在搭建ELK之前,首先要安装Redis和JDK,安装Redis请参考上一篇文章。
首先安装JDK及配置环境变量
1.解压安装包到/usr/local/java目录下[[email protected]_0_9_centos ~]# tar xvf /ryt/soft/jdk-11.0.3_linux-x64_bin.tar.gz -C /usr/local/java/
2.配置环境变量(在尾部追加内容如下)[[email protected]_0_9_centos ~]# vim /etc/profile export JAVA_HOME=/usr/local/java/jdk-11.0.3export JRE_HOME=${JAVA_HOME}/jreexport CLASSPATH=.:${JAVA_HOME}/lib:${JRE_HOME}/libexport PATH=${JAVA_HOME}/bin:$PATH
3.重启配置文件,使其立即生效
[[email protected]_0_9_centos ~]# source /etc/profile
ELK搭建详细过程
安装程序:filebeat,elasticsearch,logstash,kibana
1.安装Elasticsearch
1)解压安装包到路径/usr/local/elk下 [[email protected]_0_9_centos ~]# tar -zxvf /ryt/soft/elk/elasticsearch-7.2.0-linux-x86_64.tar.gz -C /usr/local/elk/
2.创建用户并赋权
[[email protected]_0_9_centos elk]# useradd es_user
[[email protected]_0_9_centos elk]# groupadd esgroup
[[email protected]_0_9_centos elk]# chown -R es_user:esgroup /usr/local/elk/elasticsearch-7.2.0/
3)修改ES配置文件:
[[email protected]_0_9_centos elk]# vim /usr/local/elk/elasticsearch-7.2.0/config/elasticsearch.yml
#这里指定的是集群名称,需要修改为对应的,开启了自发现功能后,ES会按照此集群名称进行集群发现
cluster.name: elk-applicationnode.name: node-1
#目录需要手动创建
path.data: /data/elasticsearch/data
path.logs: /data/elasticsearch/logs
#ES监听地址
network.host: 0.0.0.0 #允许外网个访问
http.port: 9200
discovery.seed_hosts: ["172.17.0.9"] #内网ip
cluster.initial_master_nodes: ["node-1"]
4)修改系统参数
#添加参数、
m.max_map_count=655360
注:ES启动的时候回占用特别大的资源所以需要修改下系统参数,若不修改资源启动会异常退出
[[email protected]_0_9_centos elk]# vim /etc/sysctl.conf
5)重新载入配置[[email protected]_0_9_centos elk]# sysctl -p /etc/sysctl.conf 6)修改资源参数
[[email protected]_0_9_centos elk]# vim /etc/security/limits.conf 修改内容* soft nofile 65536* hard nofile 131072* soft nproc 65536* hard nproc 131072
7)设置用户资源参数
[[email protected]_0_9_centos elk]# vim /etc/security/limits.d/20-nproc.conf
#添加
es_user soft nproc 65536
8)创建数据和日志目录并修改目录权限[[email protected]_0_9_centos elk]# mkdir -pv /usr/local/elk/{data,logs}[[email protected]_0_9_centos elk]# chown -R es_user:esgroup /data/elasticsearch/
[[email protected]_0_9_centos elk]# chown -R es_user:esgroup /usr/local/elk/elasticsearch-7.2.0
9)切换用户并后台启动ES
[[email protected]_0_9_centos elk]# su es_user[[email protected]_0_9_centos elk]$ /usr/local/elk/elasticsearch-7.2.0/bin/elasticsearch &
2.安装logstash
1.解压安装包并移到/usr/local/elk目录下[[email protected]_0_9_centos filebeat-7.2.0]# tar -zvxf /ryt/soft/elk/logstash-7.2.0.tar.gz -C /usr/local/elk/2.创建软连接[[email protected]_0_9_centos elk]# ln -s /usr/local/elk/logstash-7.2.0 /usr/local/elk/logstash 注:Java HotSpot(TM) 64-Bit Server VM warning: INFO: os::commit_memory(0x00000000c5330000, 986513408, 0) failed; error=‘Not enough space‘ (errno=12)[[email protected]_0_9_centos elk]# vim ./elasticsearch-7.2.0/config/jvm.options
3.安装filebeat
1)解压安装包到路径/usr/local/elk下 [[email protected]_0_9_centos elk]# tar xvf filebeat-7.2.0-linux-x86_64.tar.gz -C /usr/local/elk/ 2)修改配置文件,使filebeat获取的日志进入redis: 注:此处演示获取spring cloud框架中eureka日志,其他程序日志都可相同方法获取
[[email protected]_0_9_centos filebeat-7.2.0]#
[[email protected]_0_9_centos filebeat-7.2.0]# pwd
/usr/local/elk/filebeat-7.2.0
[[email protected]_0_9_centos filebeat-7.2.0]# vim ./filebeat.yml
#修改的内容有一家几个字段
enabled:true
paths:程序日志路径
#output只能有一个 output.logstash: hosts:["服务器IP:5044"]
#output.redis:
# hosts:127.0.0.1 #redis所在服务器IP
# port:6379 #redis端口
# key:"filebeat-log" #redis中的key
3)设置开机启动修改配置rc.local,后面追加 /usr/local/elk/filebeat-7.2.0/filebeat > /tmp/filebeat.log 2>&1
[[email protected]_0_9_centos filebeat-7.2.0]# vim /etc/rc.local
4)后台启动filebeat[[email protected]_0_9_centos filebeat-7.2.0]# /usr/local/elk/filebeat-7.2.0/filebeat &
5)查看启动,filebeat有没有监听端口,主要看日志和进程
[[email protected]_0_9_centos filebeat-7.2.0]# ps -ef | grep filebeat
[[email protected]_0_9_centos filebeat-7.2.0]# tailf logs/filebeat
4.启动logstash
测试一下logstash不指定配置文件启动 [[email protected]_0_9_centos config]# /usr/local/elk/logstash/bin/logstash -e ‘input { stdin { } } output { stdout {} }‘注:手动输入 hello world,它也会输出 hello world
5.安装kibana
1)解压安装包到路径/usr/local/elk下 [[email protected]_0_9_centos ~]# tar -zxvf /ryt/soft/elk/kibana-7.2.0-linux-x86_64.tar.gz -C /usr/local/elk/ 2)编辑kibana配置文件[[email protected]_0_9_centos ~]# vim /usr/local/elk/kibana-7.2.0/config/kibana.yml
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://49.234.206.139:9200"]
3)后台启动kibana[[email protected]_0_9_centos ~]# /usr/local/elk/kibana-7.2.0/bin/kibana --allow-root &
原文地址:https://www.cnblogs.com/renyutao/p/11253587.html