elkf基础环境搭建

一、首先安装jdk环境
yum install java-1.8.0-openjdk*
安装elasticsearch
下载rpm包：https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.2.4.rpm
安装rpm包
Rpm -ivh elasticsearch-6.2.4.rpm
配置elasticsearch
Vim /etc/elasticsearch/elasticsearch.yum
cluster.name: my-application 集群名称
node.name: node-1 #节点名称
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 192.168.6.5 #本机IP
http.port: 9200 #开启端口
discovery.zen.ping.unicast.hosts: [“192.168.6.5”,“192.168.6.32”,“192.168.6.39”] #节点ip
启动elasticsearch
Systemctl start elasticsearch
查看 elasticsearch状态
Systemctl status elasticsearch
可以内部测试一下看是否成功
curl -XGET ‘192.168.6.5:9200/?pretty’
{ “name” : “5Gklft1”, “cluster_name” : “elasticsearch”, “cluster_uuid” : “7xLCGLC3TTeD7IgHR00Gyg”, “version” : { “number” : “6.2.2”, “build_hash” : “10b1edd”, “build_date” : “2018-02-16T19:01:30.685723Z”, “build_snapshot” : false, “lucene_version” : “7.2.1”, “minimum_wire_compatibility_version” : “5.6.0”, “minimum_index_compatibility_version” : “5.0.0” }, “tagline” : “You Know, for Search”}
表示成功
安装logstash
安装rpm

[root@localhost ~]# rpm -ivh logstash-6.2.2.rpm
配置logstash输入输出文件

[root@localhost log]# vim /etc/logstash/conf.d/logstash.conf
input {
#stdin {}
file {
path =>"/usr/log/*"
type =>“system”
start_position =>“beginning”
#codec => plain{charset => “UTF-8” }
}
}
filter{
}
output {
elasticsearch {
#cluster =>“ourfuture”
hosts =>[“192.168.26.134:9200”]
index => “wfq”
}
}
启动logstash

[root@localhost log]# sudo systemctl start logstash.service
查询启动状态

往/usr/log/ 下面任何文件中写入内容即可被logstash采集！
安装kibana
下载url：https://artifacts.elastic.co/downloads/kibana/kibana-6.2.2-x86_64.rpm

安装rpm

[root@localhost ~]# rpm -ivh kibana-6.2.2-x86_64.rpm
修改kibana配置文件

[root@localhost kibana]# vim /etc/kibana/kibana.yml

启动kibana
Systemctl start kibana
附上参考链接
https://blog.csdn.net/qq_29384639/article/details/81448472?tdsourcetag=s_pcqq_aiomsg

需要收集日志的客户端安装filebeat
修改配置文件 vim /etc/filebeat/filebeat.yml
filebeat.prospectors:

• type: log
  enabled: true #启用配置
  paths:
  • D:\httx\logs* #设置监控路径
    #output.elasticsearch: #禁用ES写入
    output.logstash: #启用logstash写入
    hosts: [“192.168.6.5:5044”] #服务端地址
    创建新的配置文件vim /etc/logstash/conf.d/logstash-es.conf内容如下
    input {
    stdin { }
    beats {
    port => 5044
    ssl => false
    }
    }
    output {
    elasticsearch {
    action => “index”
    hosts => “127.0.0.1:9200”
    index => “logstash-%{+YYYY-MM}”
    }
    stdout { codec=> rubydebug }
    }
    重启logstash,访问kibana发现刚才创建的索引