ELK elasticsearch7.8.0+kibana7.8.0 搭建过程-初稿

 

----------------------

1.1修改系统文件描述符大小 （请将原文件重复配置行注释掉）
echo "* soft nofile 655360
* hard nofile 655360
* soft nproc 655360
* hard nproc 655360
* soft memlock unlimited
* hard memlock unlimited" >> /etc/security/limits.conf
-----------------------
1.2修改 vm.max_map_count值
echo "vm.max_map_count = 655360">> /etc/sysctl.conf

sysctl -p
reboot
------------------------
2.1安装java1.8
yum install java-1.8.0-openjdk

export JAVA_HOME=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.262.b10-0.el7_8.x86_64
export CLASSPATH=:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar:$JRE_HOME/lib
export JRE_HOME=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.262.b10-0.el7_6.x86_64/jre
export PATH=$PATH:$JAVA_HOME/bin:$JRE_HOME/bin

java -version
-------------------------
3.1官网下载elasticsearch包等
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.8.0-linux-x86_64.tar.gz
https://artifacts.elastic.co/downloads/kibana/kibana-7.8.0-linux-x86_64.tar.gz
https://artifacts.elastic.co/downloads/logstash/logstash-7.8.0.tar.gz
---------------------------
3.2安装elasticsearch

tar -zxvf elasticsearch-7.8.0-linux-x86_64.tar.gz
mv elasticsearch-7.8.0 /opt/elasticsearch

添加elasticsearch用户，用来启动elasticsearch
# groupadd elasticsearch
# useradd elasticsearch -g elasticsearch

将elasticsearch目录授权给elasticsearch用户
#chown -R elasticsearch:elasticsearch /opt/elasticsearch
--------------------------------------
3.3修改elasticsearch配置文件
vim /opt/elasticsearch/config/elasticsearch.yml

cluster.name: novogenesearch
node.name: node-1
path.data: /opt/elasticsearch/data
path.logs: /opt/elasticsearch/logs
bootstrap.memory_lock: true
#bootstrap.memory_lock: false
#bootstrap.system_call_filter: false
network.host: 0.0.0.0
http.port: 9200
##discovery.zen.ping.unicast.hosts: ["192.168.0.58", "192.168.0.59", "192.168.0.60"]
cluster.initial_master_nodes: ["node-1"]
##discovery.zen.minimum_master_nodes: 2
http.cors.enabled: true
http.cors.allow-origin: "*"
http.cors.allow-credentials: true
http.cors.allow-headers: Authorization,X-Requested-With,Content-Length,Content-Type
--------------------------------------
3.4切换到elasticsearch用户启动elasticsearch
/opt/elasticsearch/bin/elasticsearch -d
测试 http://ip:9200
-------------------------------------
3.5下载elasticsearch-head-master.zip包
wget https://github.com/mobz/elasticsearch-head/archive/master.zip
#yum install unzip -y
unzip master.zip
mv elasticsearch-head-master /opt/
-------------------------------------
3.6安装node:由于head插件本质上还是一个nodejs的工程，因此需要安装node，使用npm来安装依赖的包。
wget https://nodejs.org/dist/v10.15.0/node-v10.15.0-linux-x64.tar.xz
xz -d node-v10.15.0-linux-x64.tar.xz
tar -xf node-v10.15.0-linux-x64.tar
mv node-v10.15.0-linux-x64 /opt/
添加node环境变量
vim /etc/profile
添加：
export NODE_HOME=/opt/node-v10.15.0-linux-x64
export PATH=$PATH:$NODE_HOME/bin
 
[root@elk-dev ~]#source /etc/profile

测试node是否安装成功
#node -v
#npm -v

-----------------------------------
3.7安装grunt(grunt是基于Node.js的项目构建工具，可以进行打包压缩、测试、执行等等工作，elasticsearch-head插件就是通过grunt启动的)
cd /opt/elasticsearch-head-master/
npm install -g grunt-cli
grunt -version测试是否安装成功

修改elasticsearch-head-master下Gruntfile.js配置文件，添加hostname: '*',
vim Gruntfile.js

 94                 connect: {
 95                         server: {
 96                                 options: {
 97                                         port: 9100,
 98                                         hostname: '*',
 99                                         base: '.',
100                                         keepalive: true
101                                 }
102                         }
103                 }
更换npm源
npm install -g cnpm --registry=https://registry.npm.taobao.org

使用cnpm安装
cnpm install
安装完成后没有报错的话启动elasticsearch-head-master
grunt server &
用浏览器测试是否正常http://xxx.xxx.xxx.xxx:9100
------------------------------------
4.1安装kibana
mv kibana-7.8.0-linux-x86_64.tar.gz /opt
cd /opt
# 解压安装包:
tar -zxf kibana-6.6.0-linux-x86_64.tar.gz
# 重命名
mv kibana-6.6.0-linux-x86_64 kibana
-----------------------------------
4.2配置kibana
文件位置: $kibana/config/kibana.yml:

server.port: 5601
server.host: xxx.xxx.xxx.xxx
kibana.index: ".kibana"
#汉化，在文件末尾添加：
i18n.locale: "zh-CN"
启动kibana
nohup ./kibana --allow-root > /dev/null 2>&1 &
-------------------------------------
5.1创建elasticsearch 密码

vim /opt/elasticsearch/config/elasticsearch.yml
原
101 # ---------------------------------- X-Pack -----------------------------------
102 http.cors.enabled: true
103 http.cors.allow-origin: "*"
104 http.cors.allow-credentials: true
105 http.cors.allow-headers: Authorization,X-Requested-With,Content-Length,Content-Type
修改为
101 # ---------------------------------- X-Pack -----------------------------------
102 http.cors.enabled: true
103 http.cors.allow-origin: "*"
104 #http.cors.allow-credentials: true
105 http.cors.allow-headers: Authorization,X-Requested-With,Content-Length,Content-Type
106 xpack.security.enabled: true
107 xpack.license.self_generated.type: basic
108 xpack.security.transport.ssl.enabled: true

cd /opt/elasticsearch/bin/

./elasticsearch-setup-passwords interactive

Enter password for [elastic]:
Reenter password for [elastic]:
Enter password for [apm_system]:
Reenter password for [apm_system]:
Enter password for [kibana_system]:
Reenter password for [kibana_system]:
Enter password for [logstash_system]:
Reenter password for [logstash_system]:
Enter password for [beats_system]:
Reenter password for [beats_system]:
Enter password for [remote_monitoring_user]:
Reenter password for [remote_monitoring_user]:
Changed password for user [apm_system]
Changed password for user [kibana_system]
Changed password for user [kibana]
Changed password for user [logstash_system]
Changed password for user [beats_system]
Changed password for user [remote_monitoring_user]
Changed password for user [elastic]
----------------------------------------

6.1配置nginx反向代理将80端口指向5601，关闭5601外网端口
cd /usr/local/src
wget http://nginx.org/download/nginx-1.18.0.tar.gz
tar -zxvf nginx-1.18.0.tar.gz
cd nginx-1.18.0/
./configure --with-http_ssl_module && make && make install

在 http{...}内添加
include vhost/*.conf;

mkdir vhost
vim ./vhost/kibana.novogene.com.conf
upstream kibana_server {
        server  172.17.8.3:5601 weight=1 max_fails=3  fail_timeout=60;
}

server {
        listen 80;
        server_name kibana.novogene.com;
        rewrite ^/(.*) https://kibana.novogene.com/$1 permanent;
}
server {
        listen 443 ssl;
        server_name kibana.novogene.com;
        ssl_certificate /usr/local/nginx/conf/vhost/3737519__novogene.com.pem;
        ssl_certificate_key /usr/local/nginx/conf/vhost/3737519__novogene.com.key;
        ssl_session_cache    shared:SSL:1m;    
        ssl_session_timeout  5m;    
        ssl_ciphers  HIGH:!aNULL:!MD5;    
        ssl_prefer_server_ciphers  on;
location / {
        proxy_pass http://kibana_server;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        }
}
上传证书文件到/usr/local/nginx/conf/vhost/
---------------------------------------
测试配置文件
cd /usr/local/nginx/sbin
./nginx -t
./nginx -c /usr/local/nginx/con/nginx.conf
启动nginx
./nginx -s reload
测试
---------------------------------------
开机自启脚本 start.sh
 
#!/bin/bash
/usr/local/nginx/sbin/nginx -c /usr/local/nginx/conf/nginx.conf
sleep 2
/usr/local/nginx/sbin/nginx -s reload
sleep 8
su - elasticsearch -c "/opt/elasticsearch/bin/elasticsearch -d"
sleep 20
nohup /opt/kibana/bin/kibana --allow-root > /dev/null 2>&1 &

加入/etc/rc.d/rc.local或/etc/rc.local
添加执行权限
chmod +x /root/start.sh
chmod +x /etc/rc.d/rc.local

############################################
##启动方法：                                                              ##
##启动es                                                                     ##
##su - elasticsearch                                                    ##
##/opt/elasticsearch/bin/elasticsearch -d                    ##
##启动kibana                                                              ##
##nohup ./kibana --allow-root > /dev/null 2>&1 &       ##
############################################