Centos下ELK环境搭建

最新推荐文章于 2024-08-09 17:31:57 发布
最新推荐文章于 2024-08-09 17:31:57 发布
阅读量29 收藏
点赞数
文章标签： centos elk jenkins 运维 linux
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/weixin_42641157/article/details/133009173
版权

简介：

ELK = Elasticsearch+Logstash+Kibana

Elasticsearch：存储日志，处理分析日志，检索日志

Logstash：收集日志

Kibana：web界面展示日志

本来，Elasticsearch+Logstash+Kibana就可以完成一套日志的是采集，处理+检索，展示，但是Logstash是jvm实现的，耗得资源不少，部署到目标服务器(产生日志的应用服务器)占用资源多，故需比较轻量级的Filebeat部署到目标服务器采集日志

环境说明：

172.16.1.169 安装 Elasticsearch(单机)

172.16.1.69   安装Logstash

172.16.1.81   安装Kibana

172.16.1.31   安装Filebeat

当然，Elasticsearch+Logstash+Kibana+Filebeat四个家伙同时部署到1台服务器也是可以的，只要服务器性能吃得消(本人一台2核8G服务器同时部署四个家伙启动报内存溢出，跑不动)，Elasticsearch配置成集群的方式也是可以的，只要稍稍改下配置文件

准备:

服务器安装jdk1.8以上

[root@iZwz98bpfv23id0ffnnis1Z ~]# java -version
java version "1.8.0_181"
Java(TM) SE Runtime Environment (build 1.8.0_181-b13)
Java HotSpot(TM) 64-Bit Server VM (build 25.181-b13, mixed mode)
[root@iZwz98bpfv23id0ffnnis1Z ~]# javac -version
javac 1.8.0_181
[root@iZwz98bpfv23id0ffnnis1Z ~]# echo $JAVA_HOME
/usr/java/jdk1.8.0_181-amd64
[root@iZwz98bpfv23id0ffnnis1Z ~]#

 

下载文件：

 到官网下载： https://www.elastic.co/cn/downloads

目前最新版本是7.6.2，所以本人安装的也就是这个版本

由于官网下载比较慢，我这里有个百度网盘的分享

链接：https://pan.baidu.com/s/1nWyaJJtB0Z3UAOuCNF055g
提取码：t6qy

 安装Elasticsearch：

新增elk用户

[root@iZwz98bpfv23id0ffnnis1Z ~]# useradd elk
[root@iZwz98bpfv23id0ffnnis1Z ~]# passwd elk
Changing password for user elk.
New password:
BAD PASSWORD: The password contains the user name in some form
Retype new password:
passwd: all authentication tokens updated successfully.
[root@iZwz98bpfv23id0ffnnis1Z ~]#

开始安装

[root@iZwz98bpfv23id0ffnnis1Z ~]# mv elasticsearch-7.6.2-linux-x86_64.tar.gz /home/elk/
[root@iZwz98bpfv23id0ffnnis1Z ~]# su elk
[elk@iZwz98bpfv23id0ffnnis1Z root]$ cd ~
[elk@iZwz98bpfv23id0ffnnis1Z ~]$ tar -zxvf elasticsearch-7.6.2-linux-x86_64.tar.gz
[elk@iZwz98bpfv23id0ffnnis1Z ~]$
[elk@iZwz98bpfv23id0ffnnis1Z ~]$ pwd
/home/elk
[elk@iZwz98bpfv23id0ffnnis1Z ~]$ mkdir -p var/es
[elk@iZwz98bpfv23id0ffnnis1Z ~]$ cd  elasticsearch-7.6.2/config/
[elk@iZwz98bpfv23id0ffnnis1Z config]$ cp elasticsearch.yml elasticsearch.yml_bak
[elk@iZwz98bpfv23id0ffnnis1Z config]$ vim elasticsearch.yml

elasticsearch.yml内容如下：

# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /home/elk/var/es/data
#
# Path to log files:
#
path.logs: /home/elk/var/es/logs
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
bootstrap.memory_lock: false
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 172.16.1.169
#
# Set a custom port for HTTP:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
#cluster.initial_master_nodes: ["node-1", "node-2"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
#
# ------------------------------------------------------------------------------
#
# 最后新增两个配置。不然启动报错
bootstrap.system_call_filter: false
cluster.initial_master_nodes: ["node-1"]

启动，发现报错

[elk@iZwz98bpfv23id0ffnnis1Z config]$ cd ../
[elk@iZwz98bpfv23id0ffnnis1Z elasticsearch-7.6.2]$ cd bin/
[elk@iZwz98bpfv23id0ffnnis1Z bin]$ ./elasticsearch
future versions of Elasticsearch will require Java 11; your Java version from [/usr/java/jdk1.8.0_181-amd64/jre] does not meet this requirement
[2020-04-21T09:39:57,898][INFO ][o.e.e.NodeEnvironment    ] [node-1] using [1] data paths, mounts [[/ (rootfs)]], net usable_space [33.8gb], net total_space [39.2gb], types [rootfs]
[2020-04-21T09:39:57,903][INFO ][o.e.e.NodeEnvironment    ] [node-1] heap size [1007.3mb], compressed ordinary object pointers [true]
[2020-04-21T09:39:57,949][INFO ][o.e.n.Node               ] [node-1] node name [node-1], node ID [dMk3D6nSRfSEM1y2LgOh8g], cluster name [my-application]
[2020-04-21T09:39:57,949][INFO ][o.e.n.Node               ] [node-1] version[7.6.2], pid[21937], build[default/tar/ef48eb35cf30adf4db14086e8aabd07ef6fb113f/2020-03-26T06:34:37.794943Z], OS[Linux/3.10.0-957.21.3.el7.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0_181/25.181-b13]
[2020-04-21T09:39:57,950][INFO ][o.e.n.Node               ] [node-1] JVM home [/usr/java/jdk1.8.0_181-amd64/jre]
[2020-04-21T09:39:57,950][INFO ][o.e.n.Node               ] [node-1] JVM arguments [-Des.networkaddress.cache.ttl=60, -Des.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.locale.providers=COMPAT, -Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Djava.io.tmpdir=/tmp/elasticsearch-2479772838674939679, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=data, -XX:ErrorFile=logs/hs_err_pid%p.log, -XX:+PrintGCDetails, -XX:+PrintGCDateStamps, -XX:+PrintTenuringDistribution, -XX:+PrintGCApplicationStoppedTime, -Xloggc:logs/gc.log, -XX:+UseGCLogFileRotation, -XX:NumberOfGCLogFiles=32, -XX:GCLogFileSize=64m, -XX:MaxDirectMemorySize=536870912, -Des.path.home=/home/elk/elasticsearch-7.6.2, -Des.path.conf=/home/elk/elasticsearch-7.6.2/config, -Des.distribution.flavor=default, -Des.distribution.type=tar, -Des.bundled_jdk=true]
[2020-04-21T09:40:00,886][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [aggs-matrix-stats]
[2020-04-21T09:40:00,887][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [analysis-common]
[2020-04-21T09:40:00,887][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [flattened]
[2020-04-21T09:40:00,887][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [frozen-indices]
[2020-04-21T09:40:00,887][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [ingest-common]
[2020-04-21T09:40:00,887][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [ingest-geoip]
[2020-04-21T09:40:00,887][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [ingest-user-agent]
[2020-04-21T09:40:00,888][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [lang-expression]
[2020-04-21T09:40:00,888][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [lang-mustache]
[2020-04-21T09:40:00,888][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [lang-painless]
[2020-04-21T09:40:00,888][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [mapper-extras]
[2020-04-21T09:40:00,888][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [parent-join]
[2020-04-21T09:40:00,888][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [percolator]
[2020-04-21T09:40:00,888][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [rank-eval]
[2020-04-21T09:40:00,888][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [reindex]
[2020-04-21T09:40:00,889][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [repository-url]
[2020-04-21T09:40:00,889][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [search-business-rules]
[2020-04-21T09:40:00,889][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [spatial]
[2020-04-21T09:40:00,889][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [transform]
[2020-04-21T09:40:00,889][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [transport-netty4]
[2020-04-21T09:40:00,889][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [vectors]
[2020-04-21T09:40:00,889][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-analytics]
[2020-04-21T09:40:00,889][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-ccr]
[2020-04-21T09:40:00,890][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-core]
[2020-04-21T09:40:00,890][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-deprecation]
[2020-04-21T09:40:00,890][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-enrich]
[2020-04-21T09:40:00,890][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-graph]
[2020-04-21T09:40:00,890][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-ilm]
[2020-04-21T09:40:00,890][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-logstash]
[2020-04-21T09:40:00,890][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-ml]
[2020-04-21T09:40:00,891][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-monitoring]
[2020-04-21T09:40:00,891][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-rollup]
[2020-04-21T09:40:00,891][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-security]
[2020-04-21T09:40:00,891][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-sql]
[2020-04-21T09:40:00,891][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-voting-only-node]
[2020-04-21T09:40:00,891][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-watcher]
[2020-04-21T09:40:00,891][INFO ][o.e.p.PluginsService     ] [node-1] no plugins loaded
[2020-04-21T09:40:04,430][INFO ][o.e.x.s.a.s.FileRolesStore] [node-1] parsed [0] roles from file [/home/elk/elasticsearch-7.6.2/config/roles.yml]
[2020-04-21T09:40:05,254][INFO ][o.e.x.m.p.l.CppLogMessageHandler] [node-1] [controller/22016] [Main.cc@110] controller (64 bit): Version 7.6.2 (Build e06ef9d86d5332) Copyright (c) 2020 Elasticsearch BV
[2020-04-21T09:40:05,722][DEBUG][o.e.a.ActionModule       ] [node-1] Using REST wrapper from plugin org.elasticsearch.xpack.security.Security
[2020-04-21T09:40:05,837][INFO ][o.e.d.DiscoveryModule    ] [node-1] using discovery type [zen] and seed hosts providers [settings]
[2020-04-21T09:40:06,640][INFO ][o.e.n.Node               ] [node-1] initialized
[2020-04-21T09:40:06,640][INFO ][o.e.n.Node               ] [node-1] starting ...
[2020-04-21T09:40:06,749][INFO ][o.e.t.TransportService   ] [node-1] publish_address {172.18.97.64:9300}, bound_addresses {0.0.0.0:9300}
[2020-04-21T09:40:07,022][INFO ][o.e.b.BootstrapChecks    ] [node-1] bound or publishing to a non-loopback address, enforcing bootstrap checks
ERROR: [1] bootstrap checks failed
[1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
ERROR: Elasticsearch did not exit normally - check the logs at /home/elk/var/es/logs/my-application.log
[2020-04-21T09:40:07,028][INFO ][o.e.n.Node               ] [node-1] stopping ...
[2020-04-21T09:40:07,043][INFO ][o.e.n.Node               ] [node-1] stopped
[2020-04-21T09:40:07,043][INFO ][o.e.n.Node               ] [node-1] closing ...
[2020-04-21T09:40:07,062][INFO ][o.e.n.Node               ] [node-1] closed
[elk@iZwz98bpfv23id0ffnnis1Z bin]$

报错如下：

ERROR: [1] bootstrap checks failed
[1]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

解决办法：

切换到root用户修改配置sysctl.conf
vi /etc/sysctl.conf
在尾行添加以下内容
vm.max_map_count=262144
并执行命令
sysctl -p

可能出现的报错：

ERROR: [1] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65535]

解决办法：

(1)切换到root用户，修改文件

vi /etc/security/limits.conf

//在文件末尾添加下面的参数值
* soft nofile 65536
* hard nofile 131072

2)在切换到elk用户，使用命令查看进程数

ulimit -Hu
ulimit -Su

再次启动：

[elk@iZwz98bpfv23id0ffnnis1Z bin]$ cd ../config/
[elk@iZwz98bpfv23id0ffnnis1Z config]$ clear
[elk@iZwz98bpfv23id0ffnnis1Z config]$ cd ../
[elk@iZwz98bpfv23id0ffnnis1Z elasticsearch-7.6.2]$ cd bin/
[elk@iZwz98bpfv23id0ffnnis1Z bin]$ ./elasticsearch
future versions of Elasticsearch will require Java 11; your Java version from [/usr/java/jdk1.8.0_181-amd64/jre] does not meet this requirement
[2020-04-21T10:21:39,286][INFO ][o.e.e.NodeEnvironment    ] [node-1] using [1] data paths, mounts [[/ (rootfs)]], net usable_space [33.8gb], net total_space [39.2gb], types [rootfs]
[2020-04-21T10:21:39,287][INFO ][o.e.e.NodeEnvironment    ] [node-1] heap size [1007.3mb], compressed ordinary object pointers [true]
[2020-04-21T10:21:39,401][INFO ][o.e.n.Node               ] [node-1] node name [node-1], node ID [dMk3D6nSRfSEM1y2LgOh8g], cluster name [my-application]
[2020-04-21T10:21:39,402][INFO ][o.e.n.Node               ] [node-1] version[7.6.2], pid[24599], build[default/tar/ef48eb35cf30adf4db14086e8aabd07ef6fb113f/2020-03-26T06:34:37.794943Z], OS[Linux/3.10.0-957.21.3.el7.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0_181/25.181-b13]
[2020-04-21T10:21:39,402][INFO ][o.e.n.Node               ] [node-1] JVM home [/usr/java/jdk1.8.0_181-amd64/jre]
[2020-04-21T10:21:39,405][INFO ][o.e.n.Node               ] [node-1] JVM arguments [-Des.networkaddress.cache.ttl=60, -Des.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.locale.providers=COMPAT, -Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Djava.io.tmpdir=/tmp/elasticsearch-5400818995391898433, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=data, -XX:ErrorFile=logs/hs_err_pid%p.log, -XX:+PrintGCDetails, -XX:+PrintGCDateStamps, -XX:+PrintTenuringDistribution, -XX:+PrintGCApplicationStoppedTime, -Xloggc:logs/gc.log, -XX:+UseGCLogFileRotation, -XX:NumberOfGCLogFiles=32, -XX:GCLogFileSize=64m, -XX:MaxDirectMemorySize=536870912, -Des.path.home=/home/elk/elasticsearch-7.6.2, -Des.path.conf=/home/elk/elasticsearch-7.6.2/config, -Des.distribution.flavor=default, -Des.distribution.type=tar, -Des.bundled_jdk=true]
[2020-04-21T10:21:41,343][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [aggs-matrix-stats]
[2020-04-21T10:21:41,343][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [analysis-common]
[2020-04-21T10:21:41,343][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [flattened]
[2020-04-21T10:21:41,344][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [frozen-indices]
[2020-04-21T10:21:41,344][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [ingest-common]
[2020-04-21T10:21:41,344][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [ingest-geoip]
[2020-04-21T10:21:41,344][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [ingest-user-agent]
[2020-04-21T10:21:41,344][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [lang-expression]
[2020-04-21T10:21:41,344][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [lang-mustache]
[2020-04-21T10:21:41,344][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [lang-painless]
[2020-04-21T10:21:41,345][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [mapper-extras]
[2020-04-21T10:21:41,345][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [parent-join]
[2020-04-21T10:21:41,345][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [percolator]
[2020-04-21T10:21:41,345][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [rank-eval]
[2020-04-21T10:21:41,345][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [reindex]
[2020-04-21T10:21:41,345][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [repository-url]
[2020-04-21T10:21:41,345][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [search-business-rules]
[2020-04-21T10:21:41,346][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [spatial]
[2020-04-21T10:21:41,346][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [transform]
[2020-04-21T10:21:41,346][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [transport-netty4]
[2020-04-21T10:21:41,346][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [vectors]
[2020-04-21T10:21:41,346][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-analytics]
[2020-04-21T10:21:41,346][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-ccr]
[2020-04-21T10:21:41,346][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-core]
[2020-04-21T10:21:41,346][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-deprecation]
[2020-04-21T10:21:41,347][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-enrich]
[2020-04-21T10:21:41,347][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-graph]
[2020-04-21T10:21:41,347][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-ilm]
[2020-04-21T10:21:41,347][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-logstash]
[2020-04-21T10:21:41,347][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-ml]
[2020-04-21T10:21:41,347][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-monitoring]
[2020-04-21T10:21:41,347][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-rollup]
[2020-04-21T10:21:41,348][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-security]
[2020-04-21T10:21:41,348][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-sql]
[2020-04-21T10:21:41,348][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-voting-only-node]
[2020-04-21T10:21:41,348][INFO ][o.e.p.PluginsService     ] [node-1] loaded module [x-pack-watcher]
[2020-04-21T10:21:41,348][INFO ][o.e.p.PluginsService     ] [node-1] no plugins loaded
[2020-04-21T10:21:45,493][INFO ][o.e.x.s.a.s.FileRolesStore] [node-1] parsed [0] roles from file [/home/elk/elasticsearch-7.6.2/config/roles.yml]
[2020-04-21T10:21:46,026][INFO ][o.e.x.m.p.l.CppLogMessageHandler] [node-1] [controller/24678] [Main.cc@110] controller (64 bit): Version 7.6.2 (Build e06ef9d86d5332) Copyright (c) 2020 Elasticsearch BV
[2020-04-21T10:21:46,539][DEBUG][o.e.a.ActionModule       ] [node-1] Using REST wrapper from plugin org.elasticsearch.xpack.security.Security
[2020-04-21T10:21:46,665][INFO ][o.e.d.DiscoveryModule    ] [node-1] using discovery type [zen] and seed hosts providers [settings]
[2020-04-21T10:21:47,531][INFO ][o.e.n.Node               ] [node-1] initialized
[2020-04-21T10:21:47,531][INFO ][o.e.n.Node               ] [node-1] starting ...
[2020-04-21T10:21:47,655][INFO ][o.e.t.TransportService   ] [node-1] publish_address {172.18.97.64:9300}, bound_addresses {0.0.0.0:9300}
[2020-04-21T10:21:47,932][INFO ][o.e.b.BootstrapChecks    ] [node-1] bound or publishing to a non-loopback address, enforcing bootstrap checks
[2020-04-21T10:21:47,943][INFO ][o.e.c.c.Coordinator      ] [node-1] setting initial configuration to VotingConfiguration{dMk3D6nSRfSEM1y2LgOh8g}
[2020-04-21T10:21:48,106][INFO ][o.e.c.s.MasterService    ] [node-1] elected-as-master ([1] nodes joined)[{node-1}{dMk3D6nSRfSEM1y2LgOh8g}{LkwLqRLDRDudVsCsZ_upZw}{172.18.97.64}{172.18.97.64:9300}{dilm}{ml.machine_memory=3777253376, xpack.installed=true, ml.max_open_jobs=20} elect leader, _BECOME_MASTER_TASK_, _FINISH_ELECTION_], term: 1, version: 1, delta: master node changed {previous [], current [{node-1}{dMk3D6nSRfSEM1y2LgOh8g}{LkwLqRLDRDudVsCsZ_upZw}{172.18.97.64}{172.18.97.64:9300}{dilm}{ml.machine_memory=3777253376, xpack.installed=true, ml.max_open_jobs=20}]}
[2020-04-21T10:21:48,161][INFO ][o.e.c.c.CoordinationState] [node-1] cluster UUID set to [QIDsWY3RTwOl86xiX0iH1Q]
[2020-04-21T10:21:48,187][INFO ][o.e.c.s.ClusterApplierService] [node-1] master node changed {previous [], current [{node-1}{dMk3D6nSRfSEM1y2LgOh8g}{LkwLqRLDRDudVsCsZ_upZw}{172.18.97.64}{172.18.97.64:9300}{dilm}{ml.machine_memory=3777253376, xpack.installed=true, ml.max_open_jobs=20}]}, term: 1, version: 1, reason: Publication{term=1, version=1}
[2020-04-21T10:21:48,247][INFO ][o.e.h.AbstractHttpServerTransport] [node-1] publish_address {172.18.97.64:9200}, bound_addresses {0.0.0.0:9200}
[2020-04-21T10:21:48,247][INFO ][o.e.n.Node               ] [node-1] started
[2020-04-21T10:21:48,333][INFO ][o.e.g.GatewayService     ] [node-1] recovered [0] indices into cluster_state
[2020-04-21T10:21:48,610][INFO ][o.e.c.m.MetaDataIndexTemplateService] [node-1] adding template [.triggered_watches] for index patterns [.triggered_watches*]
[2020-04-21T10:21:48,651][INFO ][o.e.c.m.MetaDataIndexTemplateService] [node-1] adding template [.watches] for index patterns [.watches*]
[2020-04-21T10:21:48,704][INFO ][o.e.c.m.MetaDataIndexTemplateService] [node-1] adding template [.watch-history-10] for index patterns [.watcher-history-10*]
[2020-04-21T10:21:48,742][INFO ][o.e.c.m.MetaDataIndexTemplateService] [node-1] adding template [ilm-history] for index patterns [ilm-history-1*]
[2020-04-21T10:21:48,780][INFO ][o.e.c.m.MetaDataIndexTemplateService] [node-1] adding template [.slm-history] for index patterns [.slm-history-1*]
[2020-04-21T10:21:48,826][INFO ][o.e.c.m.MetaDataIndexTemplateService] [node-1] adding template [.monitoring-logstash] for index patterns [.monitoring-logstash-7-*]
[2020-04-21T10:21:48,876][INFO ][o.e.c.m.MetaDataIndexTemplateService] [node-1] adding template [.monitoring-es] for index patterns [.monitoring-es-7-*]
[2020-04-21T10:21:48,926][INFO ][o.e.c.m.MetaDataIndexTemplateService] [node-1] adding template [.monitoring-beats] for index patterns [.monitoring-beats-7-*]
[2020-04-21T10:21:49,010][INFO ][o.e.c.m.MetaDataIndexTemplateService] [node-1] adding template [.monitoring-alerts-7] for index patterns [.monitoring-alerts-7]
[2020-04-21T10:21:49,057][INFO ][o.e.c.m.MetaDataIndexTemplateService] [node-1] adding template [.monitoring-kibana] for index patterns [.monitoring-kibana-7-*]
[2020-04-21T10:21:49,090][INFO ][o.e.x.i.a.TransportPutLifecycleAction] [node-1] adding index lifecycle policy [watch-history-ilm-policy]
[2020-04-21T10:21:49,135][INFO ][o.e.x.i.a.TransportPutLifecycleAction] [node-1] adding index lifecycle policy [ilm-history-ilm-policy]
[2020-04-21T10:21:49,180][INFO ][o.e.x.i.a.TransportPutLifecycleAction] [node-1] adding index lifecycle policy [slm-history-ilm-policy]
[2020-04-21T10:21:49,295][INFO ][o.e.l.LicenseService     ] [node-1] license [406e5b20-653b-4621-84d8-d7e5135480a7] mode [basic] - valid
[2020-04-21T10:21:49,296][INFO ][o.e.x.s.s.SecurityStatusChangeListener] [node-1] Active license is now [BASIC]; Security is disabled

好像是启动成功了

浏览器访问： http://172.16.1.169:9200

 启动确认没有问题了

[elk@iZwz98bpfv23id0ffnnis1Z bin]$ cd ../
[elk@iZwz98bpfv23id0ffnnis1Z elasticsearch-7.6.2]$ vi starup.sh
[elk@iZwz98bpfv23id0ffnnis1Z elasticsearch-7.6.2]$ chmod u+x starup.sh
[elk@iZwz98bpfv23id0ffnnis1Z elasticsearch-7.6.2]$ ps aux|grep elasticsearch-7.6.2
elk       7742  0.0  0.0 103344   888 pts/0    S+   10:31   0:00 grep elasticsearch-7.6.2
[elk@iZwz98bpfv23id0ffnnis1Z elasticsearch-7.6.2]$ ls
bin  config  data  jdk  lib  LICENSE.txt  logs  modules  NOTICE.txt  plugins  README.asciidoc  replay_pid28957.log  starup.sh
[elk@iZwz98bpfv23id0ffnnis1Z elasticsearch-7.6.2]$ ./starup.sh
future versions of Elasticsearch will require Java 11; your Java version from [/usr/java/jdk1.8.0_102/jre] does not meet this requirement
[elk@iZwz98bpfv23id0ffnnis1Z elasticsearch-7.6.2]$ ps aux|grep elasticsearch-7.6.2
elk       7809  185 15.6 3605960 1258136 pts/0 Sl   10:31   0:18 /usr/java/jdk1.8.0_102/bin/java -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djna.nosys=true -XX:-OmitStackTraceInFastThrow -Dio.netty.noUnsafe=true -Dio.netty.noKeySetOptimization=true -Dio.netty.recycler.maxCapacityPerThread=0 -Dio.netty.allocator.numDirectArenas=0 -Dlog4j.shutdownHookEnabled=false -Dlog4j2.disable.jmx=true -Djava.locale.providers=COMPAT -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.io.tmpdir=/tmp/elasticsearch-113030852514621270 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=data -XX:ErrorFile=logs/hs_err_pid%p.log -XX:+PrintGCDetails -XX:+PrintGCDateStamps -XX:+PrintTenuringDistribution -XX:+PrintGCApplicationStoppedTime -Xloggc:logs/gc.log -XX:+UseGCLogFileRotation -XX:NumberOfGCLogFiles=32 -XX:GCLogFileSize=64m -XX:MaxDirectMemorySize=536870912 -Des.path.home=/home/elk/elasticsearch-7.6.2 -Des.path.conf=/home/elk/elasticsearch-7.6.2/config -Des.distribution.flavor=default -Des.distribution.type=tar -Des.bundled_jdk=true -cp /home/elk/elasticsearch-7.6.2/lib/* org.elasticsearch.bootstrap.Elasticsearch -d
elk       7824  0.1  0.0  64124  4480 pts/0    Sl   10:31   0:00 /home/elk/elasticsearch-7.6.2/modules/x-pack-ml/platform/linux-x86_64/bin/controller
elk       7833  0.0  0.0 103344   888 pts/0    S+   10:31   0:00 grep elasticsearch-7.6.2
[elk@iZwz98bpfv23id0ffnnis1Z elasticsearch-7.6.2]$


starup.sh里面的内容：
/home/elk/elasticsearch-7.6.2/bin/elasticsearch -d

安装Logstash：

logstash可以用root用户运行，logstash也是需要在jdk1.8以上版本运行，所以可以不用像elasticsearch那样必须用新建一个elk用户，本人直接了当，用root用户，在root用户根目录安装logstash

[root@jenkins ~]# ls
diamond  jdk-8u181-linux-x64.rpm  logstash-7.6.2.tar.gz  mysqld.log.gz
[root@jenkins ~]# tar -zxvf logstash-7.6.2.tar.gz
[root@jenkins ~]# cd logstash-7.6.2
[root@jenkins logstash-7.6.2]# vim config.conf
[root@jenkins logstash-7.6.2]# vim startup.sh
[root@jenkins logstash-7.6.2]# chmod u+x startup.sh

config.conf内容如下：

input {
    beats {
        port => "5044"
    }
}

 filter {
    grok {
        match => { "message" => "%{COMBINEDAPACHELOG}"}
    }
    geoip {
        source => "clientip"
    }
}

output {
    elasticsearch {
        hosts => [ "172.16.1.169:9200" ]
    }
}

startup.sh内容如下：

nohup /root/logstash-7.6.2/bin/logstash -f /root/logstash-7.6.2/config.conf &

启动

[root@jenkins logstash-7.6.2]# ./startup.sh
[root@jenkins logstash-7.6.2]# nohup: appending output to `nohup.out'
[root@jenkins logstash-7.6.2]#
[root@jenkins logstash-7.6.2]# tail -f nohup.out
Sending Logstash logs to /root/logstash-7.6.2/logs which is now configured via log4j2.properties
[2020-04-21T11:30:38,888][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.queue", :path=>"/root/logstash-7.6.2/data/queue"}
[2020-04-21T11:30:39,058][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.dead_letter_queue", :path=>"/root/logstash-7.6.2/data/dead_letter_queue"}
[2020-04-21T11:30:39,480][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2020-04-21T11:30:39,489][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"7.6.2"}
[2020-04-21T11:30:39,516][INFO ][logstash.agent           ] No persistent UUID file found. Generating new UUID {:uuid=>"5105c2e8-9563-4a47-9e9e-a8c037a04232", :path=>"/root/logstash-7.6.2/data/uuid"}
[2020-04-21T11:30:41,412][INFO ][org.reflections.Reflections] Reflections took 46 ms to scan 1 urls, producing 20 keys and 40 values
[2020-04-21T11:30:42,498][INFO ][logstash.outputs.elasticsearch][main] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://172.16.1.81:9200/]}}
[2020-04-21T11:30:42,734][WARN ][logstash.outputs.elasticsearch][main] Restored connection to ES instance {:url=>"http://172.16.1.81:9200/"}
[2020-04-21T11:30:42,808][INFO ][logstash.outputs.elasticsearch][main] ES Output version determined {:es_version=>7}
[2020-04-21T11:30:42,817][WARN ][logstash.outputs.elasticsearch][main] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[2020-04-21T11:30:42,948][INFO ][logstash.outputs.elasticsearch][main] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//172.16.1.81:9200"]}
[2020-04-21T11:30:43,030][INFO ][logstash.outputs.elasticsearch][main] Using default mapping template
[2020-04-21T11:30:43,156][INFO ][logstash.outputs.elasticsearch][main] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1, "index.lifecycle.name"=>"logstash-policy", "index.lifecycle.rollover_alias"=>"logstash"}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[2020-04-21T11:30:43,171][INFO ][logstash.filters.geoip   ][main] Using geoip database {:path=>"/root/logstash-7.6.2/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-6.0.3-java/vendor/GeoLite2-City.mmdb"}
[2020-04-21T11:30:43,257][INFO ][logstash.outputs.elasticsearch][main] Creating rollover alias <logstash-{now/d}-000001>
[2020-04-21T11:30:43,360][WARN ][org.logstash.instrument.metrics.gauge.LazyDelegatingGauge][main] A gauge metric of an unknown type (org.jruby.specialized.RubyArrayOneObject) has been created for key: cluster_uuids. This may result in invalid serialization.  It is recommended to log an issue to the responsible developer/development team.
[2020-04-21T11:30:43,369][INFO ][logstash.javapipeline    ][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["/root/logstash-7.6.2/config.conf"], :thread=>"#<Thread:0x3b9cb2d2 run>"}
[2020-04-21T11:30:43,574][INFO ][logstash.outputs.elasticsearch][main] Installing ILM policy {"policy"=>{"phases"=>{"hot"=>{"actions"=>{"rollover"=>{"max_size"=>"50gb", "max_age"=>"30d"}}}}}} to _ilm/policy/logstash-policy
[2020-04-21T11:30:44,405][INFO ][logstash.inputs.beats    ][main] Beats inputs: Starting input listener {:address=>"0.0.0.0:5044"}
[2020-04-21T11:30:44,460][INFO ][logstash.javapipeline    ][main] Pipeline started {"pipeline.id"=>"main"}
[2020-04-21T11:30:44,523][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2020-04-21T11:30:44,583][INFO ][org.logstash.beats.Server][main] Starting server on port: 5044
[2020-04-21T11:30:44,937][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}

至此，logstash安装完毕

安装Filebeat：

filebeat可以直接在root用户运行

[root@redmine-dbs ~]# pwd
/root
[root@redmine-dbs ~]# tar -zxvf filebeat-7.6.2-linux-x86_64.tar.gz
[root@redmine-dbs ~]# mv filebeat-7.6.2-linux-x86_64 filebeat-7.6.2
[root@redmine-dbs ~]# cd filebeat-7.6.2
[root@redmine-dbs dbs filebeat-7.6.2]# vi config.yml
[root@redmine-dbs dbs filebeat-7.6.2]# vi startup.sh
[root@redmine-dbs dbs filebeat-7.6.2]# chmod u+x startup.sh

config.yml内容如下：

filebeat.inputs:
- type: log
  paths:
    -  /var/test.log
  multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:' 
  multiline.negate: false 
  multiline.match: after
output.logstash:
  hosts: ["172.16.1.69:5044"]

　　starup.sh内容如下：

nohup /root/filebeat-7.6.2/filebeat -c /root/filebeat-7.6.2/config.yml &

　　启动：

[root@redmine-dbs filebeat-7.6.2]# ./startup.sh
[root@redmine-dbs filebeat-7.6.2]# nohup: appending output to `nohup.out'

[root@redmine-dbs filebeat-7.6.2]# tail -f logs/filebeat
2020-04-21T14:09:54.812+0800    WARN    beater/filebeat.go:152  Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
2020-04-21T14:09:54.813+0800    INFO    instance/beat.go:439    filebeat start running.
2020-04-21T14:09:54.813+0800    INFO    registrar/registrar.go:145      Loading registrar data from /root/filebeat-7.6.2/data/registry/filebeat/data.json
2020-04-21T14:09:54.813+0800    INFO    registrar/registrar.go:152      States Loaded from registrar: 0
2020-04-21T14:09:54.813+0800    WARN    beater/filebeat.go:368  Filebeat is unable to load the Ingest Node pipelines for the configured modules because the Elasticsearch output is not configured/enabled. If you have already loaded the Ingest Node pipelines or are using Logstash pipelines, you can ignore this warning.
2020-04-21T14:09:54.813+0800    INFO    crawler/crawler.go:72   Loading Inputs: 1
2020-04-21T14:09:54.813+0800    INFO    log/input.go:152        Configured paths: [/var/test.log]
2020-04-21T14:09:54.813+0800    INFO    input/input.go:114      Starting input of type: log; ID: 13852086122507548810
2020-04-21T14:09:54.813+0800    INFO    crawler/crawler.go:106  Loading and starting Inputs completed. Enabled inputs: 1
2020-04-21T14:09:54.813+0800    INFO    [monitoring]    log/log.go:118  Starting metrics logging every 30s


[root@redmine-dbs filebeat-7.6.2]# ps aux|grep filebeat-7.6.2
root      1422  0.0  1.4 260868 28608 pts/0    Sl   14:09   0:00 /root/filebeat-7.6.2/filebeat -c /root/filebeat-7.6.2/config.yml
root      1482  0.0  0.0 103244   872 pts/0    S+   14:11   0:00 grep filebeat-7.6.2
[root@redmine-dbs filebeat-7.6.2]# echo testlog > /var/test.log

安装Kibana：

[root@localhost ~]# pwd
/root
[root@localhost ~]# tar -zxvf kibana-7.6.2-linux-x86_64.tar.gz
[root@localhost ~]# mv kibana-7.6.2-linux-x86_64 kibana-7.6.2
[root@localhost ~]# cd kibana-7.6.2
[root@localhost kibana-7.6.2]# cp config/kibana.yml config/kibana.yml_bak
[root@localhost kibana-7.6.2]# vi config/kibana.yml

　　kibana.yml只开启下面几个配置项

server.port: 5601
server.host: "172.16.1.81"
elasticsearch.hosts: ["http://172.16.1.169:9200"]
kibana.index: ".kibana"

　　启动：

[root@localhost kibana-7.6.2]# ./bin/kibana --allow-root

　　浏览器访问：http://192.16.1.81:5601

 

 

 

 

此时，到172.16.1.31  vi /var/test.log  给这个日志文件随便写添加几行，在上面就看到日志记录，并且可以检索

至此，ALK环境搭建完毕

斯莫克
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 0
    评论
ELK环境搭建
qq_35991363的博客
06-20 325
ELK环境搭建   ELK是ElasticSearch+Logstash+ Kibana，其中，Logstash负责收集日志，ElasticSearch负责存储日志，而Kibana提供界面查看日志信息。
ELK在Centos7上的搭建
weixin_47710047的博客
03-09 605
用于日志监控的分布式配置
centos环境下部署ELK
qq_43402287的博客
05-17 652
centos环境下部署ELK
ELKB环境搭建 - CentOS7.*
weixin_44117045的博客
06-03 320
因为有安全方面的考虑，es是不能在root账户下运行的，因此要新建用户。需要具备Java环境（1.8或11版本）推荐Java11。将 kibana 的 rpm包下载过后，放入。有相关报错信息，请参考下面链接。
CentOS7部署ELK
Hello World
03-18 1264
CentOS7部署Elasticsearch、Logstash、Kibana
CentOS7傻瓜式部署ELK小白教程（仅入门）
qq_39209622的博客
07-20 1043
ELK是Elasticsearch、Logstash和Kibana三个开源软件的简称，它们共同构成了一个强大的日志管理和数据分析平台。Elasticsearch是一个基于Lucene的搜索服务器，提供了分布式多用户能力的全文搜索引擎，具有高效的数据存储和索引能力，支持快速搜索，并且随着数据和查询量的增长，其分布式特性可以确保部署的无缝增长。Logstash是一个服务器端数据处理管道，Logstash能够从多个数据源收集数据，对数据进行实时解析和转换，并将其发送到Elasticsearch中。
CentOS7安装部署ELK8.3（单节点）
gjjhyd的博客
01-04 1107
Centos安装部署ELK8.3，单节点
Centos7下搭建ELK日志分析系统
11-02
在Centos7.6环境下搭建ELK日志分析系统，首先确保系统环境满足以下软件版本： - Elasticsearch: 7.9.3 - Logstash: 7.9.3 - Kibana: 7.9.3 - Redis: 6.0.6 1. **Elasticsearch安装** - 下载并解压Elasticsearch至 ...
基于CentOS 6.9搭建ELK环境指南
04-17
无论是甲方还是一方都需要面对大量日志处理的情况，之前分析的时候用基本的 shell 命令进行处理，但是...后来有人推荐了 ELK，最近 ELK升级到了版本五。E， L， K 三大组件统一了版本 号，花了一段时间总 算搭好了。
3.1 ELK环境搭建和使用1
08-04
【3.1 ELK环境搭建和使用1】 ELK（Elasticsearch, Logstash, Kibana）环境的搭建主要用于构建日志收集和分析系统，它可以帮助管理和处理来自各种应用和系统的日志数据，实现日志的统一收集、存储、查询和分析。通过...
centos8 ELK安装步骤以及相关注意点
05-22
CentOS 8 安装ELK 7.x 本次示例使用的是阿里云的机器，系统CentOS8 常见的问题的原因以及处理
Centos 搭建ELK.pdf
03-02
export JAVA_HOME=/fusion/opt/elk/jdk11 export CLASSPATH=.:$JAVA_HOME/jre/lib/rt.jar:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar export PATH=$PATH:$JAVA_HOME/bin # 刷新环境变量 source /etc/...
centos7--搭建部署ELK服务_xiaohuai0444167的博客-CSDN博客.doc
05-06
CentOS 7 搭建 ELK 服务 ELK 服务是 Elastic Stack 的一部分，包括 Elasticsearch、Logstash 和 Kibana 等组件。ELK 服务可以用来实时地收集、处理和展示日志数据，提供了一个强大的日志分析和可视化平台。 一、...
ELKB集群搭建，Centos环境，简单易懂，包教包会，避免踩坑~（ES7.15.1版本，CentOS-Stream-9）
bb1272196672的博客
08-08 1604
ELKB集群搭建，Centos环境，避免踩坑~（ES7.15.1版本，CentOS-Stream-9）。filebeat，logstash，elasticsearch和kibana共同作业，Elastic Stack，搭建集群
ELK集群搭建(基础教程)
lqcbj的博客
01-30 2621
ELK集群搭建(基础教程) 目录： 机器准备 集群内各台机器安装Elasticsearch 安装部署Kafka（注：每个节点都配置，注意ip不同） 安装logstash工具 安装filebeat ELK收集Nginx的json日志 ELK收集Nginx正常日志和错误日志 ELK收集Tomcat日志 ELK收集docker日志 配置filebeat收集单个docker日志 modules日志收集 使用redis作为缓存收集日志 使用Kafka做缓存收集日志
CentOS7 搭建ELK笔记
fake_hydra的博客
10-12 744
系统环境 [root@elk ~]# cat /etc/redhat-release CentOS Linux release 7.6.1810 (Core) [root@elk ~]# getenforce Permissive [root@elk ~]# systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/sy
Centos部署LEK+redis+filebeat详细部署步骤
Stars1sea的博客
09-27 378
用于存储、搜索和分析数据的分布式搜索引擎。Elasticsearch 能够高效地处理大量结构化和非结构化数据，使用户能够快速搜索和检索数据。Logstash：用于数据收集、转换和传输的服务器端数据处理管道。Logstash 可以从各种来源（如日志文件、数据库、消息队列等）采集数据，然后对数据进行处理和格式化，最终将数据发送到 Elasticsearch 或其他目标存储。Kibana：用于数据可视化和分析的用户界面。
CentOS7部署ELK_centos7 elk部署，2024年最新【大牛疯狂教学
2401_84159839的博客
04-15 384
cluster.initial_master_nodes: [“node-1”] # 集群中节点名称，此名称要和node.name对应。node.name: node-1 # 此节点在集群中的名字。path.data: /app/es/data # 数据目录位置。path.logs: /app/es/logs # 日志目录位置。./elasticsearch -d # 后台启动。“text” : “数据科学与大数据技术”,“text” : “数据科学与大数据技术”,
Docker容器里centos、unbuntu无法使用 systemctl 命令
最新发布
m0_49448331的博客
08-09 242
在run docker的最后加上。
centos7搭建elk
08-05
CentOS7是一种基于Linux的操作系统，可以方便地用于搭建ELK（Elasticsearch、Logstash和Kibana）堆栈。ELK是一套开源的日志管理解决方案，广泛用于日志分析、监控和可视化。 首先，你需要在CentOS7上安装Elastic...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

斯莫克

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值