ELK高可用开源全文检索和分析组件
安装环境:
系统:centos7
IP1:192.168.100.128
IP2:192.168.100.130
组件
JDK
elasticsearch
logstash
kibana
1.安装JDK
2.安装elasticsearch
部署主机: 192.168.100.128
yum -y install elasticsearch-6.6.2.rpm
[root@centos7-1 ~]# cat /etc/elasticsearch/elasticsearch.yml |grep -v '^#' cluster.name: sun_jl node.name: node-1 path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch network.host: 192.168.100.128 http.port: 9200
[root@centos7-1 ~]# ll /var/log/elasticsearch/ 总用量 84 -rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:19 elasticsearch_access.log -rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:19 elasticsearch_audit.log -rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:19 elasticsearch_deprecation.log -rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:19 elasticsearch_index_indexing_slowlog.log -rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:19 elasticsearch_index_search_slowlog.log -rw-r--r--. 1 elasticsearch elasticsearch 9020 7月 9 14:23 elasticsearch.log -rw-r--r--. 1 elasticsearch elasticsearch 64207 7月 9 14:34 gc.log.0.current -rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:23 sun_jl_access.log -rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:23 sun_jl_audit.log -rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:23 sun_jl_deprecation.log -rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:23 sun_jl_index_indexing_slowlog.log -rw-r--r--. 1 elasticsearch elasticsearch 0 7月 9 14:23 sun_jl_index_search_slowlog.log -rw-r--r--. 1 elasticsearch elasticsearch 7133 7月 9 14:24 sun_jl.log
[root@centos7-1 ~]# netstat -anlp |grep java tcp6 0 0 192.168.100.128:9300 :::* LISTEN 4624/java tcp6 0 0 192.168.100.128:9200 :::* LISTEN 4624/java unix 2 [ ] STREAM CONNECTED 48840 4624/java unix 2 [ ] STREAM CONNECTED 50676 4624/java
3.安装logstash
部署:192.168.100.128
yum -y install logstash-6.6.0.rpm
编辑配置文件
[root@centos7-1 ~]# vim /etc/logstash/conf.d/messages.conf
[root@centos7-1 ~]# cat /etc/logstash/conf.d/messages.conf
input {
file {
path => "/var/log/messages"
type => "messages-log"
start_position => "beginning"
}
}
output {
elasticsearch {
hosts => "192.168.100.128:9200"
index => "messages_log-%{+YYYY.MM.dd}"
}
}
启动与权限
[root@centos7-1 ~]# systemctl start logstash.service [root@centos7-1 ~]# chmod -R 777 /var/log/ [root@centos7-1 ~]# ll /var/log/logstash/ 总用量 4 -rwxrwxrwx. 1 logstash logstash 3783 7月 9 14:47 logstash-plain.log -rwxrwxrwx. 1 logstash logstash 0 7月 9 14:47 logstash-slowlog-plain.log
4.安装kibana
部署:192.168.100.130
yum -y install kibana-6.6.2-x86_64.rpm
修改配置文件
[root@centos7 ~]# vim /etc/kibana/kibana.yml [root@centos7 ~]# cat /etc/kibana/kibana.yml |grep -v "^#"|sed '/^$/d' server.port: 5601 server.host: "192.168.100.130" elasticsearch.hosts: ["192.168.100.128:9200"]
[root@centos7 ~]# systemctl start kibana [root@centos7 ~]# netstat -anlp | grep 5601 tcp 0 0 192.168.100.130:5601 0.0.0.0:* LISTEN 2912/node
