Elk Log Analysis System Logstash+elasticsearch+kibana4

Elk Log Analysis System

Logstash+elasticsearch+kibana4

• Logstash tools for managing logs and events
• ElasticSearch Search
• KIBANA4 Powerful data Display client
• Redis Cache

Install package

• logstash-1.4.2-1_2c0f5a1.noarch.rpm
• elasticsearch-1.4.4.noarch.rpm
• logstash-contrib-1.4.2-1_efd53ef.noarch.rpm
• Kibana-4.0.1-linux-x64.tar.gz

Installing the JDK

OPENJDK or Oracle's JDK is available.
Here with OpenJDK.

install java-1.7.0-openjdk

Installing Redis

yum install redis/etc/init.d/redis start查看redis中的键值redis-cli‘*‘

Installation Test Elasticsearch

RPM-IVH elasticsearch-1.4. 4. noarch.rpm Confirm9200Port monitoring has a normal return value: Curl-x GET http://localhost:9200[Root@iZ28ywqw7nhz ~]# curl-x GET http://localhost:9200{"Status": $,"Name":"Damballah","Cluster_Name":"Elasticsearch","Version": {"Number":"1.4.4","Build_hash":"c88f77ffc81301dfa9dfd81ca2232f09588bd512","Build_timestamp":"2015-02-19t13:05:36z","Build_snapshot":false,"Lucene_version":"4.10.3"},"tagline":"Know, for Search"}

Installing Logstash

rpm -ivh logstash-1.4.2-1_2c0f5a1.noarch.rpm

Logstash Configuration

The simplest is to accept an input and then put it in the output:

-e‘input { stdin { } } output { stdout {} }‘helo2015-03-19T09:09:38.161+0000 iZ28ywqw7nhZ helo

Similar to the following:

-e‘input { stdin { } } output { stdout { codec => rubydebug } }‘

But the above two does not have much practical significance, we can insert the data into the Elasticsearch and then display it with Kibana.

1. First, make sure that Elasticsearch starts, 9200 listens.
2. Then insert the data:

/opt/logstash/bin/logstash  -e‘input { stdin { } } output { elasticsearch { host => localhost } }‘

You can then use Kibana to view
or access
Curl ' Http://localhost:9200/_search?pretty ' to view data

Download Kibana, run

Kibana is a Java package.

-xf kibana-4.0.1-linux-x64.tar.> kibana.log&

Inside the configuration index patterns, with the default on the line.

Postscript

Basically elk are connected with the official website is the same, for example, Elasticsearch is generally from the logstash above the data. Kibana defaults to fetching data from the Elasticsearch. The three of them are very well combined.
More features are being explored. Elk very powerful Data collection query analysis open source solution.

Http://logstash.net/docs/1.4.2/tutorials/getting-started-with-logstash

Http://www.cnblogs.com/buzzlight/p/logstash_elasticsearch_kibana_log.html

Logstash Best Practices

Upgrade Required Your version of Elasticsearch is too old. Kibana requires Elasticsearch 0.90.9 or above.
Init:tty (/DEV/TTY4) main process killed by KILL signal

List all Indexs
Curl ' localhost:9200/_cat/indices?v '

Delete

Curl-xdelete ' Localhost:9200/customer?pretty '
Curl ' localhost:9200/_cat/indices?v '

Http://www.elastic.co/guide/en/elasticsearch/reference/1.x/_index_and_query_a_document.html

Elk Log Analysis System Logstash+elasticsearch+kibana4