ELK的安装

首先得安装好Elasticsearch、Kibana和Logstash（这里全部使用rpm安装的是6.4.2版本，而且都是单机安装，暂时没有考虑分布式安装。）

服务器内存要求至少为4G，下图为运行起来的ELK，4G内存的虚拟机，可以看到占用内存很大。

在安装之前首先确定java（1.8版本以上）已经安装，这里
下载地址：https://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html

解压：
tar -xvf jdk-8u171-linux-x64.tar.gz -C /usr/local/

在/etc/profile添加环境变量
export JAVA_HOME=/usr/local/jdk1.8.0_171
export JAVA_JRE=$JAVA_HOME/jre
export CLASS_PATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar:$JRE_HOME/lib
export PATH=$PATH:$JAVA_HOME/bin:$JRE_HOME/bin

生效：source /etc/profile

1.安装Elasticsearch：
curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.4.2.rpm
rpm -i elasticsearch-6.4.2.rpm
修改/etc/sysconfig/elasticsearch文件下：JAVA_HOME=/usr/local/jdk1.8.0_171
不然启动elasticsearch会报错which: no java in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin)
vi /etc/elasticsearch/elasticsearch.yml，修改：network.host: 0.0.0.0和取消注释http.port: 9200

启动：systemctl start elasticsearch
测试：curl http://127.0.0.1:9200会出现如下：
{
"name" : "zyQUqmo",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "sEeFbBVCRQu3oNhsRlUeiA",
"version" : {
"number" : "6.4.2",
"build_flavor" : "default",
"build_type" : "rpm",
"build_hash" : "04711c2",
"build_date" : "2018-09-26T13:34:09.098244Z",
"build_snapshot" : false,
"lucene_version" : "7.4.0",
"minimum_wire_compatibility_version" : "5.6.0",
"minimum_index_compatibility_version" : "5.0.0"
},
"tagline" : "You Know, for Search"
}

2.安装Kibana：
wget https://artifacts.elastic.co/downloads/kibana/kibana-6.4.2-x86_64.rpm
rpm -i kibana-6.4.2-x86_64.rpm
vi /etc/kibana/kibana.yml,打开注释修改server.port: 5601，server.host: "0.0.0.0"和elasticsearch.url: "http://localhost:9200"
启动：systemctl start kibana
测试：浏览器打开：http://ip:5601可以看到kibana的展示界面

3.安装Logstash：
curl -L -O https://artifacts.elastic.co/downloads/logstash/logstash-6.4.2.rpm
rpm -i logstash-6.4.2.rpm
修改/usr/share/logstash/bin/logstash.lib.sh，在页首新增export JAVA_HOME=/usr/local/jdk1.8.0_171
否则在启动的时候可能会出现：logstash: could not find java; set JAVA_HOME or ensure java is in PATH
启动：systemctl start logstash