开坑-学习ELFK

1.了解常见ELK/ElasticStack架构图

2.elastic search官网

https://www.elastic.co/cn/elasticsearch

3. 从模板安装虚拟机后，设置系统相关配置

3.1设置主机名称

hostnamectl set-hostname 主机名称

3.2设置主机IP

nmcli connection show
nmcli connection modify "配置 1" ipv4.addresses <IP_address>/<prefix_length>
nmcli connection modify "配置 1" ipv4.dns '114.114.114.114'
nmcli connection reload "配置 1"
nmcli device reapply eth0

3.3添加主机和IP映射

cat >> /etc/hosts << 'EOF'
172.16.201.192 elk001
172.16.201.190 elk002
172.16.201.191 elk003
EOF

3.4修改软件源

下载、替换、加载阿里yum源

wget  -O /etc/yum.repos.d/aliyun.repo  http://mirrors.aliyun.com/repo/Centos-7.repo


#修改前备份yum文件
cp /etc/yum.repos.d/aliyun.repo /etc/yum.repos.d/aliyun.repo.bak
sed -i -e 's/\$releasever/7/g' \
 -e 's/\$basearch/x86_64/g' \
 -e '/mirrors.cloud.aliyuncs.com/d' \
 -e '/mirrors.aliyuncs.com/d' \
/etc/yum.repos.d/aliyun.repo

yum clean all

yum makecache

3.5关闭防火墙

systemctl --now disable firewalld.service && systemctl status firewalld.service

3.6禁用selinux,先备份，在修改

cp /etc/selinux/config /etc/selinux/config.bak
sed -ri 's#(SELINUX=)enforcing#\1disabled#' /etc/selinux/config
#检查修改内容
grep ^SELINUX /etc/selinux/config
#设置selinux为permissive
setenforce 0
getenforce

配置集群免密登录和同步脚本

#1.生产elk001密钥对
ssh-keygen -t rsa -P  '' -f ~/.ssh/id_rsa -q
#2.配置集群免密登录
for ((host_id=1;host_id<=3;host_id++)) ; do ssh-copy-id elk00${host_id} ; done

#3.安装rsync
yum install -y rsync
#4.编写同步脚本
#bin/bash
if [ $# -ne 1 ];then
	echo"Usage :$0 /path/to/file(绝对路径)"
	exit
fi
# 判断文件是否存在
if [ ! -e $1 ]; then
	echo "[ $1 ] dir or file not find! "
	exit
fi
# 获取父路径
fullpath=`dirname $1`
# 获取子路径
basename=`basename $1`
# 进入到父路径
cd $fullpath
for ((host_id=2;host_id<=3;host_id++))
	do
	  # 使得终端输出变为绿色
	  tput setaf 2
	  echo "===== rsyncing elk00${host_id}: $basename ====" 	
 	  #使得终端恢复原来的颜色
	  tput setaf 7
  	  #将数据同步到其他两个节点
	  rsync -az $basename `whoami`@elk00${host_id}:$fullpath
	  if [ $? -eq 0 ] ; then
 		echo "命令执行成功!"
	  fi
done

安装时间同步服务

yum install -y net-tools chrony ntpdate
#修改配置文件
/etc/chrony.conf
#同步本地elk002时间
server elk002 iburst

#配置开机自启
systemctl enable --now chronyd

#查看服务状态
systemctl status chronyd