ELK搭建

规划如下：
192.168.1.7
jdk
elasticsearch
kibana
192.168.1.8
jdk
logstash

1：时间同步
yum -y install ntpdate
ntpdate pool.ntp.org
2 防火墙
[root@bogon src]# systemctl stop firewalld
[root@bogon src]# setenforce 0

3: 解压压缩包
yum -y install unzip
unzip ELK.zip

4：安装jdk
rpm -ivh jdk-8u131-linux-x64_.rpm
验证：
java -version

5：安装elasticsearch
yum -y install elasticsearch-6.6.2.rpm
编辑主配置文件：
vim /etc/elasticsearch/elasticsearch.yml
[root@bogon ELK]# cat /etc/elasticsearch/elasticsearch.yml |grep -v “^#”
cluster.name: wg007
node.name: node-1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 192.168.1.7
http.port: 9200
6：运行服务elasticsearch
systemctl enable elasticsearch
systemctl start elasticsearch
验证服务：
9200：给客户端连接使用的
9300：给集群内部通信使用的

[root@bogon ELK]# netstat -lptnu|grep java
tcp6 0 0 192.168.1.7:9200 ::😗 LISTEN 14671/java
tcp6 0 0 192.168.1.7:9300 ::😗 LISTEN 14671/java

7：安装logstash
yum -y install logstash-6.6.0.rpm

8：编辑messages.conf
input {
file {
path => “/var/log/messages”
type => “msg-log”
start_position => “beginning”
}
}

output{
elasticsearch {
hosts => “192.168.1.7:9200”
index => “msg_log-%{+YYYY.MM.dd}”
}
}

9：开启服务logstash
systemctl enable logstash
systemctl start logstash
验证：
[root@bogon conf.d]# netstat -lptnu|grep java
tcp6 0 0 127.0.0.1:9600 ::😗 LISTEN 5453/java

问题1：权限
chmod 777 /var/log -R
10： 查看index是否创建成功
方法1：tailf /var/log/elasticsearch/wg007.log
方法2：
curl -X GET http://192.168.1.7:9200/_cat/indices?v

11：安装kibana
yum -y install kibana-6.6.2-x86_64.rpm

12 编辑vim /etc/kibana/kibana.yml
[root@bogon ELK]# cat /etc/kibana/kibana.yml |grep -v “^#”|sed ‘/^$/d’
server.port: 5601
server.host: “192.168.1.7”
elasticsearch.hosts: [“http://192.168.1.7:9200”]

13：开启服务kibana
systemctl enable kibana
systemctl start kibana
验证服务：
[root@bogon ELK]# netstat -lptnu|grep node
tcp 0 0 192.168.1.7:5601 0.0.0.0:* LISTEN 16172/node

14： 编辑pipelines.yml
[root@bogon logstash]# vim pipelines.yml

• pipeline.id: msg
  path.config: “/etc/logstash/conf.d/messages.conf”
• pipeline.id: sec
  path.config: “/etc/logstash/conf.d/secure.conf”