ELK搭建

一.搭建基础环境
1.关闭防火墙
2.更改主机名
3.改hosts文件
4.安装jdk
Vim /etc/profile
export JAVA_HOME=/usr/local/java/jdk1.8.0_181
export PATH=$JAVA_HOME/bin:$PATH

5.内核调优
vi /etc/sysctl.conf
vm.max_map_count=655360 然后保存
sysctl -p
vi /etc/security/limits.conf

• soft nofile 65536
• hard nofile 131072
• soft nproc 2048
• hard nproc 4096
  vi /etc/security/limits.d/20-nproc.conf

•     soft    nproc     65536
  

root soft nproc unlimited
必须重启！ 重启才可以生效
二.安装es
1.下载安装包
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.3.2.tar.gz
2.配置安装
tar -xvf elasticsearch-6.3.2.tar.gz -C /usr/local/elasticsearch-6.3.2/
3.新建用户
useradd feiyu
passwd feiyu
chown -R feiyu:feiyu elasticsearch-6.3.2/
4.修改配置文件
单机:
vi config/elasticsearch.yml
network.host: 你自己的服务器ip
http.port: 9200
5.启动服务
Su feiyu
bin/elasticsearch -d
netstat -nltp | grep 9200
6.测试
curl http://192.168.0.209:9200

7.安装插件
Yum -y install docker
docker pull mobz/elasticsearch-head:5
docker run -d -p 9100:9100 docker.io/mobz/elasticsearch-head:5
或者
mkdir -p /root/ELK
cd /root/ELKy
yum install git npm -y
git clone https://github.com/mobz/elasticsearch-head.git
cd elasticsearch-head
npm install
nohup npm run start &
8.测试

三.安装logstash
1.下载安装包
wget https://artifacts.elastic.co/downloads/logstash/logstash-6.3.2.tar.gz
2.解压安装
tar -zxvf logstash-6.3.2.tar.gz -C /usr/local/logstash-6.3.2
cd /usr/local/logstash-6.3.2/bin
3.改配置文件
/usr/local/logstash-6.3.2/config/logstash.yml

4.编写日志过滤文件格式
vi conf/erp-web.conf(路径及文件名自定义)
input {
file {
path => "/var/log/messages"
type => "system"
start_position => "beginning"
}
}
output {
elasticsearch {
hosts => ["192.168.1.202:9200"]
index => "system-%{+YYYY.MM.dd}"
}
}

5.启动服务

测试配置语法是否正确

bin/logstash -f config/erp-web.conf -t

指定配置文件启动

nohup bin/logstash -f config/erp-web.conf &

多配置文件启动：

nohup bin/logstash -f config/ &
四.安装kibana
1.下载安装包
wget https://artifacts.elastic.co/downloads/kibana/kibana-6.3.2-linux-x86_64.tar.gz
2.安装配置
tar zxvf kibana-6.3.2-linux-x86_64.tar.gz -C /usr/local/
cd /usr/local/kibana-6.3.2-linux-x86_64/config
vim kibana.yml

3.启动服务
./kibana &
netstat -nltp| grep 5601