elk7.6.2_01_单节点版部署
环境：centos7.7
准备工作： jdk、elk安装包
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.6.2-linux-x86_64.tar.gz
1.修改内核参数：
[root@es02 config]# echo "vm.max_map_count=262144" >> /etc/sysctl.conf
[root@es02 config]# sysctl -p
vm.max_map_count = 262144
[root@master-node ~]# vim /etc/security/limits.conf
* soft nproc 65536
* hard nproc 65536
* soft nofile 65536
* hard nofile 65536
2.jdk
[root@es02 ~]# yum remove *jdk* *java*
[root@es02 ~]# tar -C /usr/ -zxvf openjdk-11+28_linux-x64_bin.tar.gz
[root@es02 ~]# vim /etc/profile
JAVA_HOME=/usr/jdk-11
PATH=$JAVA_HOME/bin:$PATH
CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
export JAVA_HOME
export PATH
export CLASSPATH[root@es02 ~]# source /etc/profile
[root@es02 ~]# java -version
3.创建elk用户
[root@es02 ~]# groupadd elk
[root@es02 ~]# useradd -g elk elk
[root@es02 ~]# passwd elk
4.ElasticSearch
4.1 install
[root@es02 A010_elk]# tar -C /usr/local/ -zxvf elasticsearch-7.6.2-linux-x86_64.tar.gz
[root@es02 A010_elk]# cd /usr/local
[root@es02 local]# mv elasticsearch-7.6.2 elasticsearch
[root@es02 local]# chown -R elk:elk elasticsearch
[root@es02 local]# echo 'ES_HOME=/usr/local/elasticsearch' >> /etc/profile
4.2 config
[root@es02 ~]# cd /var/log/
[root@es02 log]# mkdir elasticsearch
[root@es02 log]# chown -R elk:elk elasticsearch
[root@es02 ~]# mkdir -p /data/elasticsearch
[root@es02 ~]# chown -R elk:elk /data/elasticsearch
[root@es02 ~]# cp /usr/local/elasticsearch/config/elasticsearch.yml{,.bakup}
[root@es02 ~]# vim /usr/local/elasticsearch/config/elasticsearch.yml
cluster.name: HZZ-ELK-Cluster
node.name: ${HOSTNAME}
path.data: /data/elasticsearch
path.logs: /var/log/elasticsearch
#network.host: 127.0.0.1
network.host: 192.168.1.72
http.port: 9200
cluster.initial_master_nodes: ["192.168.1.72"]4.3 startup
[root@es02 ~]# su - elk
[elk@es02 ~]$ cd $ES_HOME
[elk@es02 elasticsearch]$ ./bin/elasticsearch -d -p pid
[elk@es02 elasticsearch]$ curl 192.168.1.72:9200
[elk@es02 elasticsearch]$ curl -X GET "192.168.1.72:9200/"
{
"name" : "es02",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "Ebl03w5XQf6IIKVHeS-asg",
"version" : {
"number" : "7.6.2",
"build_flavor" : "default",
"build_type" : "tar",
"build_hash" : "ef48eb35cf30adf4db14086e8aabd07ef6fb113f",
"build_date" : "2020-03-26T06:34:37.794943Z",
"build_snapshot" : false,
"lucene_version" : "8.4.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
[root@es02 log]# curl -X GET "192.168.1.72:9200/_cat/nodes?v"
ip heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name
192.168.1.72 7 96 1 0.06 0.06 0.08 dilm * es02
[root@es02 log]# curl -X GET "192.168.1.72:9200/_cat/health?v"
epoch timestamp cluster status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent
1587636059 10:00:59 HZZ-ELK-Cluster green 1 1 0 0 0 0 0 0 - 100.0%
[root@localhost filebeat]# curl -X GET "192.168.1.72:9200/_cat/indices?v"
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open .kibana_task_manager_1 NM8G5rwVQm-3vHnSb-g0vw 1 0 2 0 34.1kb 34.1kb
green open .apm-agent-configuration aVHVjoWFQHOlXnkfv4KwmA 1 0 0 0 283b 283b
green open ilm-history-1-000001 EL3FbYWiTXSFVvnvyW0leg 1 0 18 0 25.3kb 25.3kb
yellow open filebeat-7.6.2-2020.04.24-000001 Dp9mkAygTRq-qKKAwpKUqQ 1 1 35303 0 4.2mb 4.2mb
green open .kibana_1 8yop_FPbQMql2YtwVa11aA 1 0 8 10 50.5kb 50.5kb
yellow open syslog-2020.04.24 1vQgkHQkQsOf1RZT-bTvQA 1 1 74 0 103.6kb 103.6kb
[root@es02 log]# curl -X GET http://api.zsearch-gtj.alipay.com/?pretty5.logstash
[root@es02 local]# tar -zxvf logstash-7.6.2.tar.gz -C /usr/local/
[root@es02 home]# cd /usr/local/
[root@es02 local]# mv logstash-7.6.2 logstash
input {
file {
path => ["/var/log/messages"]
type => "syslog"
}
}
filter {
grok {
match => [ "message", "%{SYSLOGBASE} %{GREEDYDATA:content}" ]
}
}
output {
elasticsearch {
hosts => ["192.168.1.72:9200"]
index => "syslog-%{+YYY.MM.dd}"
}
}[root@es02 logstash]# cd /usr/local/logstash
[root@es02 logstash]# ./bin/logstash -f /usr/local/logstash/config/logstash.conf &
[root@es02 logstash]# ./bin/logstash -f /usr/local/logstash/config/logstash-sample.conf &
[root@es02 logstash]# curl localhost:9600
9600 5044
6.kibana
[root@es02 local]# tar -C /usr/local/ -zxvf kibana-7.6.2-linux-x86_64.tar.gz
[root@es02 es]# cd /usr/local/
[root@es02 local]# mv kibana-7.6.2-linux-x86_64 kibana
[root@es02 config]# touch /var/log/kibana.log
[root@es02 config]# chmod 777 /var/log/kibana.log
[root@es02 local]# cp kibana/config/kibana.yml{,.bakup}
[root@es02 config]# cat kibana.yml
server.port: 5601
server.host: 192.168.1.72
elasticsearch.hosts: "http://192.168.1.72:9200"
logging.dest: /var/log/kibana.log[root@es02 local]# chown -R elk:elk kibana
[root@es02 local]# su - elk
[elk@es02 ~]$ cd /usr/local/kibana/bin/
[elk@es02 ~]$ ./kibana &
http://192.168.1.72:5601/app/kibana#/home?_g=()
7.filebeat
[root@localhost usr]# tar -C /usr/local/ -zxvf filebeat-7.6.2-linux-x86_64.tar.gz
[root@localhost local]# mv filebeat-7.6.2-linux-x86_64 filebeat