ELK stack安裝

• logstash 收集日志
• elasticsearch 存儲(chǔ)+搜索
• kibana 顯示

前置條件

需要先安裝java

yum install -y java

安裝

• 可下載源碼，解壓，即可以運(yùn)行
• 可yum安裝

源碼解壓

從官網(wǎng)下載tar.gz文件，解壓后，即可使用。官網(wǎng)下載地址：

https://www.elastic.co/downloads

centos yum安裝

elasticsearch

$ rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch
$ cat /etc/yum.repos.d/elasticsearch.repo
    [elasticsearch-2.x]
    name=Elasticsearch repository for 2.x packages
    baseurl=http://packages.elastic.co/elasticsearch/2.x/centos
    gpgcheck=1
    gpgkey=http://packages.elastic.co/GPG-KEY-elasticsearch
    enabled=1
$ yum install elasticsearch

logstash

$ rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch

// 配置yum
$ cat /etc/yum.repos.d/logstash.repo
    [logstash-2.3]
    name=Logstash repository for 2.3.x packages
    baseurl=https://packages.elastic.co/logstash/2.3/centos
    gpgcheck=1
    gpgkey=https://packages.elastic.co/GPG-KEY-elasticsearch
    enabled=1

// 安裝logstash
$ yum -y install logstash

kibana

// 安裝key. 
rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch

// 配置yum
$ vim /etc/yum.repos.d/kibana.repo 
    [kibana-4.5]
    name=Kibana repository for 4.5.x packages
    baseurl=http://packages.elastic.co/kibana/4.5/centos
    gpgcheck=1
    gpgkey=http://packages.elastic.co/GPG-KEY-elasticsearch
    enabled=1
    
// 安裝kibana
$ yum install -y kibana

啟動(dòng)準(zhǔn)備

elasticsearch

設(shè)置jvm.options,

-XX:ParallelGCThreads=3 #3可修改

elasticsearch 不能用root啟動(dòng)；

groupadd elsearch
useradd elsearch -g elsearch -p elasticsearch
su elsearch

修改 /etc/security/limits.conf, 增加：

elsearch soft nofile 819200
elsearch hard nofile 819200
elsearch soft nproc 2048
elsearch hard nproc 4096
elsearch soft memlock unlimited
elsearch hard memlock unlimited

修改 /etc/security/limits.d/90-nproc.conf：

*          soft    nproc    1024

修改為

*          soft    nproc    2048

修改 /etc/sysctl.conf。如果在docker中，修改/etc/sysctl.conf文件，需要--privileged權(quán)限。：

vm.max_map_count=655360

這個(gè)文件修改后，需要執(zhí)行：

sysctl -p

修改配置文件 config/elasticsearch.yml

cluster.name: myes
node.name: abcdocker-node-1
path.data: /home/worker/data/www/src/data/es-date
path.logs: /home/worker/data/www/src/logs/elasticsearch
bootstrap.memory_lock: true
network.host: 172.17.0.2
http.port: 9200

logstash

設(shè)置jvm.options,

-XX:ParallelGCThreads=3 #3可修改

kibana

啟動(dòng)前，需設(shè)置elasticsearch訪問端口

修改配置文件 config/kibana.yml

elasticsearch.url: "http://172.17.0.2:9200"
server.port: 80

啟動(dòng)命令

elasticsearch

進(jìn)入elasticsearch的bin目錄：

./elasticsearch -d

-d參數(shù)是后臺(tái)運(yùn)行

logstash

bin/logstash -e 'input { stdin{} } output { stdout{ codec => rubydebug} }'

寫入elasticsearch

bin/logstash -e 'input { stdin{} } output { stdout{ codec => rubydebug} elasticsearch { hosts => ["172.17.0.2:9200"] index => "logstash-%{+YYYY.MM.dd}" } }'

可用配置文件方式，配置文件內(nèi)容：

input{
    file{
        path => ["/home/worker/data/www/runtime/demo/err.log"]
        type => "system-log"
        start_position => "beginning"
    }
    stdinP{}
}

filter{
}

output{
    elasticsearch{
        hosts => ["172.17.0.1:9200"]
        index => "logstash-%{+YYYY.MM.dd}"
    }
    stdout{
        codec=>rubydebug
    }
}

啟動(dòng)方式：

bin/logstash -f /etc/logstash/conf.d/file.conf

kibana

 bin/kibana

參考

http://www.cnblogs.com/xing901022/p/4805586.html
https://kibana.logstash.es/content/
https://caidezhi.gitbooks.io/elk-getting-started-guide/content/