192.168.18.151:9301"]

cluster.initial_master_nodes: ["elk-node1"]

network.host: 0.0.0.0

#path.data: /usr/share/elasticsearch/data

#path.logs: /usr/share/elasticsearch/logs

xpack.security.enabled: true
 xpack.security.transport.ssl.enabled: true
 xpack.security.transport.ssl.verification_mode: certificate
 xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
 xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12

7、shell脚本

1）start.sh

export ES_PATH_CONF=/home/es/elk/elasticsearch-7.6.2/config

bin/elasticsearch -d

2）stop.sh

#!/bin/bash

pro_patten="elasticsearch-7.6.2"

current_pid_list=$(ps -ef | grep $pro_patten | grep -v grep | awk '{print $2}')

for current_pid in $current_pid_list

kill -9 $current_pid

done

3）delete.sh

定时删除无效索引数据

二、安装kibana

1、下载安装包，上传解压

https://www.elastic.co/cn/downloads/past-releases/kibana-7-6-2

2、完整kibana.yml

server.name: elk-kibana

server.host: "0.0.0.0"

elasticsearch.hosts: [ "http://192.168.18.151:9201" ]

xpack.monitoring.ui.container.elasticsearch.enabled: true

elasticsearch.username: "kibana"

elasticsearch.password: "elastic"

i18n.locale: "zh-CN"

3、shell脚本

1）start.sh

nohup bin/kibana &

2）stop.sh

#!/bin/bash

pro_patten=".*node/bin/node.*src/cli"

pid=`ps -ef | grep $pro_patten | grep -v grep | awk '{print $2}'`

if [ -n "$pid" ] ;then

echo "kill -9 的pid:" $pid

kill -9 $pid

三、安装logstash

1、下载安装包，上传解压

https://www.elastic.co/cn/downloads/past-releases/logstash-7-6-2

2、shell脚本

1）start.sh

nohup /usr/local/logstash-7.6.2/bin/logstash -f /usr/local/logstash-7.6.2/config/logstash-test.conf &>/usr/local/logstash-7.6.2/logs/nohup.log&

2）stop.sh

#!/bin/bash

pro_patten="logstash"

pid=`ps -ef | grep $pro_patten | grep -v grep | awk '{print $2}'`

if [ -n "$pid" ] ;then

echo "kill -9 的pid:" $pid

kill -9 $pid

四、安装filebeat

1、下载安装包，上传解压

https://www.elastic.co/cn/downloads/past-releases/filebeat-7-6-2

2、linux-shell脚本

1）start.sh

#!/bin/bash

echo "***********************************"

jar_name=filebeat.yml

pid=`ps -ef | grep $jar_name | grep -v grep | awk '{print $2}'`

if [ -n "$pid" ] ;then

echo "kill -9 的pid:" $pid

kill -9 $pid

cd /usr/local/filebeat-7.6.2

echo "执行……"

#nohup ./filebeat -e -c filebeat.yml > nohup.log &

nohup ./filebeat -e -c filebeat.yml > logs/nohup.out 2>&1&

echo "*****************filebeat启动成功******************"

2）stop.sh

#!/bin/bash

jar_name=filebeat.yml

pid=`ps -ef | grep $jar_name | grep -v grep | awk '{print $2}'`

if [ -n "$pid" ] ;then

#!kill -9 强制停止

echo "kill -9 的pid:" $pid

kill -9 $pid

3）checkFilebeatHeath.sh

#!/bin/bash

pro_patten="filebeat.yml"

pid=`ps -ef | grep $pro_patten | grep -v grep | awk '{print $2}'`

file_path=/usr/local/filebeat-7.6.2

starttime=$(date +%Y-%m-%d\ %H:%M:%S)

if [ -z "${pid}" ]; then

echo "$starttime 程序死了,现在启动" >> $file_path/logs/cron.log

sh $file_path/start.sh

vim /var/spool/cron/root

*/2 * * * * /usr/local/filebeat-7.6.2/checkFilebeatHeath.sh >> /tools/logs/check.o.log 2>> /tools/logs/check.e.log

3、windows添加进服务

.\install-service-filebeat.ps1

若报错禁止执行脚本，先执行，再执行.\install-service-filebeat.ps1即可添加进服务

anhao78

关注

0
点赞
踩
3

收藏

觉得还不错? 一键收藏
0
评论
ELK+filebeat单机版搭建

目录一、安装Elasticsearch1、下载安装包，上传解压2、新建es用户3、帐号赋予目录权限4、设置一些用户相关的限制5、配置密码1）生成CA证书2）生成p12秘钥3）拷贝p12秘钥文件4）修改配置文件5）重启ES，配置密码6）登录验证6、完整elasticsearch.yml7、shell脚本1）start.sh2）stop.sh3）delete.sh二、安装kibana1、下载安装包，上传解压2、完整kibana.
复制链接

扫一扫