CentOS6.5 Build Elk Suite to build log analysis and monitoring platform

1 Overview

The ELK kit (ELK stack) refers to the three-piece set of Elasticsearch, Logstash, and Kibana. These three software can form a set of log analysis and monitoring tools.

2 Environment Preparation 2.1 Firewall Configuration

In order to use HTTP services normally, you need to shut down the firewall: [plain] view plain Copy # service iptables stop

Or you can not turn off the firewall, but open the relevant port in iptables: [plain] view plain copy # vim/etc/sysconfig/iptables-a input-m State-- State new-m tcp-p TCP--dport 80-j accept-a input-m State--state new-m tcp-p TCP--dport 9200-j accept-a INP Ut-m State--state new-m tcp-p TCP--dport 9292-j ACCEPT # service iptables restart 3 installing JDK

Elasticsearch and Logstash depend on the JDK, so the JDK needs to be installed: [plain] view Plain Copy # yum-y install java-1.7.0-openjdk* # java -version

4 Installing Elasticsearch

Elasticsearch the default HTTP port for the external service is 9200, and the TCP port that interacts between nodes is 9300.

Download Elasticsearch:[Plain]View Plain Copy # mkdir-p/opt/software && cd/opt/software # sudo wget https://download.elasticsearch.org/ela  sticsearch/elasticsearch/elasticsearch-1.4.2.tar.gz # sudo tar-zxvf elasticsearch-1.4.2.tar.gz-c/usr/local/# ln-s /usr/local/elasticsearch-1.4.2/usr/local/elasticsearch install Elasticsearch-servicewrapper and start the Elasticsearch service:
[Plain]View plain copy # sudo wget https://github.com/elasticsearch/elasticsearch-servicewrapper/archive/master.tar.gz # sudo TAR-ZXVF Master # mv/opt/software/elasticsearch-servicewrapper-master/service/usr/local/elasticsearch/bin/#/usr/ Local/elasticsearch/bin/service/elasticsearch Start Test Elasticsearch service is normal, expected to return 200 of the status code:
[Plain]View Plain Copy # Curl-x GET http://localhost:92005 Installing Logstash

Logstash the default port for external services is 9292.

Download Logstash:[Plain]View plain copy # sudo wget https://download.elasticsearch.org/logstash/logstash/logstash-1.4.2.tar.gz # sudo tar-zxvf Logstash-1.4.2.tar.gz-c/usr/local/# ln-s/usr/local/logstash-1.4.2/usr/local/logstash simple test Logstash service is normal, expected to be input The content is printed on the interface in a simple log format:
[Plain]View Plain Copy #/usr/local/logstash/bin/logstash-e ' input {stdin {}} ' output {stdout {}} ' creates a Logstash configuration file and tests the LO Gstash the service is normal, it is expected that the input content can be printed on the interface in a structured log form:
[Plain]  View Plain  copy # mkdir -p /usr/local/logstash/etc   # vim /usr/ local/logstash/etc/hello_search.conf   input {     stdin {       type =>  "Human"      }  }