ELK7.17离线安装

ElasticSearch安装

版本：Centos7、ElasticSearch7.17.6

节点列表

• es1：27.196.38.200 master、data
• es2：27.196.38.201 master、data
• es3：27.196.38.202 master、data

基础设置

在所有节点执行
0、关闭防火墙

systemctl stop firewalld
systemctl disable firewalld
setenforce 0
sed -i "s/SELINUX=enforcing/SELINUX=disabled/g" /etc/selinux/config

1、设置主机名（每个节点单独执行）

hostnamectl set-hostname es1
hostnamectl set-hostname es2
hostnamectl set-hostname es3

修改/etc/hosts (略)
2、添加用户

adduser elastic
passwd elastic 

3、创建目录

mkdir -p /data/esdata
mkdir -p /data/eslogs
chown -R elastic /data/esdata
chown -R elastic /data/eslogs

4、调整系统参数

vi /etc/security/limits.conf
* soft nofile 65536
* hard nofile 65536
* soft nproc 65536
* hard nproc 65536
* hard memlock unlimited
* soft memlock unlimited

vi /etc/sysctl.conf
vm.max_map_count=262144
sysctl -p  #重启生效

ES配置

tar -zxvf elasticsearch-7.17.6-linux-x86_64.tar.gz -C /usr/local/
chown -R elastic /usr/local/elasticsearch-7.17.6

1、修改配置文件

vi /usr/local/elasticsearch-7.17.6/config/elasticsearch.yml

es1：27.196.38.200的配置内容：

cluster.name: es4log
node.name: node1
path.data: /data/esdata
path.logs: /data/eslogs
bootstrap.memory_lock: true
network.host: 27.196.38.200
http.host: 27.196.38.200
http.port: 9200
discovery.seed_hosts: ["27.196.38.200", "27.196.38.201", "27.196.38.202"]
cluster.initial_master_nodes: ["node1", "node2", "node3"]

action.auto_create_index: true
cluster.max_shards_per_node: 10000
xpack.security.enabled: false
xpack.security.audit.enabled: false
xpack.security.http.ssl.enabled: false
xpack.security.transport.ssl.enabled: false

http.cors.enabled: true
http.cors.allow-origin: "*"
ingest.geoip.downloader.enabled: false

es2：27.196.38.201的配置，差异的地方：

node.name: node2
network.host: 27.196.38.201
http.host: 27.196.38.201

es3：27.196.38.202的配置，差异的地方：

node.name: node3
network.host: 27.196.38.202
http.host: 27.196.38.202

2、启动es1

su elastic
nohup /usr/local/elasticsearch-7.17.6/bin/elasticsearch > /tmp/eslog.txt 2>&1 &

同样方式，启动es2、es3。

3、确认集群是否正常
http://27.196.38.200:9200/_cat/health?v
http://27.196.38.200:9200/_cat/nodes

Kibana安装

在27.196.38.200节点安装

tar -zxvf kibana-7.17.6-linux-x86_64.tar.gz
mv kibana-7.17.6-linux-x86_64 /usr/local/kibana-7.17.6
chown -R elastic /usr/local/kibana-7.17.6

vi /usr/local/kibana-7.17.6/config/kibana.yml

#配置端口号
server.port: 5601
#配置网络访问地址
server.host: "0.0.0.0"
server.publicBaseUrl: "http://27.196.38.200:5601"
#配置es地址
elasticsearch.hosts: ["http://27.196.38.200:9200", "http://27.196.38.201:9200", "http://27.196.38.202:9200"]
#配置中文语言界面
i18n.locale: "zh-CN"

启动kibana

su elastic
nohup /usr/local/kibana-7.17.6/bin/kibana > /tmp/kibanalog.txt 2>&1 &

访问地址：http://27.196.38.200:5601

Logstash安装

27.196.38.200

tar -zxvf logstash-7.17.6-linux-x86_64.tar.gz
mv logstash-7.17.6 /usr/local/
cd /usr/local/logstash-7.17.6/config
cp logstash-sample.conf logstash.conf

启动

nohup /usr/local/logstash-7.17.6/bin/logstash -f /usr/local/logstash-7.17.6/config/logstash.conf > /tmp/logstashlog.txt 2>&1 &