centos7部署ELK测试

一、背景

　　学习ELK，动手实验。

　　参考：https://blog.csdn.net/qq_33406938/article/details/80307679

二、环境

　　虚拟机一台，已安装jdk1.8，nginx，ip:192.168.1.8。

三、步骤

1、配置limit.conf

[root@localhost ~]# vi /etc/security/limit.conf
* hard nofile 65536
* soft nofile 65536
* soft nproc 65536
* hard nproc 65536

2、配置sysctl.conf

[root@localhost ~]# vi /etc/sysctl.conf

...

vm.max_map_count = 262144
net.core.somaxconn=65535
net.ipv4.ip_forward = 1

...

[root@localhost ~]# sysctl -p
vm.max_map_count = 262144
net.core.somaxconn = 65535
net.ipv4.ip_forward = 1

3、关闭防火墙

[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# systemctl disable firewalld

[root@localhost ~]# iptables -F

4、配置清华镜像yum源

[root@localhost ~]# vi /etc/yum.repos.d/elk.repo
[elk]
name=elk
baseurl=https://mirrors.tuna.tsinghua.edu.cn/elasticstack/yum/elastic-6.x/
enable=1
gpgcheck=0

5、安装elasticsearch、logstash、kibana、filebeat、nodejs

[root@localhost ~]# yum install elasticsearch -y

[root@localhost ~]# yum install logstash -y

[root@localhost ~]# yum install kibana -y

[root@localhost ~]# yum install filebeat -y

[root@localhost ~]# yum install nodejs -y

6、配置elasticsearch.yml并启动elasticsearch服务

[root@localhost ~]# vi /etc/elasticsearch/elasticsearch.yml

...

cluster.name: elk-stack
node.name: elk.node1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
http.port: 9200
discovery.zen.ping.unicast.hosts: ["192.168.1.8:9300"]
discovery.zen.minimum_master_nodes: 1

...

[root@elk ~]# systemctl start elasticsearch
[root@elk ~]# ss -ntlup| grep -E "9200|9300"

tcp LISTEN 0 65535 :::9200 :::* users:(("java",pid=16217,fd=234))
tcp LISTEN 0 65535 :::9300 :::* users:(("java",pid=16217,fd=209))

7、配置kibana.yml并启动kibana服务

[root@localhost ~]# vi /etc/kibana/kibana.yml

...

server.port: 5601
server.host: "0.0.0.0"
elasticsearch.url: "http://192.168.1.8:9200"
kibana.index: ".kibana"

...

[root@localhost ~]# systemctl start kibana

[root@localhost ~]# ss -ntlup | grep 5601
tcp LISTEN 0 511 *:5601 *:* users:(("node",pid=19513,fd=18))

8、配置logstash.yml，添加日志处理文件local_syslog.conf，启动logstash

[root@localhost ~]# vi /etc/logstash/logstash.yml

...

path.config: /etc/logstash/conf.d

...

添加日志处理文件：

[root@localhost ~]# vi /etc/logstash/conf.d/local_syslog.conf

input {
#filebeat客户端
beats {
port => 5044
}
}

#筛选
#filter { }

output {
# 输出到es
elasticsearch {
hosts => ["http://192.168.1.8:9200"]
index => "syslog-%{+YYYY.MM.dd}"
}

}

[root@localhost ~]# vi /etc/logstash/conf.d/local_syslog.conf

[root@localhost ~]# lsof -i:5044
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 17524 logstash 114u IPv6 149366 0t0 TCP *:lxi-evntsvc (LISTEN)

9、配置filebeat.yml并启动filebeat

[root@localhost ~]# vi /etc/filebeat/filebeat.yml

...

filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/messages
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 3
output.logstash:
hosts: ["192.168.1.8:5044"]

...

[root@localhost ~]# systemctl start filebeat

至此，在浏览器中输入http://192.168.1.8即可访问ELK之kibana界面。

10、汉化kibana

[root@localhost ~]# yum install -y git

[root@localhost ~]# git clone https://github.com/anbai-inc/Kibana_Hanization.git

[root@localhost ~]# cd kibana_Hanization

#查看README.md文件，得到汉化方法为：拷贝translations`文件夹`到kibana目录下的`src/legacy/core_plugins/kibana/`目录

[root@localhost kibana_Hanization]#  rsync -av --progress translations /usr/share/kibana/src/legacy/core_plugins/kibana

重启kibana：

[root@localhost ~]#  systemctl restart kibana

[root@localhost ~]# ss -ntlup | grep 5601
tcp LISTEN 0 511 *:5601 *:* users:(("node",pid=19513,fd=18))

此时，用浏览器访问http://192.168.1.8:5601即可看到中文界面的kibana。