efk8.0.1部署

1.初始化系统

1.1修改文件限制
vi /etc/security/limits.conf
*       soft nofile 65536
*       hard nofile 65536
*       soft nproc 4096
*       hard nproc 4096

1.2调整虚拟内存 最大并发连接
vim /etc/sysctl.conf 
vm.max_map_count=262144
fs.file-max=655360
vm.swappiness=0 
sysctl -p

1.3安装JDK
vim /etc/profile
export JAVA_HOME=/usr/local/jdk1.8.0_192
export JAVA_BIN=$JAVA_HOME/bin
export JAVA_LIB=$JAVA_HOME/lib
export PATH=$JAVA_HOME/bin:$PATH
export CLASSPATH=.:$JAVA_LIB/tools.jar:$JAVA_LIB/dt.jar 
source /etc/profile 

1.4添加用户
useradd elasticsearch
useradd kibana
useradd filebeat 

2.Elasticsearch

2.1创建软链接 方便后期版本迭代更新
ln -s /home/elasticsearch-8.0.1 /home/elasticsearch 

2.2生成CA证书
 cd /home/elasticsearch/bin
./elasticsearch-certutil ca
./elasticsearch-certutil cert --ca elastic-stack-ca.p12 
复制证书到config 目录

2.3 elasticsearch配置文件
cluster.name: my-application
node.name: 20.58.32.64
path.data: /home/elasticsearch-8.0.1/data
path.logs: /home/elasticsearch-8.0.1/logs
network.host: 0.0.0.0
http.port: 19200
transport.port: 19300
discovery.seed_hosts: ["192.168.133.100:19300"]
cluster.initial_master_nodes: ["20.58.32.64"]
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12 

2.4systemctl 配置管理
cat > /etc/systemd/system/elasticsearch.service <<EOF
[Unit]
Description=elasticsearch
[Service]
User=elasticsearch
Group=elasticsearch
LimitMEMLOCK=infinity
LimitNOFILE=100000
LimitNPROC=100000
ExecStart=/home/elasticsearch/bin/elasticsearch
[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl start elasticsearch
systemctl enable elasticsearch 

2.5设置密码 
./elasticsearch-setup-passwords interactive 


3.Kibana

3.1创建软连接
ln -s /home/kibana-8.0.1-linux-x86_64 /home/kibana 

3.2kibana配置文件
server.host: "20.58.32.64"
server.publicBaseUrl: "http://192.168.133.100:15601"
elasticsearch.hosts: ["http://192.168.133.100:19200"]
server.port: 15601
elasticsearch.username: "elastic"
elasticsearch.password: "QWer12#$,"
i18n.locale: "zh-CN" 


3.3 systemdctl配置管理
vim /etc/systemd/system/kibana.service
[Unit]
Description=kibana
[Service]
User=kibana
Group=kibana
LimitMEMLOCK=infinity
LimitNOFILE=100000
LimitNPROC=100000
ExecStart=/home/kibana/bin/kibana
[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl start kibana
systemctl enable kibana 


4.Filebeat

4.1创建软链接
ln -s /home/filebeat-8.0.1-linux-x86_64 /home/filebeat 

4.2filebeat配置文件
# ================= Filebeat inputs =============
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /app/yxjcjk/api-server/logs/catalina.out
  fields:
    source: "yxjcjk_check"
- type: log
  paths:
    - /app/yxjcjk/sh/logs/jcjk_test_*.log
  fields:
    source: "yxjcjk_test"
  multiline.pattern: '^\['
  multiline.negate: true
  multiline.match: after
# =============== Filebeat modules ================
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
# =============== Elasticsearch template setting ==========
setup.ilm.enabled: false
setup.template.name: "*yxjcjk*"
setup.template.pattern: "*yxjcjk*"
setup.template.enabled: false
setup.template.overwrite: true
setup.template.settings:
  index.number_of_shards: 1
# ================= Kibana ================
setup.kibana:
  host: "192.168.133.100:15601"
  username: "elastic"
  password: "QWer12#$"
# -------------- Elasticsearch Output --------------
output.elasticsearch:
  hosts: ["192.168.133.100:19200"]
  username: "elastic"
  password: "QWer12#$"
  index: "%{[fields.source]}-%{[filds.index]}-*"
  indices:
    - index: yxjcjk_check-%{+yyyy.MM-dd}
      when.equals:
        fields:
          source: "yxjcjk_check"
    - index: yxjcjk_test-%{+yyyy.MM-dd}
      when.equals:
        fields:
          source: "yxjcjk_test"

#multiline.type: pattern
#multiline.pattern: '^\['
#multiline.negate: true
#multiline.match: after

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~
  - drop_fields:
      fields: ["host","ecs.version","agent","input","log"]

vim /etc/systemd/system/filebeat.service

[Unit]
Description=filebeat
[Service]
User=filebeat
Group=filebeat
LimitMEMLOCK=infinity
LimitNOFILE=100000
LimitNPROC=100000
ExecStart=/home/filebeat/filebeat
[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl start filebeat
systemctl enable filebeat



4.3feailbeat连接测试
./filebeat output test
参考EFK官网elastic.co
journalctl -u 查看服务日志