ELK安装使用

6.42版本为例

一、安装elasticsearch

1、下载https://www.elastic.co/downloads/past-releases/elasticsearch-6-4-2

2、修改配置文件，结尾添加两个配置

cd elasticsearch-6.4.2/config
vi elasticsearch.yml

server.host: 本机ip
http.cors.enabled: true
http.cors.allow-origin: "*"

3、启动(不能用root用户，必须新创建一个用户并授权)

nohup ./bin/elasticsearch &

4、安装ik(非必须)

1、安装：
  ./bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v6.4.2/elasticsearch-analysis-ik-6.4.2.zip
2、启动
  curl -H "Content-Type: application/json" -XPOST http://localhost:9200/_index/_doc/_mapping -d' { "properties": { "content": { "type": "text", "analyzer": "ik_max_word", "search_analyzer": "ik_max_word" } } }'

二、安装kibana

1、下载https://www.elastic.co/downloads/past-releases/kibana-6-4-2

2、修改配置文件

cd kibana-6.4.2-linux-x86_64/config
vi kibana.yml
server.host: 本机ip

3、kibana没有权限管理功能，可借助nginx验证权限(非必须)

创建密码文件

yum install -y httpd
htpasswd -c /usr/local/nginx/db/passwd.db user

先安装httpd, user是用户名，接着输入两次一样的密码。然后配置到nginx中

server {
  listen       80;
  server_name localhost;
  location / {
     auth_basic "secret";
     auth_basic_user_file /usr/local/nginx/db/passwd.db;
     proxy_pass http://localhost:5601;
     proxy_set_header Host $host:5601;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header Via "nginx";
  }
}

auth_basic_user_file路径是上面创建的密码文件

4、启动

nohup ./bin/kibana &

三、安装logstash

1、下载https://www.elastic.co/downloads/past-releases/logstash-6-4-2

2、创建配置文件

cd logstash-6.4.2
mkdir conf_logs
cd conf_logs
vi test.conf

input {
     file {
        type => "log"
        path => "/Users/chenfenli/Log/haozhun/hz-model/*.log"
        start_position => "beginning"
    }
}
output {
  stdout {
   codec => rubydebug { }
  }
  elasticsearch {
    hosts => "localhost"
    index => "hz-log-%{+YYYY.MM.dd}"
  }
}

3、启动

nohup ./bin/logstash -f conf_logs/test.conf &

猜你喜欢