ELK
ELK
elk是目前很流行的实时日志分析系统，E=elasticsearch，L=logstash，K=kibana
version：
elasticsearch：1.4.0
logstash：1.4.2
kibana：3.1.2
nginx：1.2.2
下面是单机搭建ELK的过程：
1 依赖
java环境是logstash和elasticsearch都需要的，在logstash和elasticsearch所在的主机上安装最新的版本的java环境。
确认java环境是否安装好，输入下面的命令：
$ java -version
输出：
java version "1.7.0_79"
OpenJDK Runtime Environment (rhel-2.5.5.3.el6_6-x86_64 u79-b14)
OpenJDK 64-Bit Server VM (build 24.79-b02, mixed mode)1 logstash
-安装
$ wget https://download.elasticsearch.org/logstash/logstash/logstash-1.4.2.tar.gz
$ tar zxvf logstash-1.4.2.tar.gz
-验证
$ cd /path/to/logstash/
$ bin/logstash -e 'input { stdin { } } output { stdout {} }'
hello world
2014-11-13T02:46:46.340+0000 linux hello world2 Elasticsearch
-安装
$ wget https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-1.4.0.tar.gz
$ tar zxvf elasticsearch-1.4.0.tar.gz-运行
$ cd /path/to/elasticsearch
$ bin/elasticsearch -d正常启动elasticsearch会输出一下信息：
[2014-11-12 18:04:14,250][INFO ][node ] [Thunderclap] version[1.4.0], pid[25882], build[bc94bd8/2014-11-05T14:26:12Z]
[2014-11-12 18:04:14,251][INFO ][node ] [Thunderclap] initializing ...
[2014-11-12 18:04:14,256][INFO ][plugins ] [Thunderclap] loaded [], sites []
[2014-11-12 18:04:16,527][INFO ][node ] [Thunderclap] initialized
[2014-11-12 18:04:16,528][INFO ][node ] [Thunderclap] starting ...
[2014-11-12 18:04:16,820][INFO ][transport ] [Thunderclap] bound_address {inet[/0:0:0:0:0:0:0:0:9300]}, publish_address {inet[/192.168.205.252:9300]}
[2014-11-12 18:04:16,839][INFO ][discovery ] [Thunderclap] elasticsearch/AWsqNT85SbytA3OYMKvekQ
[2014-11-12 18:04:20,625][INFO ][cluster.service ] [Thunderclap] new_master [Thunderclap][AWsqNT85SbytA3OYMKvekQ][linux][inet[/192.168.205.252:9300]], reason: zen-disco-join (elected_as_master)
[2014-11-12 18:04:20,647][INFO ][http ] [Thunderclap] bound_address {inet[/0:0:0:0:0:0:0:0:9200]}, publish_address {inet[/192.168.205.252:9200]}
[2014-11-12 18:04:20,647][INFO ][node ] [Thunderclap] started-* 验证*
可以直接通过HTTP协议访问Elasticsearch，默认端口为9200：
$ curl -X GET http://localhost:9200
{
"status" : 200,
"name" : "Spellcheck",
"cluster_name" : "elasticsearch",
"version" : {
"number" : "1.4.0",
"build_hash" : "bc94bd81298f81c656893ab1ddddd30a99356066",
"build_timestamp" : "2014-11-05T14:26:12Z",
"build_snapshot" : false,
"lucene_version" : "4.10.2"
},
"tagline" : "You Know, for Search"
}3 kibana
-安装
$ wget https://download.elasticsearch.org/kibana/kibana/kibana-3.1.2.tar.gz
$ tar zxvf kibana-3.1.2.tar.gz -启动
启动kibana3需要一个web server，使用nginx作为kibana的web server，配置过程如下：
1 将解压后的kibana文件夹下的内容copy到/var/www/kibana
$ mkdir -p /var/www/kibana && cp -r /path/to/kibana /var/www/kibana2 配置nginx的/etc/nginx/conf.d/default.conf
#
# The default server
#
server {
listen 8088;
server_name _;
#charset koi8-r;
#access_log logs/kibana.access.log main;
location / {
root /var/www/kibana;
index index.html index.htm;
}
error_page 404 /404.html;
location = /404.html {
root /usr/share/nginx/html;
}
# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
# proxy the PHP scripts to Apache listening on 127.0.0.1:80
#
#location ~ \.php$ {
# proxy_pass http://127.0.0.1;
#}
# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
#location ~ \.php$ {
# root html;
# fastcgi_pass 127.0.0.1:9000;
# fastcgi_index index.php;
# fastcgi_param SCRIPT_FILENAME /scripts$fastcgi_script_name;
# include fastcgi_params;
#}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
}
-验证
在浏览器中输入kibana所在主机的ip:8088，但会出现链接不上elasticsearch的情况，修改/var/www/kibana/config.js中的
elasticsearch: "http://"+window.location.hostname+":9200",
为
elasticsearch: "http://ip_of_elasticsearch:9200",然后修改Elasticsearch的配置文件elasticsearch.yml，增加以下配置：
http.cors.enabled: true再次访问就会出现kibana的欢迎界面。