對於日志來說,最常見的需求就是收集、存儲、查詢、展示,開源社區正好有相對應的開源項目:logstash(收集)、elasticsearch(存儲+搜索)、kibana(展示),我們將這三個組合起來的技術稱之為ELKStack,所以說ELKStack指的是Elasticsearch、Logstash、Kibana技術棧的結合
主機名
IP
服務
node1
192.168.16.73
Elasticsearch、Kibana
node2
192.168.17.224
Elasticsearch、Kibana
node3
192.168.16.70
Logstash、服務及程序日志
node4
192.168.16.111
Logstash、Redis(消息隊列)
本次采用集群安裝,單台安裝大同小異
一、安裝
Elasticsearch、需要Java環境,所以直接使用yum安裝。 最好用1.8版本(centos7),centos 6.X版本可tar包安裝
[root@node1]# java -version
java version "1.8.0_102"
Java(TM) SE Runtime Environment (build 1.8.0_102-b14)
Java HotSpot(TM) 64-Bit Server VM (build 25.102-b14, mixed mode)
1、下載並安裝GPG key
[root@node1 ~]# rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch
2、添加elasticsearch、logstash、kibana的yum倉庫
# 添加elasticsearch/logstash/ kibana的yum倉庫
[root@node1 ~]# cat /etc/yum.repos.d/elasticsearch.repo
[elasticsearch-2.x]
name=Elasticsearch repository for 2.x packages
baseurl=http://packages.elastic.co/elasticsearch/2.x/centos
gpgcheck=1
gpgkey=http://packages.elastic.co/GPG-KEY-elasticsearch
enabled=1
cat kibana.repo
[kibana-4.5]
name=Kibana repository for4.5.x packages
baseurl=http://packages.elastic.co/kibana/4.5/centos
gpgcheck=1
gpgkey=http://packages.elastic.co/GPG-KEY-elasticsearch
enabled=1
3、安裝ElasticSearch
[root@node1 ~]# yum install -y elasticsearch
[root@node1 ~]# yum install -y kibana
4、yum安裝需要配置limits
[root@node1 ~]# vim /etc/security/limits.conf
elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited
[root@node1 ~]# mkdir -p /data/es-data #創建es數據目錄
[root@node1 ~]# chown -R elasticsearch.elasticsearch /data/es-data/ #授權
[root@node1 /]# grep '^[a-z]' /etc/elasticsearch/elasticsearch.yml
cluster.name: elk-cluter #集群名稱
node.name: linux-node1 #節點的名稱
path.data: /data/es-data #數據存放路徑
path.logs: /var/log/elasticsearch/ #日志存放日志
bootstrap.mlockall: true #不使用swap分區,鎖住內存
network.host: 192.168.16.73 #允許訪問的IP(本機ip)
http.port: 9200 #elasticsearch訪問端口
discovery.zen.ping.unicast.hosts: ["192.168.16.73","192.168.17.224"] #單播(配置一台即可,生產可以使用組播方式)
1.啟動elasticsearch
systemctl daemon-reload
systemctl enable elasticsearch
[root@node1 ~]# systemctl start elasticsearch ##centos7 啟動方式
啟動時如果提示: Can't start up: not enough memory,有可能是java未用到1.8,還是用的1.5或者1.6
解決辦法:
vi /etc/sysconfig/elasticsearch
將 JAVA_HOME=/root/jdk1.8.0_60 寫到文件中保存後啟動
service elasticsearch start ####centos 6.x 啟動方式
2.訪問:elasticsearch_url: "http://192.168.16.73:9200/" 出現下面 json 串表示安裝成功
{
"name" : "linux-node1",
"cluster_name" : "elk-cluter",
"cluster_uuid" : "8Tw1Ko2PS6aJzSguT7kwig",
"version" : {
"number" : "2.4.1",
"build_hash" : "c67dc32e24162035d18d6fe1e952c4cbcbe79d16",
"build_timestamp" : "2016-09-27T18:57:55Z",
"build_snapshot" : false,
"lucene_version" : "5.5.2"
},
"tagline" : "You Know, for Search"
}
三、Elasticsearch插件
1.安裝Elasticsearch集群管理插件
[root@node1 ~]# /usr/share/elasticsearch/bin/plugin install mobz/elasticsearch-head
訪問head集群插件:http://ES_IP:9200/_plugin/head
2.安裝Elasticsearch監控插件
[root@node1 plugins]# /usr/share/elasticsearch/bin/plugin install lmenezes/elasticsearch-kopf
訪問kopf監控插件:http://ES_IP:9200/_plugin/kopf
1.node2配置一個與node1相同的節點,通過組播進行通信,會通過cluster進行查找,如果無法通過組播查詢,修改成單播即可
[root@node2 ~]# grep "^[a-Z]" /etc/elasticsearch/elasticsearch.yml
cluster.name: elk-cluter
node.name: linux-node2
path.data: /data/es-data
path.logs: /var/log/elasticsearch/
bootstrap.mlockall: true
network.host: 0.0.0.0
http.port: 9200
discovery.zen.ping.unicast.hosts: ["192.168.16.73","192.168.17.224"] #單播(配置一台即可,生產可以使用組播方式)
http://xxxxxx/Linuxjc/1166789.html TechArticle