ELK ( 一 ) 安装与配置

ELK 安装

（默认环境需要依赖JDK,这里不做JDK等安装配置说明了）

(若有自定义data和logs目录，需要给对应的用户和组权限 如【chown es:es /user/data】)

安装配置

Elasticsearch

# 华为镜像下载
wget -c  https://mirrors.huaweicloud.com/elasticsearch/7.2.1/elasticsearch-7.2.1-x86_64.rpm
# 安装 RPM 包
rpm -ivh elasticsearch-7.2.1-x86_64.rpm
# 查看安装信息
rpm -qi elasticsearch

# 启动并设置开机启动
systemctl daemon-reload
systemctl start elasticsearch
## 开机启动
systemctl enable elasticsearch.service

# 查看 Elasticsearch 运行状态
systemctl status elasticsearch
ps -ef | grep elasticsearch
netstat -nlpt

# 尝试请求
curl localhost:9200

## 出现以下信息即请求成功
{
  "name" : "node-test",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "TmdINQ9FSJKSeK2INt_MVA",
  "version" : {
    "number" : "7.2.1",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "fe6cb20",
    "build_date" : "2019-07-24T17:58:29.979462Z",
    "build_snapshot" : false,
    "lucene_version" : "8.0.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

# 设置允许其他机器访问
vim /etc/elasticsearch/elasticsearch.yml
## 修改以下内容

    # line 17, uncomment
    cluster.name: my-application
    # line 22, uncomment and change
    node.name: node-1
    # line 55, uncomment and change
    network.host: 0.0.0.0
    # line 59, uncomment
    http.port: 9200
    # line 72, uncomment and change
    cluster.initial_master_nodes: ["node-1"]
    # 这里如果有修改 data 和 logs 路径，需要给予组和用户权限
    chown elasticsearch:elasticsearch /对应目录
    
# 重启 Elasticsearch
systemctl stop elasticsearch
systemctl start elasticsearch
# 启动后稍等一会
netstat -nlpt

# 如果可以看到 :::9200,就可以通过外部浏览器访问 Elasticsearch服务了，到此Elasticsearch安装配置完成！！

Kibana

# 华为镜像下载
wget -c https://mirrors.huaweicloud.com/kibana/7.2.1/kibana-7.2.1-x86_64.rpm
# 安装 RPM 包
rpm -ivh kibana-7.2.1-x86_64.rpm
# 查看安装信息
rpm -qi kibana

# 启动并配置开机启动
systemctl start kibana
systemctl enable kibana

# 查看 Kibana 运行状态
systemctl status kibana
ps -ef | grep kibana
netstat -nlpt

# 配置允许远程机器访问
vim /etc/kibana/kibana.yml
 ## 修改下面信息
 	# line 2, uncomment and change
    server.port: 5601
    # line 7, uncomment and change
    server.host: "0.0.0.0"
    # line 28, uncomment
    elasticsearch.hosts: ["http://localhost:9200"]

# 重启 Kibana
systemctl stop kibana
systemctl start kibana

# 启动后稍微等一下
netstat -nlpt
# 如果可以看到0.0.0.0:5601，就可以通过外部浏览器访问Kibana服务了，至此Kibana安装配置完成。

Logstash

# 华为镜像下载
wget -c https://mirrors.huaweicloud.com/logstash/7.2.1/logstash-7.2.1.rpm
# 安装 RPM 包
rpm -ivh logstash-7.2.1.rpm
# 查看安装信息
rpm -qi logstash

# 启动
systemctl start logstash

# 查看运行状态
systemctl status logstash
ps -ef | grep logstash
netstat -nlpt

# logstash hello world
systemctl stop logstash
/usr/share/logstash/bin/logstash -e 'input { stdin { } } output { stdout {} }'

输入启动命令后，耐心等待服务启动，直到出现Successfully started Logstash API endpoint。输入“hello world”回车，即可打印出输出。

logstash通过管道来处理数据，标准的管道包含input、filter和output。以上命令，指定了一个管道的参数，没有filter，input是控制台标准输入，output是控制台标准输出。

• 管道配置写入文件

  在配置文件目录中，新建配置文件std.conf,内容为

  input{
  	stdin{}
  }
  output{
  	stdout {}
  }
  

• 测试配置文件并启动

  /usr/share/logstash/bin/logstash --path.settings /etc/logstash -f /home/elk/logstash/conf/std.conf