实现elk冷热日志分离

实现elk冷热日志分离

方法一：

修改elasticsearch.yml配置文件的信息如下所示：

Master-node1 节点文件信息如下所示：

[root@master-node1 ~]# cat /etc/elasticsearch/elasticsearch.yml | grep -v "#" | grep -v "^$"

cluster.name: "es"

node.name: "master-node1"

node.master: true

node.data: true

node.attr.box_type: "hot"

cluster.routing.allocation.node_initial_primaries_recoveries: 4

cluster.routing.allocation.node_concurrent_recoveries: 4

transport.tcp.compress: true

path.data: /var/lib/elasticsearch

path.logs: /var/log/elasticsearch

network.host: 0.0.0.0

http.port: 9200

discovery.zen.ping.unicast.hosts: ["192.168.101.17", "192.168.101.23","192.168.101.16"]