ElasticStack笔记（三）Logstash Cluster

总括

主机	IP	HOSTNAME
FileBeat	13.13.11.5/16	web01
LogStash 1	13.13.12.5/16	logstash01
LogStash 2	13.13.12.6/16	logstash02
Elasticsearch 1	13.13.13.5/16	es01
Elasticsearch 2	13.13.13.6/16	es02
Elasticsearch 3	13.13.13.7/16	es03
Kibana	13.13.14.5/16	kibana

Logstash集群搭建

參考： https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html

1. 软件安装

[root@logstash01 ~]# dnf install java-11-openjdk
[root@logstash01 ~]# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
[root@logstash01 ~]# ll lo*
-rw-r--r--. 1 root root 158845079 Oct 13 16:35 logstash-7.9.2.rpm
-rw-r--r--. 1 root root       148 Oct 13 16:35 logstash-7.9.2.rpm.sha512
[root@logstash01 ~]# shasum -a 512 -c logstash-7.9.2.rpm.sha512 
logstash-7.9.2.rpm: OK
[root@logstash01 ~]# rpm --install logstash-7.9.2.rpm 
Using provided startup.options file: /etc/logstash/startup.options
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/pleaserun-0.0.31/lib/pleaserun/platform/base.rb:112: warning: constant ::Fixnum is deprecated
Successfully created system startup script for Logstash
[root@logstash01 ~]#

2. 配置/etc/hosts告知ES网络位置

[root@logstash02 ~]# tail -3 /etc/hosts
13.13.13.5 es01
13.13.13.6 es02
13.13.13.7 es03
[root@logstash02 ~]# 

3. 编写配置文件

[root@logstash01 ~]# cp /etc/logstash/logstash-sample.conf /etc/logstash/conf.d/logstash.conf
[root@logstash01 ~]# vi /etc/logstash/conf.d/logstash.conf 
[root@logstash01 ~]# cat /etc/logstash/conf.d/logstash.conf 
input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["http://es01:9200", "http://es02:9200", "http://es03:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
  }
}
[root@logstash01 ~]# 

5. 开放防火墙端口

[root@logstash01 ~]# firewall-cmd --permanent --add-port=5044/tcp
success
[root@logstash01 ~]# firewall-cmd --reload
success
[root@logstash01 ~]# 

6. 启动与检验

[root@logstash01 ~]# systemctl enable logstash.service 
Created symlink /etc/systemd/system/multi-user.target.wants/logstash.service → /etc/systemd/system/logstash.service.
[root@logstash01 ~]# systemctl start logstash.service 
[root@logstash01 ~]# ss -tlunp | grep 5044
tcp    LISTEN  0       128                        *:5044                *:*      users:(("java",pid=2388,fd=93))                                                
[root@logstash01 ~]#