CentOS7安装ELK7.2.0

1、下载安装包

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.2.0-linux-x86_64.tar.gz
wget https://artifacts.elastic.co/downloads/logstash/logstash-7.2.0.tar.gz
wget https://artifacts.elastic.co/downloads/kibana/kibana-7.2.0-linux-x86_64.tar.gz
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.2.0-linux-x86_64.tar.gz

2、解压安装包

直接使用root用户进行解压

tar -xzf elasticsearch-7.2.0-linux-x86_64.tar.gz
tar -xzf logstash-7.2.0.tar.gz
tar -xzf kibana-7.2.0-linux-x86_64.tar.gz
tar -xzf filebeat-7.2.0-linux-x86_64.tar.gz

3、创建ELK用户

由于ELK和Kibana要求非root用户启动，所以这里创建一个elk用户，用于启动ELK

groupadd elk
useradd elk -g elk
passwd admin123
chown -R elk:elk elasticsearch-7.2.0 
chown -R elk:elk kibana-7.2.0-linux-x86_64

4、创建数据和日志文件夹，并修改权限

mkdir  -pv  /data/elk/{data,logs}
chown -R elk:elk /data/elk/

5、修改配置文件

在root用户下修改本机配置权限

vim elasticsearch-7.2.0/config/elasticsearch.yml
path.data: /data/elk/data
path.logs: /data/elk/logs

vim /etc/security/limits.conf
 
----- 最后添加 -----
*       soft    nofile  65536
*       hard    nofile  131072
*       soft    nproc   4096
*       hard    nproc   4096
vim /etc/sysctl.conf
 
----- 最后添加 -----
 
vm.max_map_count=655360
————————————————
sysctl -p

6、启动ES

su - elk
cd elasticsearch-7.2.0
nohup bin/elasticsearch &

8、root用户下安装logstash

cd logstash-7.2.0/
cp config/logstash-sample.conf ./
# 可以自己看一下这个配置文件里的内容，根据自己的需求修改，本次使用默认
nohup bin/logstash -f logstash-sample.conf &

9、安装kibana

su - elk
cd kibana-7.2.0-linux-x86_64
vim config/kibana.yml   #修改host，这样可以在其他机器上的浏览器，用ip+端口去访问kibana
server.host: "0.0.0.0"

启动,Kibana也不能用root用户启动

nohup bin/kibana &

在浏览器里，输入yourip:5601 访问成功即代表启动成功

filebeat

root下

cd filebeat-7.2.0-linux-x86_64

#下面主要是将filebeat.inputs的enabled改为true,paths改为需要采集的日志文件，这里使用的Nginx的日志，然后将output.elasticsearch注释掉，output.logstash打开，也就是用filebeat将日志采集传给logstash，然后再由logstash传给elasticsearch，而不是默认的直接传，注意：当然还有其他默认的注释的我没有贴出来 #

filebeat.inputs:
 # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/nginx/*.log
filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.settings:
  index.number_of_shards: 1
  #-------------------------- Elasticsearch output ------------------------------
#output.elasticsearch:
  # Array of hosts to connect to.
 # hosts: ["localhost:9200"]

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["localhost:5044"]
# Configure processors to enhance or manipulate events generated by the beat.

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

启动

nohup  ./filebeat -e -c filebeat.yml &