ELK日志收集分析平台

ELK日志收集分析平台

时间同步

# yum -y install ntpdate
# ntpdate ntp.aliyun.com

防火墙

[root@bogon src]# systemctl stop firewalld
[root@bogon src]# setenforce 0

解压压缩包

# yum -y install unzip
# unzip ELK.zip

安装jdk

# rpm -ivh jdk-8u131-linux-x64_.rpm
验证：
# java -version

安装elasticsearch

# yum -y install elasticsearch-6.6.2.rpm
编辑主配置文件：
# vim /etc/elasticsearch/elasticsearch.yml
# cat /etc/elasticsearch/elasticsearch.yml |grep -v "^#"

cluster.name: wg007
node.name: node-1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 192.168.1.7
http.port: 9200

运行服务elasticsearch

# systemctl enable elasticsearch
# systemctl start elasticsearch

验证服务：
9200：给客户端连接使用的
9300：给集群内部通信使用的

# [root@bogon ELK]# netstat -lptnu|grep java

tcp6 0 0 192.168.1.7:9200 ::: LISTEN 14671/java
tcp6 0 0 192.168.1.7:9300 ::: LISTEN 14671/java

安装logstash

# yum -y install logstash-6.6.0.rpm

编辑messages.conf

1. input {
2. file {
3. path => "/var/log/messages"
4. type => "msg-log"
5. start_position => "beginning"
6. }
7. }
9. output{
10. elasticsearch {
11. hosts => "192.168.1.7:9200"
12. index => "msg_log-%{+YYYY.MM.dd}"
13. }
14. }

开启服务logstash

# systemctl enable logstash
# systemctl start logstash
验证：
# netstat -lptnu|grep java

tcp6 0 0 127.0.0.1:9600 :::* LISTEN 5453/java

问题1：权限
# chmod 777 /var/log -R

查看index是否创建成功

方法1：
# tailf /var/log/elasticsearch/wg007.log
方法2：
# curl -X GET http://192.168.1.7:9200/_cat/indices?v

安装kibana

# yum -y install kibana-6.6.2-x86_64.rpm

12 编辑vim /etc/kibana/kibana.yml
# cat /etc/kibana/kibana.yml |grep -v "^#"|sed '/^$/d'

server.port: 5601
server.host: “192.168.1.7”
elasticsearch.hosts: [“http://192.168.1.7:9200“]

开启服务kibana

# systemctl enable kibana
# systemctl start kibana
验证服务：
# netstat -lptnu|grep node

tcp 0 0 192.168.1.7:5601 0.0.0.0:* LISTEN 16172/node

编辑pipelines.yml

# vim pipelines.yml

1. - pipeline.id: msg
2. path.config: "/etc/logstash/conf.d/messages.conf"
3. - pipeline.id: sec
4. path.config: "/etc/logstash/conf.d/secure.conf"