elk部署文档(离线)

部署elasticsearch#安装rpm—ivhelasticsearch—6.2.3.rpm#查找安装路径rpm-qlelasticsearch一般是装在/usr/share/elasticsearch/下。设置data的#创建/data/es-data目录，用于elasticsearch数据的存放mkdir-p/data/es-data#修改该目录的拥有者为elasticsearchchown-Relasticsearch:elasticsearch/data/es-data设・log的#创建/data/es-log目录，用于elasticsearch日志的存放mkdir-p/log/es-log#修改该目录的拥有者为elasticsearchchown-Relasticsearch:elasticsearch/log/es-log修改配置文件elasticsearch.ymlvim/etc/elasticsearch/elasticsearch.yml根据下面的内容进行修改，wq保存。#设置data存放的路径为/data/es-datapath.data:/data/es-data#设置logs日志的路径为/log/es-logpath.logs:/log/es-log

#设置内存不使用交换分区bootstrap.memory_lock:false#配置了bootstrap.memory_lock为true时反而会引发9200不会被监听，原因不明#设置允许所有ip可以连接该elasticsearchnetwork.host:#开启监听的端口为9200http.port:9200#增加新的参数，为了让elasticsearch-head插件可以访问es（5.x版本，如果没有可以自己手动加）http.cors.enabled:truehttp.cors.allow-origin:“*〃3.5启动elasticsearch#启动systemctlstartelasticsearch#查看状态systemctlstatuselasticsearch#设置开机启动systemctlenableelasticsearch3.6开启9200端口firewall-cmd--add-port二9200/tcp--permanentfirewall-cmd——reload3.7测试安装是否成功#检查9200是否有监听netstat-antp|grep92001[poot^1ocaIhost«]#netstat-antpItcpG00Froctftlocalhostgrep9200!:i*LISTEN117B2/java

curl:9200有下面类似的内容才说明elasticsearch正常启动。[root^localhostcurlhttp://127.0.&.l;9200<"namab,:'--fQFIxV'^"clu5ter_na[DE":11elasticsearch","cluster_uuid":''qWSkaVxUQx69GQ]wDrIfjA"T"version":{''number":"G.1.0P\"bud：lcl_h¥h“：■'caclbaa1,"build_d日七寸:"20171212T12:32:54.550Z","bui]d_5napshot":false,''liJccne_verEicn'':n7.1.0""mlnimum_wire_ccnnpatibllity_versiDn":115.6.0","minimum_index_CDmpa'tnbi1ity_uersion":"5.0.0''Ji"taglineq:"YouKno叭fairSearch''}[roo■七七…]#部署logstash#安装rpm-ivhlogstash-6.2.3rpm设置data的目录#创建/data/ls-data目录，用于logstash数据的存放mkdir-p/data/ls-data#修改该目录的拥有者为logstashchown-Rlogstash:logstash/data/ls-data设置log的目录#创建/data/ls-log目录，用于logstash日志的存放mkdir-p/log/ls-log#修改该目录的拥有者为logstashchown-Rlogstash:logstash/log/ls-log修改配置文件logstash.ymlvim/etc/logstash/logstash.yml

根据下面的内容进行修改，wq保存。#设置数据的存储路径为/data/ls-datapath.data:/data/ls-data#设置管道配置文件路径为/etc/logstash/conf.dpath.config:/etc/logstash/conf.d#设置日志文件的存储路径为/log/ls-logpath.logs:/log/ls-log4.5启动logstash#启动systemctlstartlogstash#查看状态systemctlstatuslogstash#设置开机启动systemctlenablelogstash4.6测试安装是否成功#查看下logstash的安装目录rpm-qllogstash#创建一个软连接，每次执行命令的时候不用在写安装路径（yum安装是在/usr/share下）ln-s/usr/share/logstash/bin/logstash/bin/#执行logstash的命令logstash-e'input{stdin{}}output{stdout{}}'等待片刻后出现“Thestdinpluginisnowwaitingforinput:”，输入“abc”回车，有返回的输出。[roDtjfilocalhost«]#logstash-e1input{stdin{}}output{stdout{}}"WARNING:Couldnotfindlo-gs七吕£乩丫・1utiichis七ypicallylocated才門$LS_HQME/cQrifigor/etc/logs七启呂!！.Vouc&n5pecifythepathusing--path・5巴上七匚口占5・Co-ntinuineusingthedefaultsCouldnotfindj2configurationaitpmth/usr/share/logstash/comfig/l!Dg4;j2・properties・UsingdefoultconfigwhichlogserrorstothEconsoleThestdiftpluginisriowMaltingfarinpui::abc2&L7-12-25T06:52]19a745Zlocallhost11ocaldorwainabc

ctrl+c退出。如果标准输出还有elasticsearch中都需要保留，看下面#6是试验elk的ip/usr/share/logstash/bin/logstash-e'input{stdin{}}output{elasticsearch{hosts=>["6:9200"]}stdout{codec=>rubydebug}}'等待片刻后出现“Thestdinpluginisnowwaitingforinput:”，输入“test”回车，返回下面标准的输出。[rootjffllo匚日]|.11口5七血]#/usr/share/1ogstash/bin/logst-ash-e1input{5七din{}}output{elas七匚匚{hosts=>[-,192--1216[920BHJ}stdoLit{codec=>rubydebug}}"^lARNING::Couldnotfind1ogstash.yntlwhichistypicallylocatedintLS_HOME/comfigor/etc/lDgstash.Youcanspecifythepathiusing--path.settings・ContinuingusingthedefaultsCouldnotfindlog4ji2conifigur■曰tiQinatpath/usr/share/1ogstash/canfig/1Dg^j2«properties・Usingdefanitconfig讨hi匚hlogserrors七口theconsoleThestdinpluginisnewwaitingforinput!：test{"host"=>"lo-calhast.localdonain111'*message11=>J,+est","^tlmestaimp*4=>2017-12-25T07:02-27.79BZ?'■g¥ersionR=>"I"部署kibana#安装rpm—ivhkibana—6.1.0—x86_64.rpm修改kibana.yml#搜索rpm包rpm—qlkibana默认是装在/usr/share/kib