ELK windows端整合过程

Elasticsearch配置启动

官网下载完windows版

遇到错误1：

the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured

解决办法：
在安装目录的config/elasticsearch.yml打开几个注释
1.node.name注释 node.name: node-1

2.cluster.initial_master_nodes注释
cluster.initial_master_nodes: [“node-1”, “node-2”]

3.添加外网访问配置

**
network:
host: 0.0.0.0
http:
port: 9200
cors:
enabled: true
allow-origin: “*”
**

加上配置后成功访问

Kibana配置

config/kibana.yml添加
**
i18n.locale: “zh-CN”
server.port: 5601
server.host: “0.0.0.0”
elasticsearch.hosts: [“http://http://10.167.197.128:9200/”]
kibana.index: “.kibana”
**
elasticsearch.url可能是老版配置
新版需要elasticsearch.hosts否则报错：**
FATAL Error: [elasticsearch.url]: definition for this key is missing**

运行中
[“warning”,“elasticsearch”,“admin”],“pid”:4596,“message”:“No living connections”}]
导致启动不了
在kibana.yml添加
elasticsearch.ssl.verificationMode: “certificate”

Logstash配置启动

同样下载windows安装包
在 config 新建 logstash-test.conf

input { 
    tcp {
        port => 5044
        type => "test"
        codec => json_lines
    } 
	file {
        path => "/mylogs/*.log"
        start_position => beginning
    }
} 

output { 
  elasticsearch {  
    hosts  => ["10.167.197.128:9200"]   
    index => "logstash-%{type}"
  }
  stdout { codec => rubydebug }
}

在bin目录下启动cmd用命令行:
./logstash.bat -f …/config/logstash-test.conf

启动成功！