1、安装包下载
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.15.1-linux-x86_64.tar.gz wget https://artifacts.elastic.co/downloads/logstash/logstash-7.15.1-linux-x86_64.tar.gz wget https://artifacts.elastic.co/downloads/kibana/kibana-7.15.1-linux-x86_64.tar.gz wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.15.1-linux-x86_64.tar.gz
2.解压安装包
tar -xzf elasticsearch-7.15.1-linux-x86_64.tar.gz tar -xzf logstash-7.15.1-linux-x86_64.tar.gz tar -xzf kibana-7.15.1-linux-x86_64.tar.gz tar -xzf filebeat-7.15.1-linux-x86_64.tar.gz
3、创建用户
因为es和kibana必须用非root用户登录
groupadd es useradd es_user -g es chown -R es_user:es elasticsearch-7.15.1 chown -R es_user:es kibana-7.15.1
4、安装配置elasticsearch
cd elasticsearch-7.15.1 vim config/elasticsearch.yml
插入以下内容
#更换存储文件位置以及logs位置 path.data: /mnt/elasticsearch/data path.logs: /mnt/elasticsearch/logs #禁止交换分区 bootstrap.memory_lock: false network.host: 0.0.0.0 http.port: 9200 #为了让elasticsearch-head插件可以访问es http.cors.enabled: true http.cors.allow-origin: "*" cluster.initial_master_nodes: ["elk"] node.name: elk
修改配置 如果你有JAVA jdk 是11或以上可忽略此步
vim elasticsearch-7.15.1/bin/elasticsearch-env # 在 set -e -o pipefail 下一行插入如下内容 export JAVA_PATH=/www/server/elasticsearch-7.15.1/jdk
修改系统文件
vim /etc/security/limits.conf # 在文件中插入如下内容 给 es_user 赋予更多操作空间（否则它施展不开拳脚） es_user soft nofile 65535 es_user hard nofile 65535 es_user soft nproc 4096 es_user hard nproc 4096
vi /etc/sysctl.conf # 文件中写入如下内容 增加最大运行内存 vm.max_map_count=262144
刷新内存
sysctl -p
开启ES对外默认端口 9200
firewall-cmd --zone=public --add-port=9200/tcp --permanent #重启防火墙 firewall-cmd --reload
配置注册es服务
cd /usr/lib/systemd/system vim elasticsearch.service //插入以下内容 [Unit] Description=elasticsearch After=network.target [Service] Type=forking User=es_user #自己更改es位置 ExecStart=/www/server/elasticsearch-7.15.1/bin/elasticsearch -d PrivateTmp=true # 指定此进程可以打开的最大文件数 LimitNOFILE=65535 # 指定此进程可以打开的最大进程数 LimitNPROC=65535 # 最大虚拟内存 LimitAS=infinity # 最大文件大小 LimitFSIZE=infinity # 超时设置 0-永不超时 TimeoutStopSec=0 # SIGTERM是停止java进程的信号 KillSignal=SIGTERM # 信号只发送给给JVM KillMode=process # java进程不会被杀掉 SendSIGKILL=no # 正常退出状态 SuccessExitStatus=143 [Install] WantedBy=multi-user.target
设置自启
systemctl enable elasticsearch.service
启动es
# 启动服务 service elasticsearch start
测试，如下证明启动成功
curl 127.0.0.1:9200
{
"name" : "elk",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "EVntMHqzS2WEsFSsUoQDMQ",
"version" : {
"number" : "7.15.1",
"build_flavor" : "default",
"build_type" : "tar",
"build_hash" : "83c34f456ae29d60e94d886e455e6a3409bba9ed",
"build_date" : "2021-10-07T21:56:19.031608185Z",
"build_snapshot" : false,
"lucene_version" : "8.9.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
5.kibana安装
修改kibana.yml配置文件
vim /www/server/kibana-7.15.1/config/kibana.yml
修改以下参数
# 端口 server.port: 5601 # 服务地址 server.host: "0.0.0.0" # 服务名称 server.name: "bp-kibana" # elasticsearch服务地址 elasticsearch.hosts: ["http://localhost:9200"] # 设置为简体中文 i18n.locale: "zh-CN"
打开5601端口
firewall-cmd --permanent --zone=public --add-port=5601/tcp #重启防火墙 systemctl reload firewalld
注册服务
vim /usr/lib/systemd/system/kibana.service
填入以下内容
[Unit] Description=Kibana [Service] LimitNOFILE=100000 LimitNPROC=100000 ExecStart=/www/server/kibana/bin/kibana User=es_user Group=es [Install] WantedBy=multi-user.target
设置开机启动
systemctl enable kibana.service
相关命令
# 启动服务 systemctl start kibana.service # 重启服务 systemctl restart kibana.service # 停止服务 systemctl stop kibana.service # 禁止开机启动 systemctl disable kibana.service # 启用开机启动 systemctl enable kibana.service
测试
访问你自己本机外网ip:5601 例如192.168.1.255:5061看到以下界面
6 logstash安装
logstash不用创建用户直接用root用户安装就好
cd logstash-7.15.1/ vim config/logstash.yml 编辑以下内容 node.name: cpy04.dev.xjh.com #设置节点名称，一般写主机名 path.data: /mnt/logstash #创建logstash 和插件使用的持久化目录 config.reload.automatic: true #开启配置文件自动加载 config.reload.interval: 10 #定义配置文件重载时间周期 http.host: "XXX.com" #定义访问主机名，一般为域名或IP
配置logstash input 段
在config下编写最后以.conf结尾
input {
beats {
port => "5044"
}
}
filter {
if [fields][doc_type] == 'order' {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{JAVALOGMESSAGE:msg}" }
}
}
if [fields][doc_type] == 'customer' {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{JAVALOGMESSAGE:msg}" }
}
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => [ "127.0.0.1:9200" ]
index => "%{[fields][doc_type]}-%{+YYYY.MM.dd}"
}
}
配置服务启动
1、修改config目录下的 startup.optins
################################################################################
# These settings are onLY used by $LS_HOME/bin/system-install to create a custom
# startup script for Logstash and is not used by Logstash itself. It should
# automagically use the init system (systemd, upstart, sysv, etc.) that your
# Linux distribution uses.
#
# After changing anything here, you need to re-run $LS_HOME/bin/system-install
# as root to push the changes to the init script.
################################################################################
# Override Java location
#JAVACMD=/usr/bin/java
# Set a home directory
LS_HOME=/www/server/logstash
# logstash settings directory, the path which contains logstash.yml
LS_SETTINGS_DIR=/www/server/logstash/config
# Arguments to pass to logstash
LS_OPTS="--path.settings ${LS_SETTINGS_DIR} -f ${LS_HOME}/conf.d"
# Arguments to pass to java
LS_JAVA_OPTS=""
# pidfiles aren't used the same way for upstart and systemd; this is for sysv users.
LS_PIDFILE=/var/run/logstash.pid
# user and group id to be invoked as
LS_USER=root
LS_GROUP=root
# Enable GC logging by uncommenting the appropriate lines in the GC logging
# section in jvm.options
LS_GC_LOG_FILE=/var/log/logstash/gc.log
# Open file limit
LS_OPEN_FILES=16384
# Nice level
LS_NICE=19
# Change these to have the init script named and described differently
# This is useful when running multiple instances of Logstash on the same
# physical box or vm
SERVICE_NAME="logstash"
SERVICE_DEscriptION="logstash"
# If you need to run a command or script before launching Logstash, put it
# between the lines beginning with `read` and `EOM`, and uncomment those lines.
###
## read -r -d '' PRESTART << EOM
## EOM
执行
bin/system-install
显示如图
启动Logstash服务 设置服务自启动：systemctl enable logstash 启动服务：systemctl start logstash 停止服务：systemctl stop logstash 重启服务：systemctl restart logstash 查看服务状态：systemctl status logstash
7 filebeat安装配置
配置filebeat.yml文件
filebeat.inputs:
- paths:
- /mnt/logs/order.log (自己找到要记录的log文件)
multiline:
pattern: ^d{4}
negate: true
match: after
fields:
doc_type: order
- paths:
- /mnt/logs/customer.log
multiline:
pattern: ^d{4}
negate: true
match: after
fields:
doc_type: customer
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
output.logstash:
hosts: ["127.0.0.1:5044"]
配置自启动
vi /usr/lib/systemd/system/filebeat.service
[Unit] Description=filebeat Wants=network-online.target After=network-online.target [Service] User=root ExecStart=/www/server/filebeat/filebeat -e -c /www/server/filebeat/filebeat.yml Restart=always [Install] WantedBy=multi-user.target
注意：如果不知道filebeat的路径可以用find查找
例：# find / -name filebeat.yml
就会找到：/www/server/filebeat/filebeat.yml
启动
systemctl daemon-reload #加载配置 systemctl start filebeat #启动filebeat服务 systemctl enable filebeat #设置开机自启 systemctl list-units --type=service #查看所有已启动的服务 filebeat.service loaded active running filebeat #如果有这一行就证明设置成功
恭喜您看到这里就成功配置完ELK服务环境了.现在我们登录kibana看下吧!
浏览器打卡127.0.0.1:5601地址有密码的输入密码没有的就接着看
1登录成功后点击设置=>索引管理
可以看到logstash上传过来的文件
2点击 设置=>kibana=>索引模式
这里需要创建索引才能做到可视化处理哦!!!
创建完成后点击 首页=>discover
很好终于大功告成了,赶紧去程序里嵌入相关log配置吧!!!困了睡觉!!!
