【性能测试，练习获取业务模型】日志平台ELK：单节点搭建

基础环境配置

一台centos7

关闭防火墙

关闭selinux

jdk11下载、安装、配置

参考：https://www.cnblogs.com/uncleyong/p/10732951.html

# jdk11
export ES_JAVA_HOME=/usr/local/jdk-11.0.15.1
export PATH=$ES_JAVA_HOME/bin:$PATH
export CLASSPATH=.:$ES_JAVA_HOME/lib/dt.jar:$ES_JAVA_HOME/lib/tools.jar

es安装、配置

安装：yum localinstall elasticsearch-7.14.0-x86_64.rpm -y

修改配置：vim /etc/elasticsearch/elasticsearch.yml

path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
http.port: 9200
xpack.security.enabled: true
discovery.type: single-node

启动服务：

systemctl enable elasticsearch

systemctl start elasticsearch

systemctl status elasticsearch

netstat -lntp |grep 9300

设置密码：/usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive

密码：qzcsbj16

访问：http://192.168.117.186:9200/

看节点：http://192.168.117.186:9200/_cat/nodes?v

kibana安装、配置

安装：yum localinstall kibana-7.14.0-x86_64.rpm -y

配置：vim /etc/kibana/kibana.yml

server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://192.168.117.186:9200"]
elasticsearch.username: "elastic"
elasticsearch.password: "qzcsbj16"
logging.dest: /tmp/kibana.log

启动服务：

systemctl enable kibana

systemctl start kibana

systemctl status kibana

netstat -lntp |grep 5601

访问：http://192.168.117.186:5601/

账号密码：elastic/qzcsbj16

logstash安装、配置

安装：yum localinstall logstash-7.14.0-x86_64.rpm -y

配置：vim /etc/logstash/conf.d/logstash.conf

input {
 file {
  path => "/usr/local/nginx/logs/access.log"
 }
}

filter {
 grok {
  match => {
   "message" => '%{IP:remote_addr} - (%{WORD:remote_user}|-) \[%{HTTPDATE:time_local}\] "%{WORD:method} %{NOTSPACE:request} HTTP/%{NUMBER}" %{NUMBER:status} %{NUMBER:body_bytes_sent} %{QS} %{QS:http_user_agent}'
  }
  remove_field => ["message"]
 }
 date {
  match => ["time_local", "dd/MMM/yyyy:HH:mm:ss Z"]
  target => "@timestamp"
 }
}


output {
 elasticsearch {
  hosts => ["http://192.168.117.186:9200"]
  user => "elastic"
  password => "qzcsbj16"
  index => "qzcsbj_nginx-%{+YYYY.MM.dd}"
 }
}

启动服务：

systemctl enable logstash

systemctl start logstash

systemctl status logstash

netstat -lntp |grep 9600

基本使用

nginx请求一次：http://192.168.117.186

索引管理

可以看到es中的索引

 

kibana上建索引

查数据

【其它参考】k8s集群搭建EFK日志平台：ElasticSearch + Fluentd + Kibana

https://www.cnblogs.com/uncleyong/p/15527484.html

业务模型获取

https://www.cnblogs.com/uncleyong/p/15179752.html