ELK-MAC Environment Construction

ELK-MAC Environment Construction

This article aims to record the installation and startup of Elasticsearch, Logstash, Kibana under Mac.

Prerequisite

• Java8
• Mac Software Management tool brew

Brew-related commands

# 安装软件brew install your-software# 查看软件安装信息brew info your-software# 管理服务，没怎么用它，ELK都有自己的启动脚本在安装目录的bin/下面，且基本上都会携带参数启动brew services start/stop your-service

Elasticsearch

Mac installation Elasticsearch

# mac安装elasticsearchbrew install elasticsearch

Elasticsearch of the relevant installation location

Installation directory:/usr/local/cellar/elasticsearch/{elasticsearch-version}/

Log directory:/usr/local/var/log/elasticsearch/

Plugin directory:/usr/local/var/elasticsearch/plugins/

Configuration directory:/usr/local/etc/elasticsearch/

After the installation is complete Elasticsearch, you can invoke it by brew services start elasticsearch starting it and then requesting the rest API via Curl

First boot, the default port number is 9200, the user name is elastic, password I do not know (the data is found in the 6.0 previous version, password is not clear after the changeme,6.0), by calling the _xpack interface to modify the default password:

# 如果不是第一次修改，则需要输入当前密码才能进行密码修改curl‘localhost:9200/_xpack/security/user/elastic/_password‘"Content-Type: application/json"‘{"password":"123456"}‘

Kibana

# mac安装kibanabrew install kibana

Kibana of the relevant installation location

Installation directory:/usr/local/cellar/kibana/{kibana-version}/

Configuration directory:/usr/local/etc/kibana/

Before starting Kibana, you need to modify the configuration file /usr/local/etc/kibana/kibana.yml, Uncomment Elasticsearch.name and Elasticsearch.password, and change the value to the user name password username:elastic, password:123456, as modified above. Please refer to the KIBANA.YML fragment below

# kibana.yml# If your Elasticsearch is protected with basic authentication, these settings provide# the username and password that the Kibana server uses to perform maintenance on the Kibana# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which# is proxied through the Kibana server.elasticsearch.username"elastic"elasticsearch.password"changeme"

by brew services start kibana starting it

First boot, the default port number is 5601, open the browser access to the http://localhost:5601 Kibana Management page, the box will require the user name password input, enter elastic and 123456.

Note: The user name password configured in KIBANA.YML here is Kibana access elasticsearch need to use, and the Web page manually entered the user name password is our login Kibana Management page password, why they can share a password, not very clear

Pit: If you do not configure KIBANA.YML, although you can login successfully kibana, but in the Kibana page nothing can not access, it will prompt you elasticsearch authentication failed!

Logstash

# mac安装logstashbrew install logstash

Logstash of the relevant installation location

Installation directory:/usr/local/cellar/logstash/{logstash-version}/

Start Related: Reference notes

Filebeat

# mac安装filebeatbrew install filebeat

Filebeat of the relevant installation location

Installation directory:/usr/local/cellar/filebeat/{filebeat-version}/

Configuration directory:/usr/local/etc/filebeat/

Cache directory:/usr/local/var/lib/filebeat/

Start Related: Reference notes

Note

Because Logstash's start-up is about many concepts such as piping, input, output, filters, and so on, I am here to refer to the official documentation, written very clearly: Getting-started-with-logstash, Spoke of Logstash combined filebeat to parse Apache log files into a structured data store to Elasticsearch

ELK-MAC Environment Construction