ELK-Logstash,kibana

软件下载
https://elasticsearch.cn/download/
logstash安装
rpm -ivh jdk-8u171-linux-x64.rpm
rpm -ivh logstash-7.6.1.rpm
标准输入到标准输出
/usr/share/logstash/bin/logstash -e 'input { stdin { } } output { stdout {} }'

文件方式创建索引

需要给/var/log/elasticsearch/ 文件 chmod 755 加权限 才可以读取

kibana

安装
rpm -ivh kibana-7.6.1-x86_64.rpm

//kibana配置：
# vim /etc/kibana/kibana.yml
server.port: 5601			//服务端口
server.host: "172.25.0.17"		//服务监听地址
elasticsearch.hosts: ["http://172.25.0.13:9200"]	//ES集群地址
kibana.index: ".kibana"			//kibana在ES中创建的索引
i18n.locale: "zh-CN"      // 中文

//启动kibana服务
# systemctl enable kibana
# systemctl start kibana

# netstat -antlp|grep :5601
tcp        0      0 172.25.0.17:5601         0.0.0.0:*               LISTEN      1159/node 

/etc/logstash/conf.d

推送文件后在elastic上

添加索引：

创建索引：

压测：

启用xpack安全验证

集群模式需要先创建证书：
# cd /usr/share/elasticsearch/
# bin/elasticsearch-certutil ca
# bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
# cp elastic-certificates.p12 elastic-stack-ca.p12 /etc/elasticsearch
# cd /etc/elasticsearch
# chown elasticsearch elastic-certificates.p12 elastic-stack-ca.p12  //加权限 
//需要和创建密码  友情提示设置一样的

配置所有的elasticsearch集群节点：
# vim /etc/elasticsearch/elasticsearch.yml
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/elastic-certificates.p12
//全部主机都需要配置，友情提示 不要scp法过去
//因为你可能会忘记，其他主机配配置文件上不同的地方，会被copy上去

ES集群重启正常后，设置用户密码：

设置kibana连接ES的用户密码：
# vim /etc/kibana/kibana.yml
elasticsearch.username: "kibana"
elasticsearch.password: "westos"

设置Logstash连接ES用户密码:
output {
        elasticsearch {
                hosts => "172.25.0.13:9200"
                index => "apachelog-%{+YYYY.MM.dd}"
		 user => "elastic"
		 password => "westos"
        }
}

head访问：
http.cors.allow-headers: Authorization,X-Requested-With,Content-Length,Content-Type	//添加参数到es配置
http://172.25.16.1:9100/?auth_user=elastic&auth_password=westos