部署Kibana&&Logstash部署&&Beats采集日志

一、部署Kibana

从百度下载压缩包,通过FX上传到本地
https://artifacts.elastic.co/downloads/kibana/kibana-6.0.0-x86_64.rpm

1. 安装Kibana

[root@elk-1 ~]# rpm -ivh kibana-6.0.0-x86_64.rpm 
Preparing...                          ################################# [100%]
Updating / installing...
   1:kibana-6.0.0-1                   ################################# [100%]

2. 配置Kibana

[root@elk-1 ~]# vi /etc/kibana/kibana.yml
server.port: 5601
server.host: "192.168.200.10"
elasticsearch.url: "http://192.168.200.10:9200"

3. 启动Kibana

[root@elk-1 ~]# systemctl start kibana.service
[root@elk-1 ~]# 
[root@elk-1 ~]# ps aux |grep kiba
kibana    21519 20.7  4.2 1054100 78728 ?       Ssl  17:13   0:11 /usr/share/kibana/bin/../node/bin/node --no-warnings /usr/share/kibana/bin/../src/cli -c /etc/kibana/kibana.yml
root      21537  0.0  0.0 112660   968 pts/0    S+   17:14   0:00 grep --color=auto kiba
查看是否端口启动
[root@elk-1 ~]#  netstat -lntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1098/sshd           
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1471/master         
tcp        0      0 192.168.200.10:5601     0.0.0.0:*               LISTEN      21519/node     有此端口或者进程存在，证明服务启动成功         
tcp6       0      0 192.168.200.10:9200     :::*                    LISTEN      21348/java          
tcp6       0      0 192.168.200.10:9300     :::*                    LISTEN      21348/java          
tcp6       0      0 :::22                   :::*                    LISTEN      1098/sshd           
tcp6       0      0 ::1:25                  :::*                    LISTEN      1471/master     
[root@elk-1 ~]#  netstat -lntp |grep node
tcp        0      0 192.168.200.10:5601     0.0.0.0:*               LISTEN      21519/node       

可以访问到如下界面

二、Logstash部署

从百度下载压缩包,通过FX上传到本地
https://artifacts.elastic.co/downloads/logstash/logstash-6.0.0.rpm

1. 安装Logstash

[root@elk-2 ~]# rpm -ivh logstash-6.0.0.rpm 
Preparing...                          ################################# [100%]
Updating / installing...
   1:logstash-1:6.0.0-1               ################################# [100%]
Using provided startup.options file: /etc/logstash/startup.options
OpenJDK 64-Bit Server VM warning: If the number of processors is expected to increase from one, then you should configure the number of parallel GC threads appropriately using -XX:ParallelGCThreads=N
Successfully created system startup script for Logstash

2. logstash收集syslog日志

编辑配置文件

[root@elk-2 ~]# vi /etc/logstash/conf.d/syslog.conf 
input {
            //定义日志源
  syslog {
           
    type => "system-syslog"         //定义类型
    port => 10514
  }
}
output {
           //定义日志输出
  stdout {
   
    codec => rubydebug
  }
}

启动Logstash

[root@elk-2 ~]# vi /etc/rsyslog.conf
#### RULES ####
*.* @@192.168.200.40:10514      添加的内容
[root@elk-2 ~]# vi /etc/logstash/logstash.yml
# ------------ Metrics Settings --------------
http.host: "192.168.200.40"     修改此内容
[root@elk-2 ~]# systemctl restart rsyslog
[root@elk-2 ~]# systemctl start rsyslog

检测配置文件是否错误：

[root@elk-2 ~]# ln -s /usr/share/logstash/bin/logstash /usr/bin   // 创建软连接，方便使用logstash命令
[root@elk-2 ~]# logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/syslog.conf --config.test_and_exit
OpenJDK 64-Bit Server VM warning: If the number of processors is expected to increase from one, then you should configure the number of parallel GC threads appropriately using -XX:ParallelGCThreads=N
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
Configuration OK
// 为ok则代表没问题

报错：

[root@elk-2 ~]# logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/syslog.conf --config.test_and_exit
-bash: logstash: command not found
[root@elk-2 ~]# netstat -ntlp
# 查看是否端口  9600 10514
[<