elk7.6.2_01_单节点版部署

环境：centos7.7

准备工作： jdk、elk安装包

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.6.2-linux-x86_64.tar.gz

1.修改内核参数：

[root@es02 config]# echo "vm.max_map_count=262144" >> /etc/sysctl.conf
[root@es02 config]# sysctl -p
vm.max_map_count = 262144
[root@master-node ~]# vim /etc/security/limits.conf
* soft nproc 65536
* hard nproc 65536
* soft nofile 65536
* hard nofile 65536

2.jdk

[root@es02 ~]# yum remove *jdk* *java*
[root@es02 ~]# tar -C /usr/ -zxvf openjdk-11+28_linux-x64_bin.tar.gz
[root@es02 ~]# vim /etc/profile

JAVA_HOME=/usr/jdk-11
PATH=$JAVA_HOME/bin:$PATH
CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
export JAVA_HOME
export PATH
export CLASSPATH

[root@es02 ~]# source /etc/profile
[root@es02 ~]# java -version

3.创建elk用户

[root@es02 ~]# groupadd elk
[root@es02 ~]# useradd -g elk elk
[root@es02 ~]# passwd elk

4.ElasticSearch

4.1 install

[root@es02 A010_elk]# tar -C /usr/local/ -zxvf elasticsearch-7.6.2-linux-x86_64.tar.gz
[root@es02 A010_elk]# cd /usr/local
[root@es02 local]# mv elasticsearch-7.6.2 elasticsearch
[root@es02 local]# chown -R elk:elk elasticsearch
[root@es02 local]# echo 'ES_HOME=/usr/local/elasticsearch' >> /etc/profile

4.2 config

[root@es02 ~]# cd /var/log/
[root@es02 log]# mkdir elasticsearch
[root@es02 log]# chown -R elk:elk elasticsearch
[root@es02 ~]# mkdir -p /data/elasticsearch
[root@es02 ~]# chown -R elk:elk /data/elasticsearch
[root@es02 ~]# cp /usr/local/elasticsearch/config/elasticsearch.yml{,.bakup}
[root@es02 ~]# vim /usr/local/elasticsearch/config/elasticsearch.yml

cluster.name: HZZ-ELK-Cluster
node.name: ${HOSTNAME}
path.data: /data/elasticsearch
path.logs: /var/log/elasticsearch
#network.host: 127.0.0.1
network.host: 192.168.1.72
http.port: 9200
cluster.initial_master_nodes: ["192.168.1.72"]

4.3 startup

[root@es02 ~]# su - elk
[elk@es02 ~]$ cd $ES_HOME
[elk@es02 elasticsearch]$ ./bin/elasticsearch -d -p pid
[elk@es02 elasticsearch]$ curl 192.168.1.72:9200
[elk@es02 elasticsearch]$ curl -X GET "192.168.1.72:9200/"

{
  "name" : "es02",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "Ebl03w5XQf6IIKVHeS-asg",
  "version" : {
    "number" : "7.6.2",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "ef48eb35cf30adf4db14086e8aabd07ef6fb113f",
    "build_date" : "2020-03-26T06:34:37.794943Z",
    "build_snapshot" : false,
    "lucene_version" : "8.4.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

[root@es02 log]# curl -X GET "192.168.1.72:9200/_cat/nodes?v"
ip           heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name
192.168.1.72            7          96   1    0.06    0.06     0.08 dilm      *      es02
[root@es02 log]# curl -X GET "192.168.1.72:9200/_cat/health?v"
epoch      timestamp cluster         status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent
1587636059 10:00:59  HZZ-ELK-Cluster green           1         1      0   0    0    0        0             0                  -                100.0%
[root@localhost filebeat]# curl -X GET "192.168.1.72:9200/_cat/indices?v"
health status index                            uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   .kibana_task_manager_1           NM8G5rwVQm-3vHnSb-g0vw   1   0          2            0     34.1kb         34.1kb
green  open   .apm-agent-configuration         aVHVjoWFQHOlXnkfv4KwmA   1   0          0            0       283b           283b
green  open   ilm-history-1-000001             EL3FbYWiTXSFVvnvyW0leg   1   0         18            0     25.3kb         25.3kb
yellow open   filebeat-7.6.2-2020.04.24-000001 Dp9mkAygTRq-qKKAwpKUqQ   1   1      35303            0      4.2mb          4.2mb
green  open   .kibana_1                        8yop_FPbQMql2YtwVa11aA   1   0          8           10     50.5kb         50.5kb
yellow open   syslog-2020.04.24                1vQgkHQkQsOf1RZT-bTvQA   1   1         74            0    103.6kb        103.6kb
[root@es02 log]# curl -X GET http://api.zsearch-gtj.alipay.com/?pretty

5.logstash

[root@es02 local]# tar -zxvf logstash-7.6.2.tar.gz -C /usr/local/
[root@es02 home]# cd /usr/local/
[root@es02 local]# mv logstash-7.6.2 logstash

input {
    file {
        path => ["/var/log/messages"]
        type => "syslog"
    }
}

filter {
    grok {
        match => [ "message", "%{SYSLOGBASE} %{GREEDYDATA:content}" ]
    }
}

output {
    elasticsearch {
        hosts => ["192.168.1.72:9200"]
        index => "syslog-%{+YYY.MM.dd}"
    }
}

[root@es02 logstash]# cd /usr/local/logstash
[root@es02 logstash]# ./bin/logstash -f /usr/local/logstash/config/logstash.conf &
[root@es02 logstash]# ./bin/logstash -f /usr/local/logstash/config/logstash-sample.conf &
[root@es02 logstash]# curl localhost:9600
9600 5044

6.kibana

[root@es02 local]# tar -C /usr/local/ -zxvf kibana-7.6.2-linux-x86_64.tar.gz
[root@es02 es]# cd /usr/local/
[root@es02 local]# mv kibana-7.6.2-linux-x86_64 kibana
[root@es02 config]# touch /var/log/kibana.log
[root@es02 config]#  chmod 777 /var/log/kibana.log
[root@es02 local]# cp kibana/config/kibana.yml{,.bakup}

[root@es02 config]# cat kibana.yml
server.port: 5601
server.host: 192.168.1.72
elasticsearch.hosts: "http://192.168.1.72:9200"
logging.dest: /var/log/kibana.log

[root@es02 local]# chown -R elk:elk kibana
[root@es02 local]# su - elk
[elk@es02 ~]$ cd /usr/local/kibana/bin/
[elk@es02 ~]$ ./kibana &
http://192.168.1.72:5601/app/kibana#/home?_g=()

7.filebeat

[root@localhost usr]# tar -C /usr/local/ -zxvf filebeat-7.6.2-linux-x86_64.tar.gz
[root@localhost local]# mv filebeat-7.6.2-linux-x86_64 filebeat