注：/usr/local/src爲源碼安裝包存放目錄。 /data/爲數據存儲、解壓目錄。
準備工作：下載elasticsearch、filebeat、Kibana_Hanization、elasticsearch-head、jdk 、kibana、logstash、node
wget https://download.oracle.com/otn-pub/java/jdk/8u191-b12/2787e4a523244c269598db4e85c51e0c/jdk-8u191-linux-x64.tar.gz
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.5.1.tar.gz
wget https://artifacts.elastic.co/downloads/kibana/kibana-6.5.1-linux-x86_64.tar.gz
wget https://artifacts.elastic.co/downloads/logstash/logstash-6.5.1.tar.gz
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.4.1-linux-x86_64.tar.gz
git clone https://github.com/mobz/elasticsearch-head.git
wget https://npm.taobao.org/mirrors/node/latest-v4.x/node-v4.4.7-linux-x64.tar.gz
git clone https://github.com/anbai-inc/Kibana_Hanization.git
一、 安裝elasticsearch
1.1 安裝Java
[root@localhost data]# rpm -qa |grep java
tzdata-java-2015g-1.el7.noarch
javapackages-tools-3.4.1-11.el7.noarch
java-1.8.0-openjdk-headless-1.8.0.65-3.b17.el7.x86_64
java-1.7.0-openjdk-1.7.0.91-2.6.2.3.el7.x86_64
java-1.8.0-openjdk-1.8.0.65-3.b17.el7.x86_64
java-1.7.0-openjdk-headless-1.7.0.91-2.6.2.3.el7.x86_64
python-javapackages-3.4.1-11.el7.noarch
[root@localhost data]# rpm -e --nodeps java-1.7.0-openjdk-1.7.0.91-2.6.2.3.el7.x86_64
[root@localhost data]# rpm -e --nodeps java-1.7.0-openjdk-headless-1.7.0.91-2.6.2.3.el7.x86_64
[root@localhost data]# rpm -e --nodeps java-1.8.0-openjdk-1.8.0.65-3.b17.el7.x86_64
[root@localhost data]# rpm -e --nodeps java-1.8.0-openjdk-headless-1.8.0.65-3.b17.el7.x86_64
[root@localhost data]# rpm -qa |grep java
tzdata-java-2015g-1.el7.noarch
javapackages-tools-3.4.1-11.el7.noarch
python-javapackages-3.4.1-11.el7.noarch
[root@localhost ~]# mkdir /data
[root@localhost src]# tar xf jdk-8u191-linux-x64.tar.gz -C /data/
[root@localhost jdk]# vim /etc/profile
在末尾添加以下內容
export JAVA_HOME=/data/jdk
export JAVA_BIN=/data/jdk/bin
export JAVA_LIB=/data/jdk/lib
export JAVA_JRE=/data/jdk/jre
[root@localhost jdk]# ln -s /data/jdk/bin/java /usr/bin/
[root@localhost jdk]# java -version
java version "1.8.0_191"
Java(TM) SE Runtime Environment (build 1.8.0_191-b12)
Java HotSpot(TM) 64-Bit Server VM (build 25.191-b12, mixed mode)
[root@localhost config]# mkdir /data/{es-data,es-logs}
修改配置文件，注意“：”後面有空格，
[root@localhost config]# vim elasticsearch.yml
path.data: /data/es-data
path.logs: /data/es-logs
network.host: 0.0.0.0
http.port: 9200
在network項最後添加，後面要調用到以下信息，所以一起添加。但是在啓動elasticsearch時會報錯，所以添加時記得註銷掉，在前面添加“#”，這樣啓動elasticsearch就不會報錯了。在安裝elasticsearch-head後再取消“#”就可以了。
http.cors.enabled:true
http.cors.allow-origin:""
**後面安裝elasticsearch-head-master需要調用到**
[root@localhost data]# vim /etc/security/limits.conf*
在最後添加以下信息， ***
soft nofile 65536
* hard nofile 65536
* soft nproc 65536**
*** hard nproc 65536
[root@localhost data]# vim /etc/sysctl.conf
添加以下內容
vm.max_map_count=655360
保存後執行下
[root@localhost data]# sysctl -p
修改完後需要重啓，因爲修改limits.conf內容需要重啓才能生效。
[root@localhost data]# reboot
修改權限，由於不能用root用戶運行，需要創建新用戶，並授權。
[root@localhost data]# chown -R elk:elk elasticsearch
[root@localhost data]# chown -R elk:elk es-data
[root@localhost data]# chown -R elk:elk es-logs
重新登錄，切換普通用戶
[root@localhost config]# su elk
[elk@localhost config]$ cd ..
運行elasticsearch
[elk@localhost elasticsearch]$ bin/elasticsearch
檢查是否啓動成功
查看監聽端口
[root@localhost ~]# netstat -ntlp |grep java
tcp6 0 0 :::9200 ::: LISTEN 3469/java
tcp6 0 0 :::9300 ::: LISTEN 3469/java
說明正常啓動
在沒有關閉防火牆的情況下，記得開放9200、9300和9100（elasticsearch-head-master用的）所以一起開放了
[root@localhost ~]# firewall-cmd --zone=public --add-port=9200/tcp --permanent
success
[root@localhost ~]# firewall-cmd --zone=public --add-port=9300/tcp --permanent
success
[root@localhost ~]# firewall-cmd --zone=public --add-port=9100/tcp --permanent
success
[root@localhost ~]# firewall-cmd --reload
success
[root@localhost ~]#
URL測試
[root@localhost ~]# curl 172.16.41.32:9200
{
"name" : "g79q1--",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "On9wUDkERpmJDcbql6jEkw",
"version" : {
"number" : "6.5.1",
"build_flavor" : "default",
"build_type" : "tar",
"build_hash" : "8c58350",
"build_date" : "2018-11-16T02:22:42.182257Z",
"build_snapshot" : false,
"lucene_version" : "7.5.0",
"minimum_wire_compatibility_version" : "5.6.0",
"minimum_index_compatibility_version" : "5.0.0"
},
"tagline" : "You Know, for Search"
}
[root@localhost ~]#
正常返回數據說明服務正常使用。
1.2 下面開始安裝elasticsearch-head-master，由於elasticsearch沒有網頁界面所以需要安裝這個插件
下載elasticsearch-head
[root@localhost data]# git clone https://github.com/mobz/elasticsearch-head.git
或
[root@localhost data]# wget https://github.com/mobz/elasticsearch-head/archive/master.zip
下載elasticsearch-head依賴插件node
[root@localhost src]# wget https://npm.taobao.org/mirrors/node/latest-v4.x/node-v4.4.7-linux-x64.tar.gz
[root@localhost src]# tar xf node-v4.4.7-linux-x64.tar.gz -C /data/
[root@localhost data]# cd elasticsearch-head/
[root@localhost elasticsearch-head]# vim Gruntfile.js
在connect項添加“hostname: '主機IP'”，注意在keeplive: true後面記得加上“，”及“:”後面加空格。否則啓動服務時會報語法錯誤。
connect: {
server: {
options: {
port: 9100,
base: '.',
keepalive: true,
hostname: '172.16.41.32',
}
}
}
添加node環境變量
[root@localhost node]# vim /etc/profile
添加以下內容
export NODE_HOME=/data/node
export NODE_PATH=/data/node/lib/node_modules
export PATH=$NODE_HOME/bin:$NODE_PATH:$PATH
修改完profile文件記得讓配置生效
[root@localhost node]# source /etc/profile
把之前添加的兩條命令前的“#”去掉，注意：“:”後面有空格
[root@localhost config]# vim elasticsearch.yml
http.cors.enabled: true
http.cors.allow-origin: ""
進入到elasticsearch-head的安裝目錄，因爲elasticsearch-head是通過grunt啓動的，所以需要安裝grunt插件
[root@localhost elasticsearch-head]# npm install -g grunt-cli
npm WARN engine [email protected]: wanted: {"node":">= 4.5.0"} (current: {"node":"4.4.7","npm":"2.15.8"})
/data/node/bin/grunt -> /data/node/lib/node_modules/grunt-cli/bin/grunt
[email protected] /data/node/lib/node_modules/grunt-cli
├── [email protected]
├── [email protected]
├── [email protected] ([email protected])
├── [email protected] ([email protected], [email protected])
└── [email protected] ([email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected])
[root@localhost elasticsearch-head]#
在elasticsearch-head目錄下面執行命令下載所有的依賴
[root@localhost elasticsearch-head]# npm install
[email protected] node_modules/grunt-contrib-jasmine
├── [email protected]
├── [email protected]
├── [email protected] ([email protected], [email protected], [email protected], [email protected], [email protected])
├── [email protected]
├── [email protected]
├── [email protected] ([email protected])
└── [email protected] ([email protected], [email protected], [email protected], [email protected])
[root@localhost elasticsearch-head]#
通過後臺進程進行啓動
[root@localhost elasticsearch-head]# nohup grunt server &
[1] 5254
[root@localhost elasticsearch-head]# nohup: 忽略輸入並把輸出追加到"nohup.out"
現在可以通過網頁進行瀏覽
默認這裏會顯示“集羣健康值：未連接”，不要緊張，我們只需要將“localhost”修改成主機IP地址，點擊“連接”就可以顯示正常了。
到此elasticsearch配置完成。
二、 logstasho安裝
2.1 手動安裝logstash
在logstash/config目錄創建一個.conf配置文件，名字自己定義。我這使用的是default.conf，添加以下內容：
#監聽5044端口作爲輸入
input {
beats {
port => "5044"
}
}
#數據過濾
filter {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
geoip {
source => "clientip"
}
#輸出配置爲本機的9200端口，這是ElasticSerach服務的監聽端口
output {
elasticsearch {
hosts => ["本機IP地址:9200"]
}
}
~
進入filebeat插件目錄
[root@localhost data]# cd filebeat/
後臺啓動
[root@localhost filebeat]# ./filebeat &
查看啓動情況
[root@localhost filebeat]# ps -ef |grep filebeat
root 70376 48524 0 16:19 pts/3 00:00:00 ./filebeat
root 70391 48524 0 16:20 pts/3 00:00:00 grep --color=auto filebeat
[root@localhost filebeat]# tail logs/filebeat
2018-11-27T16:19:36+08:00 INFO Loading Prospectors: 1
2018-11-27T16:19:36+08:00 INFO Prospector with previous states loaded: 5
2018-11-27T16:19:36+08:00 INFO Starting Registrar
2018-11-27T16:19:36+08:00 INFO Starting prospector of type: log; id: 17005676086519951868
2018-11-27T16:19:36+08:00 INFO Start sending events to output
2018-11-27T16:19:36+08:00 INFO Loading and starting Prospectors completed. Enabled prospectors: 1
2018-11-27T16:19:36+08:00 INFO Starting spooler: spool_size: 2048; idle_timeout: 5s
2018-11-27T16:20:06+08:00 INFO Non-zero metrics in the last 30s: publish.events=5 registrar.states.current=5 registrar.states.update=5 registrar.writes=1
2018-11-27T16:20:36+08:00 INFO No non-zero metrics in the last 30s
2018-11-27T16:21:06+08:00 INFO No non-zero metrics in the last 30s
啓動正常
開放端口
[root@localhost logstash]# firewall-cmd --add-port=5044/tcp --permanent
success
[root@localhost logstash]# firewall-cmd --add-port=9600/tcp --permanent
success
[root@localhost logstash]# firewall-cmd --reload
配置path.data路徑，要不然啓動logstash會報錯
[root@localhost logstash]# bin/logstash -f config-mysql-path.data=/data/es-logstash-log
後臺啓動logstash
[root@localhost logstash]# bin/logstash -f config/default.conf &
查看監聽信息
[root@localhost config]# netstat -ntlup
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 172.16.41.32:9100 0.0.0.0: LISTEN 47943/grunt
tcp 0 0 192.168.122.1:53 0.0.0.0: LISTEN 2854/dnsmasq
tcp 0 0 0.0.0.0:22 0.0.0.0: LISTEN 1566/sshd
tcp 0 0 127.0.0.1:631 0.0.0.0: LISTEN 1571/cupsd
tcp 0 0 127.0.0.1:25 0.0.0.0: LISTEN 2070/master
tcp 0 0 172.16.41.32:5601 0.0.0.0: LISTEN 73103/bin/../node/b
tcp6 0 0 :::9200 ::: LISTEN 48329/java
tcp6 0 0 :::5044 ::: LISTEN 71717/java
tcp6 0 0 :::9300 ::: LISTEN 48329/java
tcp6 0 0 :::22 ::: LISTEN 1566/sshd
tcp6 0 0 ::1:631 ::: LISTEN 1571/cupsd
tcp6 0 0 ::1:25 ::: LISTEN 2070/master
tcp6 0 0 127.0.0.1:9600 ::: LISTEN 71717/java
udp 0 0 192.168.122.1:53 0.0.0.0: 2854/dnsmasq
udp 0 0 0.0.0.0:67 0.0.0.0: 2854/dnsmasq
udp 0 0 0.0.0.0:53381 0.0.0.0: 939/avahi-daemon: r
udp 0 0 0.0.0.0:5353 0.0.0.0: 939/avahi-daemon: r
udp 0 0 127.0.0.1:323 0.0.0.0: 960/chronyd
udp6 0 0 ::1:323 ::: 960/chronyd
[root@localhost config]#
測試logstash訪問情況，結尾返回以下內容說明logstash正常啓動。
[root@localhost elasticsearch]# curl http://172.16.41.32:9200/_search?pretty
{
"_index" : "filebeat-2018.11.27",
"_type" : "log",
"_id" : "XVZAVGcB6PZDlVvdbsKB",
"_score" : 1.0,
"_source" : {
"@timestamp" : "2018-11-27T08:19:13.568Z",
"beat" : {
"hostname" : "localhost.localdomain",
"name" : "localhost.localdomain",
"version" : "5.4.1"
},
"input_type" : "log",
"message" : "[\u001B[32m OK \u001B[0m] Stopped Cleaning Up and Shutting Down Daemons.",
"offset" : 1218,
"source" : "/var/log/boot.log",
"type" : "log"
}
}
]
}
}
正常啓動
三、 配置kibana
[root@localhost data]# cd kibana/config
修改配置文件，去除“#”，並修改相應內容。
[root@localhost config]# vim kibana.yml
[root@localhost config]# egrep -v "^#|^$" kibana.yml
server.port: 5601
server.host: "172.16.41.32"
elasticsearch.url: "http://172.16.41.32:9200"
開放端口
[root@localhost config]# firewall-cmd --add-port=5601/tcp --permanent
success
[root@localhost config]# firewall-cmd --reload
success
後臺啓動kibana
[root@localhost kibana]# bin/kibana &
查看端口監聽情況
[root@localhost kibana]# netstat -ntulp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 172.16.41.32:9100 0.0.0.0: LISTEN 47943/grunt
tcp 0 0 192.168.122.1:53 0.0.0.0: LISTEN 2854/dnsmasq
tcp 0 0 0.0.0.0:22 0.0.0.0: LISTEN 1566/sshd
tcp 0 0 127.0.0.1:631 0.0.0.0: LISTEN 1571/cupsd
tcp 0 0 127.0.0.1:25 0.0.0.0: LISTEN 2070/master
tcp 0 0 172.16.41.32:5601 0.0.0.0: LISTEN 73103/bin/../node/b
tcp6 0 0 :::9200 ::: LISTEN 48329/java
tcp6 0 0 :::5044 ::: LISTEN 71717/java
tcp6 0 0 :::9300 ::: LISTEN 48329/java
tcp6 0 0 :::22 ::: LISTEN 1566/sshd
tcp6 0 0 ::1:631 ::: LISTEN 1571/cupsd
tcp6 0 0 ::1:25 ::: LISTEN 2070/master
tcp6 0 0 127.0.0.1:9600 ::: LISTEN 71717/java
udp 0 0 192.168.122.1:53 0.0.0.0: 2854/dnsmasq
udp 0 0 0.0.0.0:67 0.0.0.0: 2854/dnsmasq
udp 0 0 0.0.0.0:53381 0.0.0.0: 939/avahi-daemon: r
udp 0 0 0.0.0.0:5353 0.0.0.0: 939/avahi-daemon: r
udp 0 0 127.0.0.1:323 0.0.0.0: 960/chronyd
udp6 0 0 ::1:323 ::: 960/chronyd
結尾返回以下內容，說明正常啓動。
log [09:43:22.040] [info][status][plugin:[email protected]] Status changed from red to green - Ready
log [09:43:29.129] [warning][reporting] Enabling the Chromium sandbox provides an additional layer of protection.
log [09:43:29.287] [info][migrations] Creating index .kibana_1.
log [09:43:31.804] [info][migrations] Pointing alias .kibana to .kibana_1.
log [09:43:33.246] [info][migrations] Finished in 3959ms.
log [09:43:33.251] [info][listening] Server running at http://172.16.41.32:5601
log [09:43:36.724] [info][status][plugin:[email protected]] Status changed from red to green - Ready
2.2 漢化
默認情況下kibana是英文版，所以我們要進行漢化。
下載漢化包
[root@localhost data]# git clone https://github.com/anbai-inc/Kibana_Hanization.git
[root@localhost data]# cd Kibana_Hanization/
進行翻譯
[root@localhost Kibana_Hanization]# python main.py ../kibana/
等待翻譯完成。
重啓kibana
2.3 打開網頁進行瀏覽測試