安裝jdk
- 下載jdk8
- 設(shè)置環(huán)境變量
vim /etc/profile
export JAVA_HOME=/usr/local/jdk1.8.0_181
export JRE_HOME=${JAVA_HOME}/jre
export CLASSPATH=.:${JAVA_HOME}/lib/dt.JAVA_HOME/lib/tools.jar:${JRE_HOME}/lib
export PATH=${JAVA_HOME}/bin:${PATH}
source /etc/profile
系統(tǒng)設(shè)置
#設(shè)置hostname，打開文件筋蓖，將內(nèi)容改為 （不是必須的马僻，可跳過）
vi /etc/hostname
* elk-server
[http://www.reibang.com/p/8fd07c60f23f](http://www.reibang.com/p/8fd07c60f23f)
[https://www.cnblogs.com/silent2012/p/4682770.html](https://www.cnblogs.com/silent2012/p/4682770.html)
#關(guān)閉防火墻（如果因為其他原因不能關(guān)閉防火墻拂檩，也請不要禁止80端口）
systemctl stop firewalld.service
systemctl stop iptables.service
#禁止防火墻自動啟動：
systemctl disable firewalld.service
systemctl disable iptables.service
#打開添加下面四行內(nèi)容：
vi /etc/security/limits.conf
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096
#soft nproc: 可打開的文件描述符的最大數(shù)(軟限制)
#hard nproc： 可打開的文件描述符的最大數(shù)(硬限制)
#soft nofile：單個用戶可用的最大進程數(shù)量(軟限制)
#hard nofile：單個用戶可用的最大進程數(shù)量(硬限制)
#打開文件/etc/sysctl.conf睹逃，添加下面一行內(nèi)容
vi /etc/sysctl.conf
vm.max_map_count=655360
vm.overcommit_memory = 1
#max_map_count定義了一個進程擁有的最多內(nèi)存區(qū)域屡律，默認(rèn)為65536
# 加載sysctl配置肥缔，執(zhí)行命令
sysctl -p
# 重啟電腦撒轮；
安裝elasticsearch
#創(chuàng)建elasticsearch用戶，注意elasticsearch不能在root中啟動
groupadd elasticsearch
useradd elasticsearch -g elasticsearch
tar zxvf elasticsearch-6.5.3.tar.gz -C /usr/local/elk/
cd /usr/local/elk
chown -R elasticsearch:elasticsearch elasticsearch-6.5.3/
cd elasticsearch-6.5.3/
# nohup bin/elasticsearch -d >elkrunlog/elasticsearch.log 2>&1 &
#修改配置文件
vi config/elasticsearch.yml
cluster.name=es_cluster
node.name=node0
path.data=/tmp/elasticsearch/data
path.logs=/tmp/elasticsearch/logs
#當(dāng)前hostname或IP醇锚，我這里是centos2
network.host=centos2
network.port=9200
#切換用戶
su elasticsearch
#使用后臺進程的方式啟動
./bin/elasticsearch &
#有響應(yīng)內(nèi)容則啟動成功
curl 127.0.0.1:9200
#退出elasticsearch用戶
exit
安裝Logstash
tar zxvf logstash-6.5.3.tar.gz -C /usr/local/elk/
cd /usr/local/elk/logstash-6.5.3
#添加配置文件
vi config/log4j_to_es.conf
# For detail structure of this file
# Set: https://www.elastic.co/guide/en/logstash/current/configuration-file-structure.html
input {
# For detail config for log4j as input,
# See: https://www.elastic.co/guide/en/logstash/current/plugins-inputs-log4j.html
log4j {
mode => "server"
host => "centos2"
port => 4567
}
}
filter {
#Only matched data are send to output.
}
output {
# For detail config for elasticsearch as output,
# See: https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html
elasticsearch {
action => "index" #The operation on ES
hosts => "centos2:9200" #ElasticSearch host, can be array.
index => "applog" #The index to write data to.
}
}
--------------------default.conf
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.
input {
beats {
port => 8021
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
#index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
index => "testlog"
#user => "elastic"
#password => "changeme"
}
}
#啟動
bin/logstash -f config/log4j_to_es.conf &
netstat -tunlp
netstat -tunlp|grep 9600
安裝kibana
tar zxvf kibana-6.5.3-linux-x86_64.tar.gz -C /usr/local/elk/
cd /usr/local/elk/kibana-6.5.3-linux-x86_64/
#修改以下幾項
vi config/kibana.yml
server.port: 5601
server.host: “centos2”
elasticsearch.url: http://localhost:9200
kibana.index: “.kibana”
# 啟動kibana
./bin/kibana &
#用瀏覽器打開該地址：
localhost:5601
https://blog.csdn.net/wu2700222/article/details/85044117
https://blog.csdn.net/wu2700222/article/details/82792708
https://my.oschina.net/itblog/blog/547250
