Centos 7 安装 ELK 5.6.8 及基础的配置

时间:2021-05-25 21:05:11

下载

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.6.8.rpm

wget https://artifacts.elastic.co/downloads/logstash/logstash-5.6.8.rpm

wget https://artifacts.elastic.co/downloads/kibana/kibana-5.6.8-x86_64.rpm

wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.6.8-x86_64.rpm

安装

yum install ./*.rpm

再安装一个redis作为filebeat与logstash间的缓冲,这里是从epel直接yum安装的,版本是:3.2.10

yum install redis

另外还需要安装好jdk8,这里的路径是:/mydata/jdk1.8.0_111

基础配置

(下文中蓝色文字为修改的内容,绿色为注释,其他是命令)

redis

mkdir -p /mydata/redis
chown -R redis:redis /mydata/redis
vim /etc/redis.conf
bind 0.0.0.0
dir /mydata/redis
systemctl start redis
systemctl enable redis

filebeat

vim /etc/filebeat/filebeat.yml
先把该文件中预设的配置全部注释掉,然后加上下面的
filebeat.prospectors:
- input_type: log
paths:
- /root/test.log  从一个测试文件中获取数据
output.redis:  输出到redis队列
enabled: true
hosts: ["127.0.0.1:6379"]
db:
key: "elk_test_list"
systemctl start filebeat
systemctl enable filebeat

logstash

logstash在安装了rpm包后,还需再安装一下:

vim /etc/logstash/startup.options
JAVACMD=${JAVA_HOME}/bin/java
cd /usr/share/logstash/bin
./system-install

然后再进行基础配置:

mkdir -p /mydata/logstash
chown -R logstash:logstash /mydata/logstash
vim /etc/logstash/logstash.yml
path.data: /mydata/logstash
cd /etc/logstash/conf.d
vim test.conf
input {
redis {  从redis队列读数据,要与上面filebeat的配置一致
host => "127.0.0.1"
port => 6379
db => 1
data_type => "list"
key => "elk_test_list"
threads => 3
}
}
filter {  解析内容,这里用一个IP和一个字符串作测试
grok {
match => { "message" => '^%{IP:myip} %{DATA:myname}$' }
}
}
output {
elasticsearch {  输出到elasticsearch
hosts => ["127.0.0.1:9200"]
index => "test-log-%{+YYYY.MM.dd}"
}
}
systemctl start logstash
systemctl enable logstash

elasticsearch

vim /etc/sysconfig/elasticsearch
JAVA_HOME=/mydata/jdk1.8.0_111
vim /etc/elasticsearch/elasticsearch.yml
path.data: /mydata/elasticsearch
network.host: 0.0.0.0
mkdir -p /mydata/elasticsearch
chown -R elasticsearch:elasticsearch /mydata/elasticsearch
systemctl start elasticsearch
systemctl enable elasticsearch

kibana

vim /etc/kibana/kibana.yml
server.host: "0.0.0.0"
systemctl start kibana
systemctl enable kibana

进行测试

touch /root/test.log
echo '127.0.0.1 张三' >> /root/test.log
echo '127.0.0.2 李四' >> /root/test.log

浏览器访问kibana(http://[your url]:5601),创建一个索引模板(test-log-*),进入Discover就可以看到:

Centos 7 安装 ELK 5.6.8 及基础的配置

over