搭建ELK日志分析系统

-------------------------环境搭建--------------------
服务器1：Elasticaearch
IP:192.168.100.101
服务器2：Elasticaearch、Kibana
IP:192.168.100.102
服务器3：Logstas
IP:192.168.100.103

服务器1：（安装Elasticaearch）

hostname node1

bash

vim /etc/hosts

scp /etc/hosts root@192.168.100.102:/etc/hosts

rpm -ivh elasticsearch-5.5.0.rpm

systemctl start elasticsearch.service

systemctl daemon-reload

systemctl enable elasticsearch.service

vim /etc/elasticsearch/elasticsearch.yml

cluster.name: my-elk-cluster
node.name: node1
path.data: /data/elk_data
path.logs: /var/log/elasticsearch
bootstrap.memory_lock: false
network.host: 0.0.0.0
http.port: 9200
discovery.zen.ping.unicast.hosts: ["node1", "node2"]

mkdir -p /data/elk_data

chown elasticsearch:elasticsearch /data/elk_data/

systemctl restart elasticsearch.service

netstat -napt |grep 9200

tar zxf node-v8.2.1.tar.gz

cd node-v8.2.1/

./configure && make && make install

tar xvjf phantomjs-2.1.1-linux-x86_64.tar.bz2

cd phantomjs-2.1.1-linux-x86_64/bin

cp phantomjs /usr/local/bin/

cd

tar xvzf elasticsearch-head.tar.gz

cd elasticsearch-head/

npm install

vim /etc/elasticsearch/elasticsearch.yml

http.cors.enabled: true
http.cors.allow-origin: "*"

systemctl restart elasticsearch.service

npm run start &

netstat -napt |grep 9200

netstat -napt |grep 9100

----------------------------测试--------------------------------------

服务器2：(安装Elasticsearch)

hostname node2

bash

rpm -ivh elasticsearch-5.5.0.rpm

systemctl start elasticsearch.service

systemctl daemon-reload

systemctl enable elasticsearch.service

vim /etc/elasticsearch/elasticsearch.yml

cluster.name: my-elk-cluster
node.name: node2
path.data: /data/elk_data
path.logs: /var/log/elasticsearch
bootstrap.memory_lock: false
network.host: 0.0.0.0
http.port: 9200
discovery.zen.ping.unicast.hosts: ["node1", "node2"]

mkdir -p /data/elk_data

chown elasticsearch:elasticsearch /data/elk_data/

systemctl restart elasticsearch.service

netstat -napt |grep 9200

tar zxf node-v8.2.1.tar.gz

cd node-v8.2.1/

./configure && make && make install

tar xvjf phantomjs-2.1.1-linux-x86_64.tar.bz2

cd phantomjs-2.1.1-linux-x86_64/bin

cp phantomjs /usr/local/bin/

cd

tar xvzf elasticsearch-head.tar.gz

cd elasticsearch-head/

npm install

vim /etc/elasticsearch/elasticsearch.yml

http.cors.enabled: true
http.cors.allow-origin: "*"

systemctl restart elasticsearch.service

npm run start &

netstat -napt |grep 9200

netstat -napt |grep 9100

----------------------------测试--------------------

服务3：(LOGSTASH)

rpm -ivh logstash-5.5.1.rpm

ln -s /usr/share/logstash/bin/logstash /usr/local/bin/

yum -y install httpd

echo “

lxn dmn hhhhh

” >/var/www/html/index.html

systemctl start httpd

systemctl enable httpd

cd /etc/logstash/conf.d/

touch apache_log.conf

vim apache_log.conf

/usr/share/logstash/bin/logstash -f apache_log.conf

安装KIBANA服务：（服务器2中安装）

rpm -ivh kibana-5.5.1-x86_64.rpm

vim /etc/kibana/kibana.yml

systemctl start kibana.service

systemctl enable kibana.service