Os 7 ELK安装部署

ELK官网： https://www.elastic.co/cn/what-is/elk-stack

ELK是什么： “ELK”是三个开源项目的首字母缩写，这三个项目分别是：Elasticsearch、Logstash 和 Kibana。Elasticsearch 是一个搜索和分析引擎。Logstash 是服务器端数据处理管道，能够同时从多个来源采集数据，转换数据，然后将数据发送到诸如 Elasticsearch 等“存储库”中。Kibana 则可以让用户在 Elasticsearch 中使用图形和图表对数据进行可视化。

实验环境：两台虚拟机（建议最小化安装）【最小2核2G】 239：elasticsearch+ logstash 240：kibana

查看ip： iifup ens33 ip add

关闭防火墙、sulinux:

[root@localhost ~]# systemctl stop firewalld [root@localhost ~]# setenforce 0

同步时间:

[root@localhost ~]# yum -y install ntp [root@localhost ~]# ntpdate pool.ntp.org

1、安装elasticsearch（先安装java环境） 解压ELK压缩包:

[root@localhost ~]# yum -y install unzip [root@localhost ~]# unzip ELK.zip

安装java环境

[root@localhost ~]# cd ELK [root@localhost ELK]# rpm -ivh jdk-8u131-linux-x64_.rpm

安装配置elasticsearch：

[root@localhost ELK]# yum -y install elasticsearch-6.6.2.rpm [root@localhost ELK]# systemctl daemon-reload [root@localhost ELK]# systemctl enable elasticsearch.service [root@localhost ELK]# yum -y install vim [root@localhost ELK]# vim /etc/elasticsearch/elasticsearch.yml [root@localhost ELK]# cat /etc/elasticsearch/elasticsearch.yml |grep -v "^#" cluster.name: yl node.name: node-1 path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch network.host: 192.168.136.239 http.port: 9200 [root@localhost ELK]# systemctl start elasticsearch

检测（两种方式）：

[root@localhost ELK]# yum -y install net-tools [root@localhost ELK]# netstat -anpt |grep java [root@localhost ELK]# tailf /var/log/elasticsearch/yl.log

2、安装配置logstash（测试检测messages+secure）

[root@localhost ELK]# yum -y install logstash-6.6.0.rpm [root@localhost ELK]# cd /etc/logstash/conf.d/ [root@localhost conf.d]# vim messages.conf input { file { path => "/var/log/messages" type => "messages-log" start_position => "beginning" } } output { elasticsearch { hosts => "192.168.136.239" index => "messages_log-%{+YYYY.MM.dd}" } } [root@localhost conf.d]# vim secure.conf input { file { path => "/var/log/secure" type => "secure-log" start_position => "beginning" } } output { elasticsearch { hosts => "192.168.136.239:9200" index => "secure_log-%{+YYYY.MM.dd}" } } [root@localhost conf.d]# cd /etc/logstash/ [root@localhost logstash]# vim pipelines.yml ------------------------------------------------------- - pipeline.id: messages path.config: "/etc/logstash/conf.d/messages.conf" - pipeline.id: secure path.config: "/etc/logstash/conf.d/secure.conf" ------------------------------------------------------- [root@localhost ~]# chmod -R 777 /var/log/ [root@localhost ~]# systemctl enable logstash [root@localhost ~]# systemctl start logstash

测试:

[root@localhost ~]# tailf /var/log/logstash/logstash-plain.log --------------出现以下就正常--------------------------------------------------------- [2020-07-01T20:06:29,449][INFO ][logstash.outputs.elasticsearch] Installing elas ticsearch template to _template/logstash ----------------------------------------------------------------------------------

3、安装kibana：

[root@localhost ~]# cd ELK [root@localhost ELK]# scp kibana-6.6.2-x86_64.rpm root@192.168.136.240:/root/

到另一台虚拟服务器

[root@localhost ~]# yum -y install kibana-6.6.2-x86_64.rpm [root@localhost ~]# yum -y install vim [root@localhost ~]# vim /etc/kibana/kibana.yml [root@localhost ~]# cat /etc/kibana/kibana.yml | grep -v "^#" | sed '/^$/d' server.port: 5601 server.host: "192.168.136.240" elasticsearch.hosts: ["http://192.168.136.239:9200"] [root@localhost ~]# systemctl enable kibana [root@localhost ~]# systemctl start kibana

测试：

[root@localhost ~]# yum -y install net-tools [root@localhost ~]# netstat -anpt |grep :5601 tcp 0 0 192.168.136.240:5601 0.0.0.0:* LISTEN 2436/node

登录web端: