总括
主机 | IP | HOSTNAME |
---|---|---|
FileBeat | 13.13.11.5/16 | web01 |
LogStash 1 | 13.13.12.5/16 | logstash01 |
LogStash 2 | 13.13.12.6/16 | logstash02 |
Elasticsearch 1 | 13.13.13.5/16 | es01 |
Elasticsearch 2 | 13.13.13.6/16 | es02 |
Elasticsearch 3 | 13.13.13.7/16 | es03 |
Kibana | 13.13.14.5/16 | kibana |
Logstash集群搭建
參考: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html
- 软件安装
[root@logstash01 ~]# dnf install java-11-openjdk
[root@logstash01 ~]# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
[root@logstash01 ~]# ll lo*
-rw-r--r--. 1 root root 158845079 Oct 13 16:35 logstash-7.9.2.rpm
-rw-r--r--. 1 root root 148 Oct 13 16:35 logstash-7.9.2.rpm.sha512
[root@logstash01 ~]# shasum -a 512 -c logstash-7.9.2.rpm.sha512
logstash-7.9.2.rpm: OK
[root@logstash01 ~]# rpm --install logstash-7.9.2.rpm
Using provided startup.options file: /etc/logstash/startup.options
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/pleaserun-0.0.31/lib/pleaserun/platform/base.rb:112: warning: constant ::Fixnum is deprecated
Successfully created system startup script for Logstash
[root@logstash01 ~]#
- 配置
/etc/hosts
告知ES网络位置
[root@logstash02 ~]# tail -3 /etc/hosts
13.13.13.5 es01
13.13.13.6 es02
13.13.13.7 es03
[root@logstash02 ~]#
- 编写配置文件
[root@logstash01 ~]# cp /etc/logstash/logstash-sample.conf /etc/logstash/conf.d/logstash.conf
[root@logstash01 ~]# vi /etc/logstash/conf.d/logstash.conf
[root@logstash01 ~]# cat /etc/logstash/conf.d/logstash.conf
input {
beats {
port => 5044
}
}
output {
elasticsearch {
hosts => ["http://es01:9200", "http://es02:9200", "http://es03:9200"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
[root@logstash01 ~]#
- 开放防火墙端口
[root@logstash01 ~]# firewall-cmd --permanent --add-port=5044/tcp
success
[root@logstash01 ~]# firewall-cmd --reload
success
[root@logstash01 ~]#
- 启动与检验
[root@logstash01 ~]# systemctl enable logstash.service
Created symlink /etc/systemd/system/multi-user.target.wants/logstash.service → /etc/systemd/system/logstash.service.
[root@logstash01 ~]# systemctl start logstash.service
[root@logstash01 ~]# ss -tlunp | grep 5044
tcp LISTEN 0 128 *:5044 *:* users:(("java",pid=2388,fd=93))
[root@logstash01 ~]#