ELK搭建及配置
1、在两台机器上分别新添加磁盘，格式化，挂载，专门用于ELK
mkfs.xfs /dev/sdb
mkdir /data1
mount /dev/sdb /data1
blkid /dev/sdb #查询磁盘的uuid，使用uuid挂载,以防止服务器重启时磁盘名称变化
vim /etc/fstab
dd86fef0-3873-4767-bc9a-dc673dcecb5a /data1 xfs defaults 0 0
2、下载安装包
https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.4.0.rpm
http://download.oracle.com/otn/java/jdk/8u121-b13/e9e7ea248e2c4826b92b3f075a80e441/jdk-8u121-linux-x64.rpm?AuthParam=1527560278_371b883a1f5d9c8b5944edcb464b5780
安装
yum install jdk-8u121-linux-x64.rpm
yum install elasticsearch-5.4.0.rpm
3、设置主机名、本地hosts文件
hostnamectl set-hostname elk01.example.com
hostnamectl set-hostname elk02.example.com
cat /etc/hosts
10.1.2.184 elk01.example.com
10.1.2.186 elk02.example.com
4、关闭防火墙和selinux、打开的文件数
systemctl disable firewalld
systemctl disable NetworkManager
sed -i '/SELINUX/s/enforcing/disabled/' /etc/selinux/config
echo " soft nofile 65536" >> /etc/security/limits.conf
echo " hard nofile 65536" >> /etc/security/limits.conf
5、设置yun源，安装必要包
yum install -y net-tools vim lrzsz tree screen lsof tcpdump wget ntpdate
6、配置elasticseach配置文件
grep "^[a-z]" /etc/elasticsearch/elasticsearch.yml
cluster.name: elk-cluster
node.name: elk-node-1
path.data: /data1/elkdata
path.logs: /data1/logs
bootstrap.memory_lock: true
network.host: 10.1.2.184
http.port: 9200
discovery.zen.ping.unicast.hosts: ["10.1.2.184", "10.1.2.186"]
7、创建目录、修改权限，启动
mkdir /data1/{elkdata,logs}
chown -R elasticsearch.elasticsearch /data1/{elkdata,logs}
8、修改启动脚本的内存参数，否则会启动不了
vim /usr/lib/systemd/system/elasticsearch.service
取消注释 LimitMEMLOCK=infinity
vim /etc/elasticsearch/jvm.options #也可以不改，如果能启动
-Xms3g #这个内存使用建议不超过物理内存的50%，最高不超过32G
-Xmx3g
PS:出错提示
Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled; vendor preset: disabled)
检查jdk版本，及系统上原来是否安装了其他版本的jdk
9、安装elasticsearch插件之head

yum install git-core
git clone git://github.com/mobz/elasticsearch-head.git
cd elasticsearch-head
yum install -y npm
npm install grunt -save
ll node_modules/grunt 确认生成文件
npm install
npm run start & 启动
10.1.2.189:9100访问
安装完测试集群状态
curl http://10.1.2.189:9200/_cluster/health?protty=true
"status" : "green",这一栏是gree是正常的
10、修改elasticsearch配置文件后才能连接
http.cors.enabled: true #注意要空格
http.cors.allow-origin: "*"