Centos6 下安裝 ELK6.4.1

標籤：net   min   basic   wget   call   its   att   rac   jar   

資源路徑
JAVA
http://www.oracle.com/technetwork/java/javase/downloads/jre8-downloads-2133155.html

ELK
https://www.elastic.co/

安裝目錄：
/usr/local/elasticsearch
/usr/local/logstash
/usr/local/kibana

服務端安裝

一、JDK安裝
1、上傳JDK8
rz
2、解壓JDK8
tar -zxvf jdk-8u181-linux-x64.tar.gz
3、將JDK移動到/usr/local/java
cp -r jdk1.8.0_181 /usr/local/java
4、修改環境變數
vim /etc/profile

export JAVA_HOME=/usr/local/javaexport PATH=$PATH:$JAVA_HOME/binexport CLASSPATH=.:$JAVA_HOME/lib/tools.jar:$JAVA_HOME/lib/dt.jar:$CLASSPATH

5、使改變生效並檢測版本
source /etc/profile
java -version

二、安裝ELK
1、上傳並解壓
tar -zxvf elasticsearch-6.4.1.tar.gz
tar -zxvf logstash-6.4.1.tar.gz
tar -zxvf kibana-6.4.1-linux-x86_64.tar.gz

mv elasticsearch-6.4.1 /usr/local/elasticsearch
mv logstash-6.4.1 /usr/local/logstash
mv kibana-6.4.1-linux-x86_64 /usr/local/kibana

2、修改許可權（elasticsearch不能以root使用者運行）
useradd elk
passwd elk
chkown -R elk.elk /usr/local/elasticsearch
chown -R elk.elk /usr/local/elasticsearch

3、修改配置：
修改檔案描述符：ulimited
vim /etc/security/limits.conf
elk soft nofile 102400
elk hard nofile 102400
其他也為 102400

vim /etc/security/limits.d/90-nproc.conf

• soft nproc 65535

修改/etc/sysctl.conf設定檔，添加
vm.max_map_count=262144
需要重啟機器

elasticsearch.yml:注意要在Network下面: network.host: 0.0.0.0http.port: 9200在elasticsearch.yml中配置bootstrap.system_call_filter為false，注意要在Memory下面:  bootstrap.memory_lock: false  bootstrap.system_call_filter: falsekibana/config/kibana.yml    server.host: "10.10.10.101"    elasticsearch.url: "http://10.10.10.100:9200"

4、運行
elasticsearch:(注意，儲存nohup.out的目錄，elk必須有寫入許可權)
su elk
nohup /usr/local/elasticsearch/bin/elasticsearch &

kibana:nohup /usr/local/kibana/bin/kibana &logstash：（如果不加入redis，可以不用這個）nohup /usr/local/logstash/bin/logstash agent -f ../conf/logstash.conf &

5、安裝Nginx並配置
在 location/ 下增加

    auth_basic "secret";    auth_basic_user_file /data/nginx/db/passwd.db;建立認證資料檔案    htpasswd -c /usr/opt/nginx/passwd.db root如果沒有htpasswd,則要安裝httpd    yum -y install httpd 

用戶端安裝

安裝目錄：
/usr/local/logstash

運行目錄：
/data/ELK/logstash

配置目錄：
/data/ELK/logstash/conf

一、JDK安裝
1、上傳JDK8
rz
2、解壓JDK8
tar -zxvf jdk-8u181-linux-x64.tar.gz
3、將JDK移動到/usr/local/java
cp -r jdk1.8.0_181 /usr/local/java
4、修改環境變數
vim /etc/profile

export JAVA_HOME=/usr/local/javaexport PATH=$PATH:$JAVA_HOME/binexport CLASSPATH=.:$JAVA_HOME/lib/tools.jar:$JAVA_HOME/lib/dt.jar:$CLASSPATH

5、使改變生效並檢測版本
source /etc/profile
java -version

二、安裝ELK
1、上傳並解壓
tar -zxvf logstash-6.4.1.tar.gz
mv logstash-6.4.1 /usr/local/logstash

2、配置logstash
logstash_nginx.conf內容
input {
file {
add_field => {"server_name"=>"nginx_33"}
path => [ "/data/nginx_log/*access.log" ]
start_position => "beginning"
ignore_older => 0
}
}

filter {
grok {
patterns_dir => ["/data/ELK/logstash/conf/patterns"]
match => { "message" => "%{NGINXACCESS}" }

}geoip {  source => "clientip"  target => "geoip"  database => "/data/ELK/logstash/conf/GeoLite2-City.mmdb"  fields => ["country_name","region_code", "city_name", "ip"]  #add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]  #add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]}mutate {#  convert => [ "[geoip][coordinates]", "float" ]  convert => [ "response","integer" ]  convert => [ "bytes","integer" ]  replace => { "type" => "nginx_access" }  remove_field => "message"}date {  match => [ "timestamp","dd/MMM/yyyy:HH:mm:ss Z"]}mutate {  remove_field => "timestamp"}

}
output {
elasticsearch {
hosts => ["10.10.10.100:9200"]
index => "logstash-nginx-access-%{+YYYY.MM.dd}"
}
#stdout {codec => rubydebug}
}

/data/ELK/logstash/conf/patterns中nginx 檔案內容：
WZ ([^ ]*)
NGINXACCESS %{IP:clientip} - - [%{HTTPDATE:timestamp}] "%{WORD:method} %{WZ:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:status} %{NUMBER:bytes} %{QS:referer} %{QS:agent} %{QS:xforward}

GeoLite2cd /data/ELK/logstash/confwget http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.tar.gztar zxvf GeoLite2-City.tar.gzcp GeoLite2-City_20180911/GeoLite2-City.mmdb ./

3、運行
nohup /usr/local/logstash/bin/logstash -f conf/logstash_nginx.conf &

Centos6 下安裝 ELK6.4.1