ELK

Download and install the public signing key:

sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

添加安装源

[elasticsearch]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
autorefresh=1
type=rpm-md

install logstash

sudo yum install logstash

安装elasticsearch

sudo yum install --enablerepo=elasticsearch elasticsearch

配置elasticsearch

useradd elasticsearch

chown -R elasticsearch:elasticsearch /data/es-data
chown -R elasticsearch:elasticsearch /var/log/elstic


vim /etc/elasticsearch/elasticsearch.yml
#
# Use a descriptive name for the node:
#
node.name: Elstic
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
# 数据路径
path.data: /data/es-data
#

# Path to log files:
#日志路径
path.logs: /var/log/elstic
...
# 监听地址，设置为127，只保持本机访问
network.host: 127.0.0.1
#
# Set a custom port for HTTP:
#
# 监听的端口
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#

添加服务

sudo systemctl restart filebeat.service
sudo systemctl restart logstash.service
sudo systemctl restart elasticsearch.service
sudo systemctl restart kibana.service


sudo systemctl start elasticsearch.service
sudo systemctl stop elasticsearch.service
sudo systemctl daemon-reload
sudo systemctl enable logstash.service
sudo systemctl enable kibana.service
sudo systemctl enable elasticsearch.service

防火墙

firewall-cmd --zone=public --add-port=9200/tcp --permanent
 firewall-cmd --zone=public --add-port=5601/tcp --permanent