elk安装

192.168.174.20 ： elasticsearch  kibana

192.168.174.21： logstash  nginx

先把相关包发送到相应服务器上

174.20 服务器上

rpm -ivh jdk-8u131-linux-x64_.rpm 安装jdk

yum -y install elasticsearch-6.6.2.rpm 安装 elasticsearch

更改elasticsearch配置文件

vim /etc/elasticsearch/elasticsearch.yml

============================

cluster.name: wg

node.name: node-1

network.host: 192.168.174.20

http.port: 9200

=====================

systemctl start elasticsearch  启动 elasticsearch

检查是否启动

ss -nlpt | grep java   9200 9300 两个端口

安装kibana

yum -y install kibana-6.6.2-x86_64.rpm

修改kibana配置文件

vim /etc/kibana/kibana.yml

===============================

server.port: 5601

server.host: "192.168.174.20"

elasticsearch.hosts: ["http://192.168.174.20:9200"]

==========================================

ss -nlpt | grep 5601   检查是否启动

174.21 服务器

rpm -ivh jdk-8u131-linux-x64_.rpm 安装jdk

yum -y install logstash-6.6.0.rpm 安装logstash

编写message.conf

===================================

input {
file {
path => "/var/log/messages"
type => "messages-log"
start_position => "beginning"
}
}

output {
elasticsearch {
hosts => "192.168.174.20:9200"
index => "messages_log-%{+YYYY.MM.dd}"
}

}

==================================

授权 chmod -R 777  /var/log

systemctl start logstash  启动logstash

然后在查看elasticsearch日志中是否成功索引

tailf /var/log/elasticsearch/wg.log

登陆kibana 192.168.174.20:5601