ELK日志分析平台

Elasticsearch官网
环境
172.25.16.1 server1
172.25.16.2 server2
172.25.16.3 server3

Elasticsearch安装

在官网下载 Elasticsearch
7.6及以上版本 自带jdk

安装完成，修改文件

vi /etc/elasticsearch/elasticsearch.yml
17 cluster.name: my-es
23 node.name: server1
33 path.data: /var/lib/elasticsearch
37 path.logs: /var/log/elasticsearch
 43 bootstrap.memory_lock: true
 55 network.host: 172.25.16.1
 59 http.port: 9200
 61 http.cors.enabled: true
 62 http.cors.allow-origin: "*"
71 discovery.seed_hosts: ["server1", "server2","server3"]
72 cluster.initial_master_nodes: ["server1", "server2","server3"]
 //其他参数修改，可见官网
 //三台主机均以上配置，设计ip及主机名使用这个本机ip

vim /usr/lib/systemd/system/elasticsearch.service
  36 LimitMEMLOCK=infinity

 62 elasticsearch soft memlock unlimited
 63 elasticsearch hard memlock unlimited
 64 elasticsearch  -    nofile 65536
 65 elasticsearch  -    nproc 65536

ssh-keygen
ssh-copy-id server2
ssh-copy-id server3
scp /etc/elasticsearch/elasticsearch.yml server2:/etc/elasticsearch/elasticsearch.yml
scp  /usr/lib/systemd/system/elasticsearch.service server2:/usr/lib/systemd/system/elasticsearch.service
scp /etc/security/limits.conf server2:/etc/security/limits.conf
//把这些文件分发到server2，server3中
//可以选择启动节点也可以选择不启动，等配置elk可视化的节点管理完成后，再启动

配置elk可视化的节点管理

需要的安装包：
nodejs-9.11.2-1nodesource.x86_64.rpm
phantomjs-2.1.1-linux-x86_64.tar.bz2
fontconfig.x86_64

rpm -ivh nodejs-9.11.2-1nodesource.x86_64.rpm
yum install -y unzip
yum install -y bzip2
tar jxf phantomjs-2.1.1-linux-x86_64.tar.bz2
cd phantomjs-2.1.1-linux-x86_64
cd bin
cd phantomjs
cp phantomjs /usr/local/bin
yum install -y fontconfig.x86_64 
cd 7.6/
unzip master.zip
cd elasticsearch-head-master
npm install //因为我已经安装了依赖性的包，如果你没有安装，需要自己下载
// --registry=https://registry.npm.taobao.org
cd  _site/
vim app.js
http://172.25.16.1:9200
npm run start &

重启服务

systemctl daemon-reload
systemctl restart elasticsearch

elasticsearch的优化

在server3上停掉elasticsearch