ELK的安装部署以及nginx日志采集

ELK的安装部署以及日志采集

环境要求:最低是2G 2核心的配置,没有上限,请根据自己机器本身情况而定。

思路:
192.168.80.130
jdk+elasticseach+kibana

192.168.80.131
jdk+logstash

1. 关闭防火墙

 systemctl stop firewalld

2. 时间同步

 yum - y install  ntpdate
 ntpdate  pool.ntp.org
    如果出现下面这种情况
var/run/yum.pid 已被锁定,PID 为 3382 的另一个程序正在运行。
Another app is currently holding the yum lock; waiting for it to exit...
  另一个应用程序是:PackageKit
    内存: 28 M RSS (440 MB VSZ)
    已启动: Mon Jan 18 20:29:35 2021 - 00:38之前
    状态  :睡眠中,进程ID:3382
[root@localhost ~]# rm -rf /var/run/yum.pid

3. 两台机器安装jdk环境

 [root@localhost ]# rpm -ivh jdk-8u131-linux-x64_.rpm 

验证一下:

[root@localhost ]# java -version

4. 130机器安装elasticseach

 [root@localhost ]# rpm -ivh elasticsearch-6.6.2.rpm
vim /etc/elasticsearch/elasticsearch.yml
17行 cluster.name: my-application
23行 node.name: node-1
33行 path.data: /var/lib/elasticsearch
37行 path.logs: /var/log/elasticsearch
55行 network.host: 192.168.80.130
59行 http.port: 9200

运行es服务:

systemctl enable elasticsearch
systemctl start elasticsearch

验证服务是否正常运行:

[root@localhost]# tailf/var/log/elasticsearch/huazai007.log 
!!!不报红就没事!!!

5. 131机器安装logstash

 [root@localhost ]# rpm -ivh logstash-6.6.0.rpm
收集/var/log/messages日志
input{
     
	file{
     
		path => "/var/log/messages"
		type => 'msg-log'
		start_position => "beginning"
	}
}

output{
     
	elasticsearch{
     
		hosts => "192.168.80.130:9200"
		index => "msg_log-%{+YYYY.MM.dd}"
	}
}

记得加权限!不加出不来效果!

chmod 777 /var/log -R

启动服务:

[root@localhost conf.d]# systemctl start logstash

验证端口:

[root@localhost conf.d]# netstat  -lptnu|grep 9600
tcp6       0      0 127.0.0.1:9600          :::*                    LISTEN      13879/java 

6. 130服务器开启kibana

 [root@localhost # rpm -ivh kibana-6.6.2-x86_64.rpm
[root@localhost kibana]# pwd
/etc/kibana
编辑配置文件:
[root@localhost kibana]# vim /etc/kibana/kibana.yml
2行 server.port: 5601
7行 server.host: "192.168.80.130"
28行 elasticsearch.hosts: ["http://192.168.80.130:9200"]

启动

[root@localhost kibana]# systemctl start kibana
[root@localhost kibana]# netstat  -lptnu|grep 5601
tcp        0      0 192.168.80.130:5601     0.0.0.0:*               LISTEN      16590/node      

7.添加nginx日志。

在131机器上安装nginx并访问(不访问没有日志!)

yum -y install nginx

systemctl enable nginx
systemctl start nginx
[root@bogon conf.d]# netstat  -lptnu|grep 80
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      73887/nginx: 
安装ab压测工具,生成测试数据
yum -y install httpd-tools
ab -n 1000 -c 1000 http://192.168.80.131/index.html
-n:请求数
-c:并发数
注意:并发数不能大于请求数!!

4: 编辑nginx.conf

[root@]# vim /etc/logstach/conf.d/nginx.conf
input {
     
	file {
     
		path => "/var/log/nginx/access.log"
		type => "nginx-log"
		start_position => "beginning"
	}
}

output{
     
	elasticsearch {
     
		hosts => "192.168.1.7:9200"
		index => "nginx_log-%{+YYYY.MM.dd}"
	}
[root@]# vim /etc/logstash/pipelines.yml 

pipeline.id: nginx
  path.config: "/etc/logstash/conf.d/nginx.conf"

重启后生效。

你可能感兴趣的:(linux,nginx,centos,docker)