ELK部署测试

最新推荐文章于 2023-03-05 21:51:40 发布

hwbswxfxzy

最新推荐文章于 2023-03-05 21:51:40 发布

阅读量224

点赞数

CC 4.0 BY-SA版权

分类专栏：后端技术 DevOps 文章标签： ELK elastic logstash kibana

本文链接：https://blog.youkuaiyun.com/hwbswxfxzy/article/details/89766228

后端技术同时被 2 个专栏收录

3 篇文章

订阅专栏

DevOps

1 篇文章

订阅专栏

本文详细介绍了ELK Stack（ES、Logstash、Kibana）的下载、启动顺序及配置方法。还介绍了Filebeat的安装与配置，用于日志数据采集。通过监控nginx的access.log，展示了数据在Elasticsearch中的存储情况，并说明了Kibana如何展示数据及相关配置步骤。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

下载：
ES和Kibana：https://www.elastic.co/cn/start?elektra=home&amp&storm=banner
Logstash：https://www.elastic.co/cn/downloads/logstash

启动顺序：
0、配置JAVA_HOME和JRE_HOME，指向c:\jdk18
启动顺序：ES->Logstash->Kibana
1、启动es：D:\sbf\elk\elasticsearch-7.0.0\bin\elasticsearch.bat
2、启动Logstash：
Create a file named "first-pipeline.conf" and save it in the same directory as Logstash.

input {
beats {
port => "5044"
}
}

output {
elasticsearch {
hosts => ["127.0.0.1:9200"]
manage_template => true
template_overwrite => true
   #index => "apache_elastic_example"
   index => "es-message-%{+YYYY.MM.dd}"
   #template => "./apache_template.json"
   template_name => "apahce_elastic_example"
}
stdout {
codec => rubydebug
}
}

执行命令：logstash -f first-pipeline.conf --config.reload.automatic

3、启动Kibana
参考：https://blog.youkuaiyun.com/ling811/article/details/74999880
调整kibanna相关参数；
###启动
./bin/kibana &
访问：http://localhost:5601

4、下载filebeat-7.0.0-windows-x86_64，由filebeat读取文件--》logstash-》elasticsearch-》kibana展示
Filebeat是本地文件的日志数据采集器。作为服务器上的代理安装，Filebeat监视日志目录或特定日志文件，tail file，并将它们转发给Elasticsearch或Logstash进行索引、kafka 等
安装：https://www.elastic.co/cn/downloads/beats/filebeat ，按页面配置

5、监控nginx的access.log，新增一行，得到：

http://localhost:9200/_cat/indices?v
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
yellow open es-message-2019.05.02 vQDwVHmNSYumN2sxGHzQxA 1 1 1 0 18.7kb 18.7kb
green open .kibana_task_manager 0WcfWNuhTqydRacI7uuA7A 1 0 2 0 46.4kb 46.4kb
yellow open apache_elastic_example lxqYpPtAQlCI_J-Rb3qsBg 1 1 1 0 18.8kb 18.8kb
yellow open filebeat-7.0.0-2019.04.30-000001 nIuNetxOSXWVtUol3nuowQ 1 1 0 0 283b 283b
yellow open logstash-2019.04.30-000001 cz7on7WVQhWw-UpQhSar-g 1 1 10 0 168.8kb 168.8kb
yellow open test 6O5jGT27TBaECW9zG6EKSQ 1 1 2 0 37.4kb 37.4kb
green open .kibana_1 3WU4duRURtG5LH2QHMHZSA 1 0 614 52 402.9kb 402.9kb

http://localhost:9200/es-message-2019.05.02/_search
{"took":2,"timed_out":false,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0},"hits":{"total":{"value":1,"relation":"eq"},"max_score":1.0,"hits":[{"_index":"es-message-2019.05.02","_type":"_doc","_id":"kLaHeGoB4xywh91DNcug","_score":1.0,"_source":{"@timestamp":"2019-05-02T12:31:24.556Z","ecs":{"version":"1.0.0"},"host":{"name":"zy","hostname":"zy","architecture":"x86_64","os":{"name":"Windows 10 Pro","build":"17763.437","platform":"windows","version":"10.0","family":"windows","kernel":"10.0.17763.437 (WinBuild.160101.0800)"},"id":"67630411-0570-40f4-bf0a-b34f2b392beb"},"message":"127.0.0.1 - - [08/Apr/2019:11:38:49 +0800] \"GET /index1.html HTTP/1.1\" 200 1691 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36\"","agent":{"type":"filebeat","version":"7.0.0","id":"debbb419-bbdd-4bd4-b717-a61ca267cc37","ephemeral_id":"229fea9e-06d8-41dc-9fd1-eff656cd5e0c","hostname":"zy"},"log":{"offset":25598,"file":{"path":"D:\\sbf\\nginx-1.14.1\\logs\\access.log"}},"input":{"type":"log"},"@version":"1","tags":["beats_input_codec_plain_applied"]}}]}}

6、上面说明手工添加的一行access.log数据已经到了elasticsearch存储了。kibana如何展示呢？
在kibana中Dev Tools 中： GET _cat/indices，执行后可以得到第5步骤的值；
GET es-message-2019.05.02

7、配置kibana
Kibana->Management->index Patterns-->Create index patterns-->按提示两部完成配置；
在Discover中选择新建的es-messsage-*,选择时间，就会查询到一笔数据；