ELK6.2.4

1.創建用戶
useradd yinlian
passwd yinlian
創建安裝和數據目錄
mkdir -p /data/tools
chown -R yinlian:yinlian /data/tools 

2.安裝jdk1.8以上
rpm -qa | grep java | xargs rpm -e --nodeps
cd /data/tools
tar xf jdk-8u60-linux-x64.gz 
vi /etc/profile
export JAVA_HOME=/data/tools/jdk1.8.0_60
export PATH=$PATH:$JAVA_HOME/bin
export CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
export PATH=$PATH:/data/elk/node/bin
source /etc/profile
su - yinlian

3.安裝elasticsearch
mkdir -p /data/elk
mkdir -p /data/elk/data
cd /data/tools/
tar xf elasticsearch-6.2.4.tar.gz 
mv elasticsearch-6.2.4   /data/elk/elasticsearch 
cd ../elk/elasticsearch/

配置文件
vi config/elasticsearch.yml 
cluster.name: es_cluster
node.name: node1
path.data: /data/elk/elasticsearch/data
path.logs: /data/elk/elasticsearch/logs
network.host: 192.168.18.20
http.port: 9200
http.cors.enabled: true
http.cors.allow-origin: "*"

安裝插件
tar xf  node-v8.11.2-linux-x64.tar.xz
mv node-v8.11.2-linux-x64 /data/elk/node
node -v 
npm -v
cd /data/elk
git clone git://github.com/mobz/elasticsearch-head.git
cd elasticsearch-head/
npm install cnpm --registry=https://registry.npm.taobao.org
npm install -g grunt-cli
npm install　
vi /data/elk/elasticsearch-head/_site/app.js

啓動命令
nohup /data/elk/elasticsearch-head/node_modules/grunt/bin/grunt server &
nohup /data/elk/elasticsearch/bin/elasticsearch &

加入開機啓動
vi /etc/rc.d/rc.local
su -c "/data/elk/elasticsearch/bin/elasticsearch &" - yinlian

安裝logstash
tar xf logstash-6.2.4.tar.gz
mv logstash-6.2.4 /data/elk/logstash

配置文件
vi logstash_agent_master
  input {
        file {
            path => "/var/log/messages"
            type => "message"
            }
    }
    output {
             elasticsearch {
                    hosts => "192.168.18.11:9200"
                    index => "%{+YYYY.MM.dd}-{system}"
                    document_type => "message"
                }
    }

啓動命令
/data/elk/logstash/bin/logstash -f logstash_agent_master &

加入開機啓動
vi /etc/rc.d/rc.local
su -c "/data/elk/logstash/bin/logstash &" - yinlian

安裝kibana
tar xf kibana-6.2.4-linux-x86_64.tar.gz 
mv kibana-6.2.4-linux-x86_64 /data/elk/kibana

配置文件
vi config/kibana.yml
server.port: 5601
server.host: "192.168.18.11"
elasticsearch.url: "http://192.168.18.11:9200"
elasticsearch.preserveHost: true
kibana.index: ".kibana"

啓動命令
/data/elk/kibana/bin/kibana &

加入開機啓動
vi /etc/rc.d/rc.local
su -c "/data/elk/kibana/bin/kibana &" - yinlian