基本环境：
服务器1：node1/192.168.10.1 4G内存 安装E,K
服务器2：node2/192.168.10.2 4G内存 安装E
服务器3：Apache/192.168.10.3 2G内存 安装L
一、node节点配置
node1:
1、修改计算机名
hostname node1
2、配置域名解析
vim /etc/hosts
添加：
192.168.10.1 node1
192.168.10.2 node2
3、监控java环境，是否为1.8版，如不满足，更新Java环境。
java -version
4、在node1和node2安装elasticsearch软件
[root@node1 ~]# rpm -ivh elasticsearch-5.5.0.rpm
[root@node1 ~]# systemctl daemon-reload
[root@node1 ~]# systemctl enable elasticsearch.service
[root@node1 ~]# vim /etc/elasticsearch/elasticsearch.yml
修改：
#cluster.name: my-elk-cluster
node.name: node-1
path.data: /data/elk_data
path.logs: /var/log/elasticsearch/
bootstrap.memory_lock: false
network.host: 0.0.0.0
http.port: 9200
#discovery.zen.ping.unicast.hosts: ["node1", "node2"]
[root@node1 ~]# mkdir -p /data/elk_data
[root@node1 ~]# chown elasticsearch:elasticsearch /data/elk_data
[root@node1 ~]# systemctl start elasticsearch.service
[root@localhost ~]# cd /etc/elasticsearch/
[root@localhost elasticsearch]# netstat -anpt |grep 9200
查看node1信息
[root@node1 ~]# firefox http://192.168.10.1:9200 &
node2配置：
1、修改计算机名
hostname node2
2、配置域名解析
vim /etc/hosts
添加：
192.168.10.1 node1
192.168.10.2 node2
其他安装配置同node1
查看node2信息
[root@node2 ~]# firefox http://192.168.10.1:9200 &
测试群集的监控状态
firefox http://192.168.10.1:9200/_cluster/health?pretty &
3、安装elasticsearch-head插件
1.编译安装node组件，安装时间比较长。
[root@node1 ~]# tar -zxvf node-v8.2.1.tar.gz -C /usr/src
[root@node1 ~]# cd /usr/src/node-v8.2.1
[root@node1 node-v8.2.1]# ./configure && make && make install
2.安装phantomjs组件
[root@node1 ~]# tar xvjf phantomjs-2.1.1-linux-x86_64.tar.bz2 -C /usr/src
[root@node1 ~]# cd /usr/src/phantomjs-2.1.1/bin/
[root@node1 bin]# cp phantomjs /usr/local/bin/
3.安装Elasticsearch-head组件
[root@node1 ~]# tar -zvxf elasticsearch-head.tar.gz -C /usr/src
[root@node1 ~]# cd /usr/src/elasticsearch-head/
[root@node1 lasticsearch-head]# npm install
4.修改Elasticsearch主配置文件
[root@node1 ~]# vim /etc/elasticsearch/elasticsearch.yml
在最后添加：
http.cors.enabled: true
http.cors.allow-origin: "*"
[root@node1 ~]# systemctl restart elasticsearch.service
[root@node1 ~]# npm run start &
[root@node1 ~]# netstat -lnupt |grep 9100
[root@node1 ~]# netstat -lnupt |grep 9200
5.测试
[root@node1 ~]# firefox http://192.168.10.1:9100 &
[root@node1 ~]# curl -XPUT 'localhost:9200/index-demo/test/1?pretty&pretty' -H 'Content-Type:application/json' -d '{"user":"zhang3","mesg":"hello world"}'
在浏览器中查看浏览数据
6.安装logstash组件
[root@node1 ~]# rpm -ivh logstash-5.5.1.rpm
[root@node1 ~]# systemctl restart logstash.service
[root@node1 ~]# ln -s /usr/share/logstash/bin/logstash /usr/local/bin/
[root@node1 ~]# chmod o+r /var/log/messages
[root@node1 ~]# touch /etc/logstash/conf.d/system.conf
[root@node1 ~]# vim /etc/logstash/conf.d/system.conf
添加：
input {
file{
path => "/var/log/messages"
type => "system"
start_position => "beginning"
}
}
output {
elasticesarch {
hosts => ["192.168.10.1:9200"]
index => "system-%{+YYYY.MM.dd}"
}
}
[root@node1 ~]# systemctl restart logstash
7.安装kibana组件
[root@node1 ~]# rpm -ivh kibana-5.5.1-x86_64.rpm
[root@node1 ~]# systemctl enable kibana.service
[root@node1 ~]# vim /etc/kibana/kibana.yml
修改：
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.url: "http://192.168.10.1:9200"
kibana.index: ".kibana"
[root@node1 ~]# systemctl restart kibana
测试：
[root@node1 ~]# firefox http://192.168.10.1:5601
8.在apache服务器上安装logstash组件
[root@localhost ~]# rpm -ivh logstash-5.5.1.rpm
[root@localhost ~]# systemctl daemon-reload
[root@localhost ~]# systemctl enable logstash.service
9.编写配置文件apache_log.conf
[root@localhost ~]# cd /etc/logstash/conf.d
[root@localhost conf.d]# vim apache_log.conf
添加：
input {
file{
path => "/var/log/httpd/access_log"
type => "access"
start_position => "beginning"
}
file{
path => "/var/log/httpd/error_log"
type => "error"
start_position => "beginning"
}
}
output {
if [type] == "access" {
elasticesarch {
hosts => ["192.168.10.1:9200"]
index => "apache_access-%{+YYYY.MM.dd}"
}
}
if [type] == "error" {
elasticesarch {
hosts => ["192.168.10.1:9200"]
index => "apache_error-%{+YYYY.MM.dd}"
}
}
}
[root@localhost conf.d]# /usr/share/logstash/bin/logstash -f apache_log.conf
