EFK安装指南

1.官网下载安装包,官网地址:

https://www.elastic.co/downloads

本次使用版本为

elasticsearch-6.1.1.tar.gz

kibana-6.1.1-linux-x86_64.tar.gz

2.环境准备:

Java环境：JDK1.8（若未安装，需先安装）

3.安装elasticsearch-6.1.1.tar.gz

a.tar -zxvf elasticsearch-6.0.1.tar.gz -C /app/webapp

b. vi /app/webapp/elasticsearch-6.1.1/config/elasticsearch.yml

配置文件内容如下:

#cluster.name: cluster-es

# 集群名称

#node.name: es-node1

# 节点名称，其余两台为es-node2、es-node3

path.data: /usr/local/elasticsearch/data

# 数据目录

path.logs: /usr/local/elasticsearch/logs

# 日志目录

network.host: 172.16.64.137

# 本机IP

http.port: 9200

# 本机http端口

discovery.zen.minimum_master_nodes: 1

# 指定集群中的节点中有几个有master资格的节点

#discovery.zen.ping.unicast.hosts: ["172.16.64.137", "172.16.64.138", "172.16.64.147"]

# 指定集群中其他节点的IP

node.master: true

# 是否为master

node.data: false

# 是否为数据节点

#discovery.zen.fd.ping_timeout: 180s

# 设置集群中自动发现其它节点时ping连接超时时间

#discovery.zen.fd.ping_retries: 10

# 集群中节点之间ping的次数

#discovery.zen.fd.ping_interval: 30s

# 集群中节点之间ping的时间间隔

c.配置内存

vim /app/webapp/elasticsearch-6.1.1/config/jvm.options

-Xms2g

-Xmx2g

注意eqidlasticsearch配置不能少于2G哦,否则回报内存不足的错

d.引用jdk版本

vim bin/elasticsearch

# 添加以下代码

export JAVA_HOME=/usr/local/jdk1.8.0_73

export PATH=$JAVA_HOME/bin:$PATH

启动报错解决:

ERROR: bootstrap checks failed
max file descriptors [65535] for elasticsearch process likely too low, increase to at least [65536]
memory locking requested for elasticsearch process but memory is not locked
max number of threads [1024] for user [jason] likely too low, increase to at least [2048]
max virtual memory areas vm.max_map_count [65530] likely too low, increase to at least [262144]

system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

解决方法:

> vim /etc/security/limits.conf

...

* hard nofile 65536  # 针对 max file descriptors

* soft nofile 65536 

* soft nproc 4096    # 针对 max number of threads

* hard nproc 4096

vi /etc/security/limits.d/90-nproc.conf

修改如下内容：
* soft nproc 1024
#修改为
* soft nproc 2048

> vim /etc/sysctl.conf
...
vm.max_map_count=262144          # 针对 max virtual memory areas
 
> vim /etc/elasticsearch/elasticsearch.yml
 
...
bootstrap.system_call_filter: false   # 针对 system call filters failed to install, 参见 https://www.elastic.co/guide/en/elasticsearch/reference/current/system-call-filter-check.html

4.

并执行命令：

sysctl -p

后台启动elasticsearch

[ela@test1 ~]$ nohup /app/efk/elasticsearch-6.1.1/bin/elasticsearch &

正常情况下，启动后，网页访问172.16.16.206:9200会有以下内容显示

5.安装kibana-6.1.1

解压:tar -zxvf kibana-6.1.1-linux-x86_64.tar.gz

修改配置文件

cd /app/webapp/kibana-6.1.1/config

vi kibana.yml

# Kibana is served by a back end server. This setting specifies the port to use.
server.port: 5601
# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
server.host: "172.16.69.70"
# Enables you to specify a path to mount Kibana at if you are running behind a proxy. This only affects
# the URLs generated by Kibana, your proxy is expected to remove the basePath value before forwarding requests
# to Kibana. This setting cannot end in a slash.
#server.basePath: ""
# The maximum payload size in bytes for incoming server requests.
#server.maxPayloadBytes: 1048576
# The Kibana server's name.  This is used for display purposes.
#server.name: "your-hostname"
# The URL of the Elasticsearch instance to use for all your queries.
elasticsearch.url: "http://172.16.69.70:9200"

把标红的注释取消,并把默认的localhost改为自己的主机名

启动: cd kibana-6.1.1/bin

nohup  /app/webapp/kibana/bin/kibana &