elk部署文档离线

部署elasticsearch安装rpm-ivhelasticsearch-6.2.3.rpm查找安装路径rpm-qlelasticsearch一般是装在/usr/share/elasticsearch/下。设置data的目录创建/data/es-data目录，用于elasticsearch数据的存放mkdir-p/data/es-data修改该目录的拥有者为elasticsearchchown-Relasticsearch:elasticsearch/data/es-data设置log的目录创建/data/es-log目录，用于elasticsearch日志的存放mkdir-p/log/es-log修改该目录的拥有者为elasticsearchchown-Relasticsearch:elasticsearch/log/es-log修改配置文件elasticsearch.ymlvim/etc/elasticsearch/elasticsearch.yml根据下面的内容进行修改，wq保存。电#设置data存放的路径为/data/es-datapath.data:/data/es-data#设置10gs日志的路径为/log/es-logpath.logs:/log/es-log

#设置内存不使用交换分区bootstrap.memory_lock:false#配置了bootstrap.memory_lock为true时反而会引发9200不会被监听，原因不明#设置允许所有ip可以连接该elasticsearchnetwork.host:#开启监听的端口为9200http.port:9200#增加新的参数，为了让elasticsearch-head插件可以访问es（5.x版本，如果没有可以自己手动加）http.cors.enabled:truehttp.cors.allow-origin:〃*〃电3.5启动elasticsearch#启动systemctlstartelasticsearch#查看状态systemctlstatuselasticsearch#设置开机启动systemctlenableelasticsearch开启9200端口firewall-cmd--add-port=9200/tcp--permanentfirewall-cmd——reload测试安装是否成功#检查9200是否有监听netstat-antp|grep9200[poot^localhostnetstat-antp|grep9200ItcpGLISTEN11782/java

ItcpGcurlhttp:〃:9200有下面类似的内容才说明elasticsearch正常启动。[root@lc?calho5tcurl 9200{"namab,:“fQF工"clu5ter_na[DE";11elasticsearch","cluster_uuid":''qWSkaVxUQx69GQ]wDrifjA"T"version":{''number":"6.1.0P\"bjild-hash":''c0clba0"?"build-date":"20171212T12;32:54.550Z","bui]d_5napshot":false,,,liJccne_ver,Eicn'':n7.1.0""mlnimum_wire_'Ccnnpatibllity_ver51or";115.6.0","minimum_index_CDmpa-tnbi1ity_uersion":"5.0.0''Ji"taglineq:"YouKnow,forSearch''}[roo■七@1口工与Ihos七〜1#部署logstash#安装rpm-ivhlogstash-6.2.3rpm设置data的目录#创建/data/ls-data目录，用于logstash数据的存放mkdir-p/data/ls-data#修改该目录的拥有者为logstashchown-Rlogstash:logstash/data/ls-data设置log的目录#创建/data/ls-log目录，用于logstash日志的存放mkdir-p/log/ls-log#修改该目录的拥有者为logstashchown-Rlogstash:logstash/log/ls-log修改配置文件logstash.ymlvim/etc/logstash/logstash.yml

根据下面的内容进行修改，wq保存。设置数据的存储路径为/data/ls-datapath.data:/data/ls-data设置管道配置文件路径为/etc/logstash/conf.dpath.config:/etc/logstash/conf.d设置日志文件的存储路径为/log/ls-logpath.logs:/log/ls-log电启动logstash启动systemctlstartlogstash查看状态systemctlstatuslogstash设置开机启动systemctlenablelogstash测试安装是否成功查看下logstash的安装目录rpm-qllogstash创建一个软连接，每次执行命令的时候不用在写安装路径（yum安装是在/usr/share下）ln-s/usr/share/logstash/bin/logstash/bin/执行logstash的命令logstash-e,input{stdin{}}output{stdout{}}'等待片刻后出现“Thestdinpluginisnowwaitingforinput:",输入''abc"回车，有返回的输出。[roDtjfilocalhost川]耶logstash-e1input{stdin{}}output{stdout{1WARNING:Couldnotfindlo-gst-ash.yntlutiichistypicallylocatedin$LS_HQME/cQrifigor/etc/logst.ash.Voucan5pecifythepathusing--poth.settin>e5.ContinuingusingthedefaultsCouldnotfindlog4j2configurationaitpath/usr/share/logstash/comfig/l!Dg4;perties■Usingdefoultconfigwhichlogs-errorstotheconsoleThestdiftpluginis.riowMaltingfari力put:abc20-L7-12-25T06:52]19a745Zlocallhost11ocaIdorwainabc

ctrl+c退出。如果标准输出还有elasticsearch中都需要保留，看下面#6是试验elk的ip/usr/share/logstash/bin/logstash-e'input{stdin{}}output{elasticsearch{hosts=>["192,168.12.16:9200"]}stdout{codec=>rubydebug}}'等待片刻后出现“Thestdinpluginisnowwaitingforinput:",输入''test”回车，返回下面标准的输出。[rootjfflloc-ailhost&]#/usr/share/1[rootjfflloc-ailhost&]#/usr/share/1ogstash/bir/logstaslh-e1input{stdin{}}output{elasticsearch{hosts=>[-,192- -1216[920BHJ}stdoLit{codec=>rubydebug}}*^lARNING!：Couldnotfind1ogstash.ynluthiclhistypi匚HllylocatedintLS_HOME/comfigor/etc/lDgstash.Youcanspecifythepatlnusing--path.settings.ContinuingusingthedefaultsCouldnotfindlog4jiZconifig□rationatpath/usr/share/1ogstash/canfig/1Dg^j2«properties.UsingdefaultconfigwhichThestdinplugintestlogserrors-totheconsoleisnoL/vjaitingforinput!："host11^message1""gversion"=>""host11^message1""gversion"=>2017-12-25T07:02-27.79BZ?部署kibana#安装rpm-ivhkibana-6.1.0-x86_64.rpm修改kibana.yml#搜索rpm包rpm-qlkibana默认是装在/usr/share/kibana/下。#修改kibana的配置文件vim/etc/kibana/kibana.yml#修改kibana.xml下面的内容，wq保存。

电#kibana页面映射在5601端口server.port:5601#允许所有ip访问5601端口server.host:""#elasticsearch所在的ip及监听的地址elasticsearch.url:"HYPERLINK"http://