搭建ELK日志分析系统-优快云博客

一、创建swap空间

[root@jiaxin swap]# cd /mnt/swap/
[root@jiaxin swap]# dd if=/dev/zero of=swapfile bs=1M count=4096
[root@jiaxin swap]# mkswap swapfile 
[root@jiaxin swap]# swapon swapfile

开现自挂载

[root@jiaxin swap]# vim /etc/fstab 
/mnt/swap/swapfile swap swap defaults 0 0

让系统积极使用swap空间

[root@jiaxin swap]# cat /proc/sys/vm/swappiness 
0
[root@jiaxin swap]# vim /etc/sysctl.conf 
vm.swappiness=100
[root@jiaxin swap]# sysctl -p
[root@jiaxin swap]# cat /proc/sys/vm/swappiness 
100

安装JDK
官网：https://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html

[root@jiaxin src]# wget https://download.oracle.com/otn-pub/java/jdk/8u191-b12/2787e4a523244c269598db4e85c51e0c/jdk-8u191-linux-x64.tar.gz?AuthParam=1546066225_ea0f756f9c5ee46830a068eac225e345
[root@jiaxin src]# tar xf jdk-8u191-linux-x64.tar.gz
[root@jiaxin src]# mv jdk1.8.0_191/ /usr/java/jdk1.8
[root@jiaxin src]# vim /etc/profile

##################JDK########################
JDK_HOME=/usr/java/jdk1.8
JRE_HMOE=$JDK_HOME/jre
PATH=$PATH:$JDK_HOME/bin:$JRE_HOME/bin
CLASSPATH=.:$JDK_HOME/lib/dt.jar:$JDK_HOME/lib/tools.jar

[root@jiaxin src]# source /etc/profile
[root@jiaxin src]# java -version
java version "1.8.0_191"
Java(TM) SE Runtime Environment (build 1.8.0_191-b12)
Java HotSpot(TM) 64-Bit Server VM (build 25.191-b12, mixed mode)

二、下载安装kibana
官网：https://www.elastic.co/downloads/kibana

[root@jiaxin swap]# cd /usr/local/src/
[root@jiaxin src]# wget https://artifacts.elastic.co/downloads/kibana/kibana-6.5.4-linux-x86_64.tar.gz
[root@jiaxin src]# tar xf kibana-6.5.4-linux-x86_64.tar.gz 
[root@jiaxin src]# mv kibana-6.5.4-linux-x86_64 /usr/local/kibana
[root@jiaxin src]# cd /usr/local/kibana/
[root@jiaxin kibana]# vim config/kibana.yml

server.port: 5601
server.host: "0.0.0.0"
elasticsearch.url: "http://localhost:9200"
kibana.index: ".kibana"

后台运行kibana

[root@jiaxin kibana]# nohup ./bin/kibana &

访问url:
http://47.99.89.247:5601/
Kibana server is not ready yet
正常~！
三、下载安装elasticsearch

[root@jiaxin src]# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.5.4.tar.gz
[root@jiaxin src]# tar xf elasticsearch-6.5.4.tar.gz 
[root@jiaxin src]# mv elasticsearch-6.5.4 /usr/local/elasticsearch
[root@jiaxin src]# cd /usr/local/elasticsearch/
[root@jiaxin elasticsearch]# vim config/elasticsearch.yml

path.data: /path/to/data
path.logs: /path/to/logs
network.host: 0.0.0.0
http.port: 9200

[root@jiaxin local]# groupadd elasticsearch
[root@jiaxin local]# useradd -r -g elasticsearch elasticsearch
[root@jiaxin local]# chown -R elasticsearch:elasticsearch elasticsearch/
[root@jiaxin local]# chown -R elasticsearch:elasticsearch /path/

[root@jiaxin local]# vim /etc/security/limits.conf 
* soft nofile 65536
* soft nofile 65536
* soft nofile 65536
* hard nofile 65536

[root@jiaxin local]# ulimit -u 4096
[root@jiaxin local]# vim /etc/sysctl.conf 
vm.max_map_count = 262144
[root@jiaxin local]# sysctl  -p
[root@jiaxin local]# vim /etc/security/limits.d/20-nproc.conf
*       soft    nproc     unlimited

[root@jiaxin local]# su elasticsearch
bash-4.2$ cd elasticsearch/
bash-4.2$ ./bin/elasticsearch &

打开URLhttp://47.99.89.247:5601/app/kibana#/home?_g=()

四、下载安装logstash

[root@jiaxin src]# wget https://artifacts.elastic.co/downloads/logstash/logstash-6.5.4.tar.gz
[root@jiaxin src]# mv logstash-6.5.4 /usr/local/logstash
[root@jiaxin src]# cd /usr/local/logstash/
[root@jiaxin logstash]# vim config/logstash.yml
http.host: "0.0.0.0"

[root@jiaxin logstash]# vim nginx.conf

input {
        beats {
                port => 5044
        }
}

output {
        elasticsearch {
                hosts => ["127.0.0.1:9200"]
                index => "haha"
        }
}

[root@jiaxin logstash]# ./bin/logstash -f nginx.conf

五、客户端服务器安装 filebeat

[root@sannian src]# wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.5.4-linux-x86_64.tar.gz
[root@sannian src]# mv filebeat-6.5.4-linux-x86_64 /usr/local/filebeat
[root@sannian src]# cd /usr/local/filebeat/

[root@sannian filebeat]# vim filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  multiline.pattern: '^baseLog INFO'
  multiline.negate: true
  multiline.match: after
  paths:
    - /work/var/baseLog/*.log

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 5

output.logstash:
  hosts: ["47.99.89.247:5044"]

[root@sannian filebeat]# /usr/local/filebeat/filebeat -e -c /usr/local/filebeat/filebeat.yml

ELK搭建