Graylog2+Elasticsearch+Nxlog
https://www.jianshu.com/u/95b81907fe14
Kibana 用户手册
Kibana汉化项目
ELK stack 中文指南
Elasticsearch: 权威指南
Elasticsearch: 权威指南
https://download.csdn.net/download/chinesepython/10904000
https://www.elastic.co/cn/
pandownload
搭建基于springcloud sleuth的ELK日志分析系统
****ELK 系列二、Centos 7 安装ELK6.5.3 +filebeat+守护进程supervisor 进行日志解析和定制
在 CentOS7 安装 ELK
https://blog.51cto.com/andyxu/2124697
https://www.cnblogs.com/hanyifeng/p/5509985.html
https://blog.csdn.net/m0_37327416/article/details/78120424
https://www.elastic.co/downloads
*****ELK(ElasticSearch, Logstash, Kibana)搭建实时日志分析平台
https://www.cnblogs.com/woshimrf/p/elk-springboot.html#_caption_5
ES学习之路-安装elasticsearch-head插件
https://www.imooc.com/article/22709?block_id=tuijian_wz
elk（单机）安装过程中遇到的问题及解决方法
https://blog.csdn.net/weini1111/article/details/60468068
https://www.cnblogs.com/yuluoxingkong/p/7886622.html
ElasticSearch Root身份运行
http://www.dajiangtai.com/community/18136.do?origin=csdn-geek&dt=1214
内存调整
JVM相关运行参数
用的是5.6.9版本，因为一个没有32位的
- elk最低要求jdk为1.8
- elasticsearch默认要求内存为2g,修改配置
vi ./elasticsearch-5.1.1/config/jvm.options
-Xms2g
-Xmx2g
- elasticsearch不能以root用户执行，所以要创建用户，然后切换用户后再执行。
- https://blog.csdn.net/weini1111/article/details/60468068
- https://blog.csdn.net/liangzhao_jay/article/details/56840941
vi /etc/sysconfig/iptables
-A INPUT -m state --state NEW -m tcp -p tcp --dport 9200 -j ACCEPT
service iptables restart
调整elk配置
vi ./elasticsearch-5.1.1/config/elasticsearch.yml
network.host: 0.0.0.0
3、max file descriptor
ERROR: bootstrap checks failed
max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
vi /etc/security/limits.conf
* hard nofile 65536
* soft nofile 65536
4、max number of threads
max number of threads [1024] for user [user] is too low, increase to at least [2048]
vi /etc/security/limits.d/90-nproc.conf
* soft nproc 2048
5、max virtual memory areas
max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
1 sysctl -w vm.max_map_count=262144
2 vi /etc/sysctl.conf
vm.max_map_count=262144
6、设置/etc/security/limits.d/90-nproc.conf后，仍报错
ERROR: bootstrap checks failed
max number of threads [1876] for user [work] is too low, increase to at least [2048]
查询虚拟机内存，如果内存较低，就会影响实际的最大线程数
在/etc/security/limits.conf文件末尾加入
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096
修改/etc/security/limits.d/20-nproc.conf
* soft nproc 4096
改成
* soft nproc 8192
在/etc/systml.conf中添加
vm.max_map_count=655360
最后执行命令
‘sysctl -p’
在elasticsearch.yml中配置bootstrap.system_call_filter为false，注意要在Memory下面:
bootstrap.memory_lock: false
bootstrap.system_call_filter: false
head安装
1.地址：https://github.com/mobz/elasticsearch-head
2.安装git :yum install git
3.安装node
wget https://nodejs.org/dist/v8.11.1/node-v8.11.1-linux-x86.tar.xz
tar xvJf ***.tar.xz来解压
添加环境变量
export NODE_HOME=/usr/local/devtools/node-v8.11.1-linux-x86
export PATH=$ZOOKEEPER_HOME/bin:$PATH
git clone git://github.com/mobz/elasticsearch-head.git
cd elasticsearch-head
npm install
npm run start
open http://localhost:9100/
logstash安装配置
https://my.oschina.net/itblog/blog/547250
log4j主动去连接ELK中的logstash，然后把日志发送到logstash上
https://blog.csdn.net/ketonfly/article/details/15812499
logstash日志分析的配置和使用
https://blog.csdn.net/clevercode/article/details/78632887?locationnum=9&fps=1
Logstash 讲解与实战应用
https://www.cnblogs.com/python-way/p/6110736.html
vi config/log4j_to_es.conf
# For detail structure of this file
# Set: https://www.elastic.co/guide/en/logstash/current/configuration-file-structure.html
input {
# For detail config for log4j as input,
# See: https://www.elastic.co/guide/en/logstash/current/plugins-inputs-log4j.html
log4j {
mode => "server"
host => "192.168.112.128"
port => 4567
}
stdin { }
}
filter {
#Only matched data are send to output.
}
output {
# For detail config for elasticsearch as output,
# See: https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html
elasticsearch {
action => "index" #The operation on ES
hosts => "192.168.112.128:9200" #ElasticSearch host, can be array.
index => "applog" #The index to write data to.
}
stdout {
codec => rubydebug
}
}
./bin/logstash -f config/log4j_to_es.conf
Kibana配置
https://my.oschina.net/itblog/blog/547250
tar -zxvf kibana-4.3.0-linux-x86.tar.gz
cd kibana-4.3.0-linux-x86
vi config/kibana.yml
server.port: 5601
server.host: “Kibanaip”
elasticsearch.url: http://elasticsearchip:9200
kibana.index: “.kibana”
启动kibana：
./bin/kibana
http://localhost:5601/
需要配置至少一个Index名字或者Pattern，它用于在分析时确定ES中的Index。这里我输入之前elasticsearch配置的Index名字applog
配置前先写几个log 到 elasticsearch
然后就可以成功添加index了