一、 ElasticSearch安裝

 wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.3.2.tar.gz #下載
 tar zxvf  elasticsearch-5.3.2.tar.gz #解壓
cd elasticsearch-5.3.2/config
vim elasticsearch.yml #修改配置文件
------------------------------------------------
cluster.name: elasticsearch
node.name: node-4
node.attr.rack: r4
network.host: 192.168.100.17,127.0.0.1
node.master: true
node.data: true
transport.tcp.port: 9300
transport.tcp.compress: true
discovery.zen.ping.unicast.hosts: ["192.168.100.17:9300","192.168.100.18:9300","192.168.100.19:9300"]

http.cors.enabled: true
http.cors.allow-origin: "*"
indices.query.bool.max_clause_count: 10240
------------------------------------------------

1）問(wèn)題：max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536] 意思是說(shuō)你的進(jìn)程不夠用了

 vim /etc/security/limits.conf   #添加
-------------------------------------------------------
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096
-------------------------------------------------------

前面的*符號(hào)必須帶上，然后重新啟動(dòng)就可以了。執(zhí)行完成后可以使用命令 ulimit -n 查看進(jìn)程數(shù)

2）問(wèn)題： max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144] 需要修改系統(tǒng)變量的最大值了

vim /etc/sysctl.conf 
----------------------------------------------------
vm.max_map_count=655360 #添加
----------------------------------------------------
sysctl -p #更新配置

3) 問(wèn)題： elasticSearch不能以 root賬號(hào)啟動(dòng)，創(chuàng)建用戶elastic

groupadd elastic #創(chuàng)建用戶組
useradd elastic -g elastic #創(chuàng)建用戶指定到用戶組
chown -R elastic:elastic  elasticsearch-5.3.2  #文件夾附用戶權(quán)限

4）啟動(dòng)es

 ./bin/elasticsearch  #前臺(tái)啟動(dòng)
nohup  ./bin/elasticsearch & #后臺(tái)啟動(dòng)

二、Kibana-5.3.2安裝

wget https://artifacts.elastic.co/downloads/kibana/kibana-5.3.2-linux-x86_64.tar.gz #下載
 tar zxvf  kibana-5.3.2.tar.gz #解壓
cd kibana-5.3.2/config
vim kibana.yml  #修改配置文件（末尾添加）
------------------------------------------------
server.port: 5601  
server.host: 192.168.100.17
elasticsearch.url: "http://192.168.100.17:9300"  
logging.dest: /data/kibana-5.3.2-linux-x86_64/log/kibana.log
------------------------------------------------

三 、Logstash-5.3.2安裝

wget https://artifacts.elastic.co/downloads/logstash/logstash-5.3.2.tar.gz  #下載
 tar zxvf  logstash-5.3.2.tar.gz #解壓
cd logstash-5.3.2/config
vim message.conf  #添加配置文件
------------------------------------------------
input {
  file {
      type => "systemlog"
     path => "/data/logdir/message.log"
     }
}
output {
    if [type] == "systemlog" {
      redis {
      host => "192.168.100.17"
          port => "7000"
          data_type => "list"
          key => "logstash-systemlog"
       }
    }
}
------------------------------------------------

啟動(dòng) logstash

./bin/logstash -f config/message.conf 前臺(tái)啟動(dòng)

流程控制

1、logstash從message.log文件獲取內(nèi)容插入取到 redis集群
2、從redis集群取數(shù)據(jù)到容插入elasticSearch里面
3、kibana讀取elasticSearch信息

最后再啟動(dòng)kibana讀取elasticSearch集群

cd  /data/kibana-5.3.2-linux-x86_64
./bin/kibana #前臺(tái)啟動(dòng)