Elk Platform Construction ES

System environment:

System:centos 6.5

elasticsearch:2.3.3

logstash:2.3.3

kibana:4.5.1

Java:jdk_1.8.0_71

New User:

Elk does not allow root user to start

#useradd Elk

JDK or JRE download installation:

Java can also be downloaded to this address https://www.reucon.com/cdn/java/

# mkdir/usr/java/# cd/usr/java# TAR-ZXVF jdk-8u71-linux-x64.tar.gz

# Modify folder names, prevent exceptions, develop good habits # MV jdk1.8.0_71 jdk18071# Configuring environment Variables # Vi/etc/profile export java_home=/usr/java/jdk18071 export JAV a_bin= $JAVA _home/bin export jre_home= $JAVA _home/jre export jre_bin= $JRE _home/bin export classpath=.: $JAVA _home/li B: $JRE _home/lib export path= $JAVA _bin: $PATH # Configuration Effective # Source/etc/profile

Redis Installation

# yum Install epel-release–y# yum install Redis–y

Modify the Redis profile to enable Redis to listen on all IPs, by default, only listen 127.0.0.01

# vi/etc/redis.conf Bind 0.0.0.0

Start Redis

CentOS 6

# service Redis Start

CentOS 7

# systemctl Restart Redis.service

Download:

Elk Download:https://www.elastic.co/downloads/

650) this.width=650; "Src=" Http://s2.51cto.com/wyfs02/M02/83/31/wKiom1dsz-CieVOVAAEYEzx-v0s956.png-wh_500x0-wm_3 -wmp_4-s_3067730089.png "title=" 123318_ihwc_1434710.png "alt=" Wkiom1dsz-cievovaaeyezx-v0s956.png-wh_50 "/>

Elasticsearch Installation:

To create a storage directory:

elasticsearch directories and files, be sure to fully modify permissions, otherwise start will error.

# mkdir-p/elk/{data,logs,work,plugins,scripts}# chown-r Elk:elk/elk

Configuration Elasticsearch:

# TAR-ZXVF elasticsearch-2.3.3.tar.gz# chown-r elk:elk elasticsearch-2.3.3# cd elasticsearch-2.3.3

Install Head plug-in (Optional):

#./bin/plugin Install Mobz/elasticsearch-head

650) this.width=650; "src=" Http://s1.51cto.com/wyfs02/M00/83/31/wKioL1ds0I_Dfs0YAACTX2xuGnc271.png "title=" 123433 _8vxm_1434710.png "alt=" Wkiol1ds0i_dfs0yaactx2xugnc271.png "/>

Then edit the ES configuration file:

# VI Config/elasticsearch.yml

Modify the following configuration items:

Cluster.name:cluster (cluster name) Node.name: "Test-node1" (cluster node name) path.data:/elk/data (data) path.logs:/elk/logs (log path) Node.master:true (whether it can be selected as the primary node, default true) Node.data:true (whether the node stores data, default true) index.number_of_shards:5 (number of indexed shards) Index.number_ Of_replicas:1 (number of index copies) transport.tcp.port:9300 (data transfer IP) network.host:192.168.1.100 (current hostname or IP, I am here IP) Http.port: 9200 (External access monitoring IP)

Start es:

Use CTRL + C to stop, parameter-D or & for background boot

$./bin/elasticsearch-d

$./bin/elasticsearch &

Test:

Curl-x GET http://IP:9200

Returns information that shows the configuration of Cluster_Name and name, as well as the version of ES installed.

Just installed head plugin, it is a browser with the ES cluster interaction plug-in, you can view the status of the cluster, the doc content of the cluster, perform search and ordinary rest requests.

You can now also use it to open the Http://IP:9200/_plugin/head page to see the ES cluster status.

650) this.width=650; "src=" Http://s5.51cto.com/wyfs02/M00/83/3B/wKioL1ds-ZHgWnCNAACfMEgaqm4147.png "title=" 124024 _bnow_1434710.png "alt=" Wkiol1ds-zhgwncnaacfmegaqm4147.png "/> can see that, now, there is no index in the ES cluster, there is no type, so these two are empty.

Logstash Installation:

Configuration Logstash:

TAR-ZXVF LOGSTASH-2.1.1.TAR.GZCD logstash-2.1.1

Write the configuration file (name and location can be arbitrary, here I put in config directory, named log4j_to_es.conf):

mkdir Configvi config/log4j_to_es.conf

Enter the following:

# for detail structure of this file# set: https://www.elastic.co/guide /en/logstash/current/configuration-file-structure.htmlinput {  # for detail  config for log4j as input,   # see: https://www.elastic.co/guide/ En/logstash/current/plugins-inputs-log4j.html  log4j {    mode =>   "Server"     host =>  "192.168.1.100"   #IP  or hostname     port => 4567  }}filter {   #Only  matched  data are send to output.} Output {  # for detail config for elasticsearch as output,    # see: https://www.elastic.co/guide/en/logstash/current/ plugins-outputs-elasticsearch.html  elasticsearch {    action =>& nbsp;" Index            #The  operation on ES     hosts  =>  "192.168.1.100:9200"   #IP  or hostname, elasticsearch host, can be array.    index  =>  " Applog "          #The  index to write data  to.  }}

Start:

Use the agent to start it (Specify the configuration file with-F):

./bin/logstash Agent-f config/log4j_to_es.conf

Startup success

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M00/83/3C/wKiom1dtBNSS152DAABM913Yarw032.png "title=" 124427 _bwlm_1434710.png "alt=" Wkiom1dtbnss152daabm913yarw032.png "/>

Reference article:

http://my.oschina.net/itblog/blog/547250

http://blog.csdn.net/gongzi2311/article/details/51699958

http://blog.csdn.net/laoyang360/article/details/51417097

This article is from the "Enlightened Grocery store" blog, please be sure to keep this source http://wutou.blog.51cto.com/615096/1792548

Elk Platform Construction ES