Centos 6.5 部署 ELK
JDK8# cd /usr/local/src
# tar zxvf jdk-8u161-linux-x64.tar.gz
# mv jdk1.8.0_161 /usr/local
# vi /etc/profile
JAVA_HOME=/usr/local/jdk1.8.0_161
JAVA_BIN=/usr/local/jdk1.8.0_161/bin
PATH=$PATH:$JAVA_BIN
CLASSPATH=$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
export JAVA_HOME JAVA_BIN PATH CLASSPATH
# java -version
java version "1.8.0_161"
Java(TM) SE Runtime Environment (build 1.8.0_161-b12)
Java HotSpot(TM) 64-Bit Server VM (build 25.161-b12, mixed mode)ElasticSearch
# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
# vim /etc/yum.repos.d/elasticsearch.repo
name=Elasticsearch repository for 6.x packages
baseurl=https://artifacts.elastic.co/packages/6.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
# yum install -y elasticsearch
# vim /etc/elasticsearch/elasticsearch.yml
cluster.name: my-application
node.name: king01
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
bootstrap.memory_lock: true
bootstrap.system_call_filter: false
network.host: 192.168.1.201
http.port: 9200
discovery.zen.ping.unicast.hosts: ["king01"]
# vi /etc/security/limits.conf
* soft nofile 65536
* hard nofile 65536
* soft nproc 4096
* hard nproc 4096
* soft memlock unlimited
* hard memlock unlimited
# vim /etc/security/limits.d/90-nproc.conf
* soft nproc 4096
root soft nproc unlimited
# /etc/init.d/elasticsearch start
# /etc/init.d/elasticsearch status
elasticsearch (pid18338) is running...
# cat /var/log/elasticsearch/my-application.log
# curl http://192.168.1.201:9200/
{
"name" : "king01",
"cluster_name" : "elk-cluster",
"cluster_uuid" : "oGuBJsi3SZyYnCT4PvuNgA",
"version" : {
"number" : "5.6.8",
"build_hash" : "688ecce",
"build_date" : "2018-02-16×××6:46:30.010Z",
"build_snapshot" : false,
"lucene_version" : "6.6.1"
},
"tagline" : "You Know, for Search"
}Logstash
# yum install -y logstash
# ln -s /usr/share/logstash/bin/logstash /bin/
# mkdir -p /usr/share/logstash/config/
# chown -R logstash:logstash /usr/share/logstash/config/
# ln -s /etc/logstash/* /usr/share/logstash/config
# vim /etc/logstash/conf.d/elk.conf
input {
syslog {
port => "514"
}
}
output {
elasticsearch {
hosts => ["192.168.1.201:9200"]
index => "syslog-%{+YYYY.MM.dd}"
}
}
# logstash -f /etc/logstash/conf.d/elk.conf&
# cat /var/log/logstash/logstash-plain.log
# netstat -tunlp | grep 514
tcp 0 0 :::514 :::* LISTEN 18713/java
udp 0 0 :::514 :::* 18713/javaKibana
# yum install -y kibana
# vim /etc/kibana/kibana.yml
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.url: "http://192.168.1.201:9200"
# /etc/init.d/kibana start
kibana started
# /etc/init.d/kibana status
kibana is running
# netstat -tunlp | grep 5601客户端
# vi /etc/rsyslog.conf
*.* @192.168.1.201:514
# vi /etc/bashrc
export PROMPT_COMMAND='{ msg=$(history 1 | { read x y; echo $y; });logger "":$(who am i):[`pwd`]"$msg"; }'
# service rsyslog restart
页:
[1]