Centos7安装ELK之SpringBoot整合ELK

安装ElasticSearch

1.先创建安装目录

mkdir /usr/local/elasticsearch

2.elasticsearch-7.6.2安装包

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.6.2-linux-x86_64.tar.gz

3 将下载好的安装包移动到新建目录下

mv elasticsearch-7.6.2-linux-x86_64.tar.gz /usr/local/elasticsearch

4.解压安装包到当前目录/usr/local/elasticsearch

tar -zxvf xvf elasticsearch-7.6.2-linux-x86_64.tar.gz

5.解压完成进入到elasticsearch-7.6.2/config目录下更改配置文件

vim elasticsearch.yml

node.name: node-1
path.data: /usr/local/elasticsearch/elasticsearch-7.6.2/data
network.host: 0.0.0.0
http.port: 9200
cluster.initial_master_nodes: ["node-1"]

6.启动elasticsearch，这里要注意，elasticsearch不支持root用户下启动，所以新建一个用户

#创建用户
adduser testelastic
passwd 123456

#切换用户
su testelastic

#启动elasticsearch 进入到elasticsearch-7.6.2/bin目录下
./elasticsearch
#后台启动
./elasticsearch -d

7.启动遇到的错误

修改限制  /etc/sysctl.conf 文件
执行命令：sudo vi /etc/sysctl.conf 
vm.max_map_count=655360  # 将这一行加入到文件最后一行
# 查看是否生效
执行命令：sudo sysctl -p

每个进程最大同时打开文件数太小，修改打开文件数的大小

执行命令：sudo vi /etc/security/limits.conf  # 将以下内容添加到文件最后

 *               soft    nproc           4096
 *               soft    nofile          65536
 *               hard    nproc           4096
 *               hard    nofile          65536

# 执行查看软限制大小
执行：ulimit -Sn 
# 执行命令查看硬限制大小
执行：ulimit -Hn

再次启动：./elasticsearch

8.查看是否启动

curl 'http://192.168.213.128:9200'

出现以下则启动成功

{
  "name" : "node-1",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "RThfTiDXQzyGCdAFm89K8g",
  "version" : {
    "number" : "7.6.2",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "ef48eb35cf30adf4db14086e8aabd07ef6fb113f",
    "build_date" : "2020-03-26T06:34:37.794943Z",
    "build_snapshot" : false,
    "lucene_version" : "8.4.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

安装Kibana

1.先创建安装目录

mkdir /usr/local/kibana

2.下载kibana-7.6.2

wget https://artifacts.elastic.co/downloads/kibana/kibana-7.6.2-linux-x86_64.tar.gz

3.将下载好的安装包移动到新建目录下

mv kibana-7.6.2-linux-x86_64.tar.gz /usr/local/kibana

4.解压kibana-7.6.2-linux-x86_64.tar.gz

tar -zxvf kibana-7.6.2-linux-x86_64.tar.gz

5.修改配置文件

cd /usr/local/kibana/kibana-7.6.2-linux-x86_64/config
vim kibana.yml

# 修改为以下内容：
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://localhost:9200"]

6.启动Kibana，进入到bin目录

./kibana

7.访问kibana

http://192.168.213.128:5601

8.汉化

vim kibana.yml
i18n.locale: "zh-CN"

重新启动kibana

安装Logstash

1.下载logstash-7.6.2

curl -L -O https://artifacts.elastic.co/downloads/logstash/logstash-7.6.2.tar.gz

2.解压

tar -zxvf logstash-7.6.2.tar.gz

3.修改配置文件 config/logstash.yml

http.host: "192.168.213.128"

4.新建配置文件 vim config/logstash.conf

input {
  tcp {
    mode => "server"
    #ip和端口，端口默认4560,对应下文logback-spring.xml中appender的destination
    host => "192.168.213.128"
    port => 4560
    #格式json
    codec => json_lines
  }
}
filter {
  #过滤器
}
output {
  elasticsearch {
    #这是elasticsearch的地址，集群配置要写成数组的格式
    hosts  => "192.168.213.128"
  }
}

5.启动

./bin/logstash -f logstash.conf

6.启动错误解决，编辑该文件：bin/logstash.lib.sh，文件第一行添加环境变量引用

export JAVA_HOME="/java/jdk/jdk1.8.0"

SpringBoot整合ELK

1、pom.xml 引入logstash依赖：

<!-- logstash 日志收集 -->
<dependency>
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>5.1</version>
</dependency>

2、新建日志文件：logback-spring.xml ，注意修改日志收集端口

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE configuration>
<configuration>
    <include resource="org/springframework/boot/logging/logback/defaults.xml"/>
    <include resource="org/springframework/boot/logging/logback/console-appender.xml"/>
    <!--应用名称-->
    <property name="APP_NAME" value="myspringboot-elk"/>
    <!--日志文件保存路径-->
    <property name="LOG_FILE_PATH" value="${LOG_FILE:-${LOG_PATH:-${LOG_TEMP:-${java.io.tmpdir:-/tmp}}}/logs}"/>
    <contextName>${APP_NAME}</contextName>
    <!--每天记录日志到文件appender-->
    <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <fileNamePattern>${LOG_FILE_PATH}/${APP_NAME}-%d{yyyy-MM-dd}.log</fileNamePattern>
            <maxHistory>30</maxHistory>
        </rollingPolicy>
        <encoder>
            <pattern>${FILE_LOG_PATTERN}</pattern>
        </encoder>
    </appender>
    <!--输出到logstash的appender-->
    <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <!--访问logstash日志收集端口-->
        <destination>192.168.213.128:4560</destination>
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder"/>
    </appender>
    <root level="INFO">
        <appender-ref ref="CONSOLE"/>
        <appender-ref ref="FILE"/>
        <appender-ref ref="LOGSTASH"/>
    </root>
</configuration>

文章到此结束，感谢支持。