ELK部署摘要
环境说明:
- 系统版本:CentOS Linux release 7.6.1810 (Core)
- 内存: 8G
环境初始化:
修改主机名,、配置信任主机:
[root@elk ~]# cat /etc/hostname
elk
[root@elk ~]# cat /etc/hosts
172.18.155.99 elk
[root@elk ~]# ssh-keygen -f /root/.ssh/id_rsa -N ''
[root@elk ~]# ssh-add
[root@elk ~]# yum -y install java-1.8.0-openjdk
安装Elasticsearch主程序:
[root@elk elasticsearch]# rpm -ivh /elasticsearch/elasticsearch-6.2.4.rpm
[root@elk ~]# rpm -q elasticsearch
elasticsearch-6.2.4-1.noarch
[root@elk ~]# sed -n '17p;55p;68p;89,91p' /etc/elasticsearch/elasticsearch.yml
cluster.name: my-elk
network.host: 0.0.0.0
discovery.zen.ping.unicast.hosts: ["elk"]
# ----------------------------------- Head -------------------------------------
http.cors.enabled: true
http.cors.allow-origin: "*"
安装Head插件:
[root@elk elasticsearch]# yum -y install npm
[root@elk elasticsearch]# wget https://nodejs.org/dist/v10.16.0/node-v10.16.0-linux-x64.tar.xz
[root@elk elasticsearch]# git clone https://github.com/mobz/elasticsearch-head.git
[root@elk elasticsearch]# xz -d node-v8.11.3-linux-x64.tar.xz
[root@elk elasticsearch]# tar xf node-v10.16.0-linux-x64.tar
[root@elk elasticsearch]# export NODE_PATH=$NODE_HOME/lib/node_modules
[root@elk elasticsearch]# source /etc/profile
[root@elk elasticsearch]# npm install -g grunt
[root@elk elasticsearch]# cd elasticsearch-head/
[root@elk elasticsearch]# npm install --ignore-scripts
[root@elk elasticsearch]# systemctl start elasticsearch
[root@elk elasticsearch]# systemctl enable elasticsearch
[root@elk elasticsearch]# nohup npm run start &
状态检查:
[root@elk elasticsearch-head]# ss -nlt
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:9100 *:*
LISTEN 0 128 *:9200 *:*
LISTEN 0 128 *:9300 *:*
[root@elk elasticsearch-head]# curl 39.108.221.104:9200/_cat/health
1564365915 10:05:15 elk-server green 1 1 0 0 0 0 0 0 - 100.0%
部署及配置Kibana:
[root@elk]# wget https://artifacts.elastic.co/downloads/kibana/kibana-6.2.4-x86_64.rpm
[root@elk elasticsearch-head]# sed -n '2p;7p;18p;21p' /etc/kibana/kibana.yml
server.port: 5601
server.host: "39.108.221.104"
server.name: "elk"
elasticsearch.url: "http://39.108.221.104:9200"
部署及配置Logstach:
[root@elk bin]# yum -y localinstall logstash-6.8.1.rpm
[root@elk bin]# systemctl start logstash
[root@elk bin]# systemctl enable logstash
[root@elk bin]# systemctl start filebeat
[root@elk bin]# systemctl enable filebeat