10-Mac安装ELK

brew install elasticsearch，安装7.10.2版本

To have launchd start elasticsearch now and restart at login:
  brew services start elasticsearch
Or, if you don't want/need a background service you can just run:
  elasticsearch
==> Summary
  /usr/local/Cellar/elasticsearch/7.10.2: 156 files, 113.5MB
==> Caveats
==> elasticsearch
Data:    /usr/local/var/lib/elasticsearch/
Logs:    /usr/local/var/log/elasticsearch/elasticsearch_yangjun.log
Plugins: /usr/local/var/elasticsearch/plugins/
Config:  /usr/local/etc/elasticsearch/

To have launchd start elasticsearch now and restart at login:
  brew services start elasticsearch
Or, if you don't want/need a background service you can just run:
  elasticsearch
yangjun@yangjun ~ % 

brew install logstash，安装7.10.2版本

注意版本要和elasticsearch一致，实在不行就自己去下载tar包下来
下载地址：https://www.elastic.co/cn/downloads/past-releases/logstash-7-10-2

yangjun@yangjun ~ % brew install logstash         
==> Downloading https://ghcr.io/v2/homebrew/core/logstash/manifests/7.14.1
Already downloaded: /Users/yangjun/Library/Caches/Homebrew/downloads/bb7e451818765e37a15312cf7b96238736a51bef9ad2d895a32e73a34d1bbe4b--logstash-7.14.1.bottle_manifest.json
==> Downloading https://ghcr.io/v2/homebrew/core/logstash/blobs/sha256:02db87c4194fd1ff3f2dd864b7c1deb3350a0c9e434b4f182845e752f8e18c03
Already downloaded: /Users/yangjun/Library/Caches/Homebrew/downloads/45f170bdc70e11cbeb337c7ef6787baedbd3f2844a69d09df6a4a6d80b59c757--logstash--7.14.1.big_sur.bottle.tar.gz
==> Reinstalling logstash 
==> Pouring logstash--7.14.1.big_sur.bottle.tar.gz
==> Caveats
Configuration files are located in /usr/local/etc/logstash/

To start logstash:
  brew services start logstash
Or, if you don't want/need a background service you can just run:
  /usr/local/opt/logstash/bin/logstash
==> Summary
  /usr/local/Cellar/logstash/7.14.1: 12,576 files, 289.1MB
yangjun@yangjun ~ % 

在conf下添加 logstash.conf

input {
  beats {
    port => 5044
  }
  tcp {
    host => "127.0.0.1" port => 9250 mode => "server" tags => ["tags"] codec => json_lines 
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
  }
  stdout { codec => rubydebug }
}

启动 ./bin/logstash -f ./config/logstash.conf

brew install kibana，安装7.10.2版本

yangjun@yangjun ~ % brew install kibana
Updating Homebrew...
==> Auto-updated Homebrew!
Updated 2 taps (homebrew/core and homebrew/cask).
==> New Formulae
jpdfbookmarks
==> Updated Formulae
Updated 7 formulae.
==> Updated Casks
Updated 12 casks.

Warning: node@10 has been deprecated because it is not supported upstream!
==> Downloading https://ghcr.io/v2/homebrew/core/node/10/manifests/10.24.1_1
######################################################################## 100.0%
==> Downloading https://ghcr.io/v2/homebrew/core/node/10/blobs/sha256:84095e53ee
==> Downloading from https://pkg-containers.githubusercontent.com/ghcr1/blobs/sh
######################################################################## 100.0%
==> Downloading https://ghcr.io/v2/homebrew/core/kibana/manifests/7.10.2
######################################################################## 100.0%
==> Downloading https://ghcr.io/v2/homebrew/core/kibana/blobs/sha256:c218ab10fca
==> Downloading from https://pkg-containers.githubusercontent.com/ghcr1/blobs/sh
######################################################################## 100.0%
Warning: kibana has been deprecated because it is switching to an incompatible license!
==> Installing dependencies for kibana: node@10
==> Installing kibana dependency: node@10
==> Pouring [email protected]_1.big_sur.bottle.tar.gz
  /usr/local/Cellar/node@10/10.24.1_1: 4,308 files, 53MB
==> Installing kibana
==> Pouring kibana--7.10.2.big_sur.bottle.tar.gz
==> Caveats
Config: /usr/local/etc/kibana/
If you wish to preserve your plugins upon upgrade, make a copy of
/usr/local/opt/kibana/plugins before upgrading, and copy it into the
new keg location after upgrading.

To have launchd start kibana now and restart at login:
  brew services start kibana
Or, if you don't want/need a background service you can just run:
  kibana
==> Summary
  /usr/local/Cellar/kibana/7.10.2: 29,153 files, 300.8MB
==> Caveats
==> kibana
Config: /usr/local/etc/kibana/
If you wish to preserve your plugins upon upgrade, make a copy of
/usr/local/opt/kibana/plugins before upgrading, and copy it into the
new keg location after upgrading.

To have launchd start kibana now and restart at login:
  brew services start kibana
Or, if you don't want/need a background service you can just run:
  kibana
yangjun@yangjun ~ % 

参考：
https://mp.weixin.qq.com/s/QY8JwMAaeks81ndql9xECQ