更多關(guān)注：http://www.mknight.cn/
安裝部署
YUM
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
Installing from the RPM repository
Create a file called kibana.repo in the /etc/yum.repos.d/
directory for RedHat based distributions
[kibana-5.x]name=Kibana repository for 5.x
packagesbaseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
And your repository is ready for use. You can now install Kibana with one of the following commands:
sudo yum install kibana
RPM
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.0.2.rpm
wget https://artifacts.elastic.co/downloads/kibana/kibana-5.0.2-x86_64.rpm
wget https://artifacts.elastic.co/downloads/logstash/logstash-5.0.2.rpm
tar.gz
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.0.2.tar.gz
wget https://artifacts.elastic.co/downloads/kibana/kibana-5.0.2-linux-x86_64.tar.gz
wget https://artifacts.elastic.co/downloads/logstash/logstash-5.0.2.tar.gz
測(cè)試logstash
輸入一段文字，然后檢查輸出
cd logstash-5.1.0
bin/logstash -e 'input { stdin { } } output { stdout {} }'
hello world
2013-11-21T01:22:14.405+0000 0.0.0.0 hello world
easy_install supervisor
echo_supervisord_conf > /etc/supervisord.conf
[program:logstash]
environment=LS_HEAP_SIZE=5000m
directory=/opt/elk/logstash
command=/opt/elk/logstash/bin/logstash -f /opt/elk/logstash/conf.d -l /opt/elk/logstash/logs
配置文件
output {
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "logstash-nginx-access-%{+YYYY.MM.dd}"
flush_size => 5000
idle_flush_time => 10
sniffing => true
}
stdout {codec => rubydebug}
}
批量發(fā)送脱货。過(guò)去的版本中岛都，主要由本插件的flush_size 和idle_flush_time 兩個(gè)參數(shù)來(lái)控制發(fā)送數(shù)據(jù)的行為。以上面為例來(lái)說(shuō)：logstash會(huì)攢到5000條數(shù)據(jù)一次性發(fā)送出去振峻，但是如果10秒內(nèi)沒(méi)有攢夠5000條臼疫，logstash 還是會(huì)以當(dāng)前攢到的數(shù)量發(fā)送一次。
默認(rèn)情況下扣孟，flush_size 是500條烫堤，idle_flush_time 是1秒。
5.0開(kāi)始凤价，有了一個(gè)前提：flush_size 的大小不能超過(guò)logstash運(yùn)行時(shí)的命令行參數(shù)設(shè)置的batch_size,否則將以batch_size 為批量發(fā)送的大小鸽斟。
[devlog@test config]$ curl 127.0.0.1:9200/_cat/nodes?v
ip heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name
127.0.0.1 46 98 0 0.26 0.75 0.53 mdi * HsGQJQI
更多關(guān)注：http://www.mknight.cn/
---end
