ELK 5.5.0 安装

Preparation

假设当前为root用户，并已有jdk1.8环境。

cd /opt/package
useradd sealion

ElasticSearch

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.5.0.zip
unzip elasticsearch-5.5.0.zip 

# mkdir paths
chown -R sealion:sealion /opt/package/elasticsearch-5.5.0
mkdir -p /data/data/es
mkdir -p /data/logs/es
chown sealion:sealion /data/data/es
chown sealion:sealion /data/logs/es

# clean bin
cd /opt/package/elasticsearch-5.5.0/bin
rm *.exe *.bat

# system config
sysctl -w vm.max_map_count=262144

vim /etc/security/limits.conf
修改如下内容:
* soft nofile 65536
* hard nofile 65536
* soft nproc 2048
* hard nproc 4096

# edit elasticsearch.yml

# Use a descriptive name for your cluster:
#
cluster.name: bigdata-log
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: bigdata6

# need new Linux kernel to support
bootstrap.memory_lock: false
bootstrap.system_call_filter: false

#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /data/data/es
#
# Path to log files:
#
path.logs: /data/logs/es

# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 192.168.10.120
#
# Set a custom port for HTTP:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.zen.ping.unicast.hosts: ["bigdata6", "bigdata7"]

# 启动
su - sealion
cd /opt/package/elasticsearch-5.5.0/bin
./elasticsearch -d

安装Cerebro插件 (前身为Kopf)

wget https://github.com/lmenezes/cerebro/releases/download/v0.6.5/cerebro-0.6.5.zip
unzip cerebro-0.6.5.zip
cd cerebro-0.6.5/bin
nohup ./cerebro > cerebro.log &

打开默认的9000端口，填上要连接的host即可看到。注意有些host或防火墙配置可能不能用localhost去连接，要填写对应的域名或集群ip。

Kibana

wget https://artifacts.elastic.co/downloads/kibana/kibana-5.5.0-linux-x86_64.tar.gz
tar xzvf kibana-5.5.0-linux-x86_64.tar.gz
chown -R sealion:sealion /opt/package/kibana-5.5.0-linux-x86_64

# edit kibana.yml

# Kibana is served by a back end server. This setting specifies the port to use.
server.port: 5601

# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
server.host: "bigdata6"

# The Kibana server's name.  This is used for display purposes.
server.name: "bigdata6"

su - sealion
cd /opt/package/kibana-5.5.0-linux-x86_64/bin
nohup ./kibana serve -e http://bigdata6:9200 > kibana.log &

LogStash

wget https://artifacts.elastic.co/downloads/logstash/logstash-5.5.0.zip
unzip logstash-5.5.0.zip
chown -R sealion:sealion /opt/package/logstash-5.5.0
mkdir -p /data/data/logstash
mkdir -p /data/logs/logstash
chown -R sealion:sealion /data/data/logstash
chown -R sealion:sealion /data/logs/logstash

# edit logstash.yml

path.data: /data/data/logstash
path.logs: /data/logs/logstash