ELK日誌即時分析系統

標籤：

logstash:https://download.elastic.co/logstash/logstash/logstash-2.2.2.tar.gz

elasticsearch:https://download.elasticsearch.org/elasticsearch/release/org/elasticsearch/distribution/tar/elasticsearch/2.2.0/elasticsearch-2.2.0.tar.gz

kibana:https://download.elastic.co/kibana/kibana/kibana-4.4.0-linux-x64.tar.gz

安裝JDK環境

yum install -y java-1.8.0-openjdk

關閉防火牆

service iptables stop

安裝elasticsearch

elasticsearch要用非root使用者運行

groupadd hadoop

useradd -g hadoop hadoop

wget https://download.elasticsearch.org/elasticsearch/release/org/elasticsearch/distribution/tar/elasticsearch/2.2.0/elasticsearch-2.2.0.tar.gz

下載外掛程式

./bin/plugin install mobz/elasticsearch-head

./bin/plugin install lmenezes/elasticsearch-kopf

修改elasticsearch.yml配置

cluster.name: es_cluster
node.name: node-1
path.data: /home/hadoop/elasticsearch/data
path.logs: /home/hadoop/elasticsearch/logs
network.host: 192.168.233.131
network.port: 9200

檢測安裝是否成功

curl http://192.168.233.131:9200/

開啟http://ip:9200/_plugin/head、http://ip:9200/_plugin/kopf可查看叢集狀態

 

安裝kibana

wget https://download.elastic.co/kibana/kibana/kibana-4.4.0-linux-x64.tar.gz

修改kibana.yml配置（主要修改elasticsearch的IP）

開啟ip:5601查看是否安裝成功

安裝logstash

wget https://download.elastic.co/logstash/logstash/logstash-2.2.2.tar.gz

簡單的logstash配置

input { stdin{}}
output {
elasticsearch { hosts=> ‘192.168.233.131‘ }
}

 

 

注意：1、logstash要有資料傳到elasticsearch才能在kibana中建立索引

　　　2、elasticsearch叢集變成yellow狀態，可用以下命令處理

curl -XPUT "http://localhost:9200/_settings" -d‘
{
"number_of_replicas" : 0
}‘

ELK日誌即時分析系統