ELK初探

ELK、nginx安装方式：rpm

https://www.elastic.co/guide/en/elasticsearch/reference/current/rpm.html

其他的类似

nginx的配置：

 # 主要增加日志的格式以及与Tomcat的连接
 log_format main '{"@timestamp":"$time_iso8601",'
                 '"host":"$server_addr",'
                 '"clientip":"$remote_addr",'
                 '"size":$body_bytes_sent,'
                 '"responsetime":$request_time,'
                 '"upstreamtime":"$upstream_response_time",'
                 '"upstreamhost":"$upstream_addr",'
                 '"http_host":"$host",'
                 '"url":"$uri",'
                 '"xff":"$http_x_forwarded_for",'
                 '"referer":"$http_referer",'
                 '"agent":"$http_user_agent",'
                 '"status":"$status"}';
 server {
     listen       80;
     server_name  localhost;

     #charset koi8-r;

     #access_log  logs/host.access.log  main;

     location / {
         root   html;
         index  index.html index.htm;
         proxy_pass http://localhost:8080/;
     }
 }

随后，logstash创建一个配置文件nginxlog2ex.conf放到config目录下

 input {
     file {
       type => "nginx_access"
         path => "/usr/local/nginx/logs/access.log"
         codec => "json"
     }
 }

 filter {
   if [type] == "nginx_access" {

     geoip {
       source => "ip"
       target => "geoip"
       #database => "/etc/logstash/GeoLiteCity.dat"  ##可要可不要
       add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
       add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
     }
     mutate {
       convert => [ "[geoip][coordinates]", "float"]
     }
   }
 }
 output {
   stdout { codec => rubydebug }
   elasticsearch {
         hosts => ["192.168.47.138:9200"]
         index => "logstash-%{type}-%{+YYYY.MM.dd}"
         document_type => "%{type}"
         flush_size => 20000
         idle_flush_time => 10
         sniffing => true
         template_overwrite => true
     }
 }

启动tomcat：bin/startup.sh

启动nginx：sbin/nginx

启动elasticsearch: systemctl start elasticsearch.service

启动kibana： systemctl start kibana.service

启动logstash：bin/logstash -f config/nginxlog2es.conf

各种图，自己折腾吧

地图，记得选上两个选项：

地图如下：

使用的是虚拟机，有时候主机无妨访问虚拟机ip:9200等，网上说将elk的network.host都改为0.0.0.0，测试无效，将防火墙挂壁也无效，即将network.host改为centos的ip，成功访问。