centos上手动安装最新版本ELK

软件包下载地址：https://www.elastic.co/downloads/elasticsearch

1，安装es

#tar zxvf elasticsearch-2.3.4.tar.gz

#mv elasticsearch-2.3.4 /usr/local

#Cd /usr/local

#mv elasticsearch-2.3.4/ elasticsearch

#chmod -R test:test ./elasticsearch/

#su test

更改配置文件config/elasticsearch.yml

cluster.name: node236

network.host: 192.168.1.236

$ bin/elasticsearch  //这里应该正常启动了

插件安装

$ ./plugin install mobz/elasticsearch-head

-> Installing mobz/elasticsearch-head...

Trying https://github.com/mobz/elasticsearch-head/archive/master.zip ...

Downloading

......................................................................................................................................

....................................DONE

Verifying https://github.com/mobz/elasticsearch-head/archive/master.zip checksums if available ...

NOTE: Unable to verify checksum for downloaded plugin (unable to find .sha1 or .md5 file to verify)

Installed head into /usr/local/elasticsearch/plugins/head

[test@node236 bin]$ ls ../plugins/head/

elasticsearch-head.sublime-project  .jshintrc                           _site/

.gitignore                          LICENCE                             src/

Gruntfile.js                        package.json                        test/

grunt_fileSets.js                   plugin-descriptor.properties

index.html                          README.textile

访问http://192.168.1.236:9200/_plugin/head/正常

注：此处远程访问一定要改配置文件的network.host值，否则只能本机访问

2，安装kibana

#tar zxvf kibana-4.5.3-linux-x64.tar.gz  -C /usr/local/

# cd /usr/local/

# mv kibana-4.5.3-linux-x64/ kibana

# cd kibana/

# ls

bin     installedPlugins  node          optimize      README.txt  webpackShims

config  LICENSE.txt       node_modules  package.json  src

# cd /etc/systemd/system

# vi kibana.service

[Service]

ExecStart=/usr/local/kibana/bin/kibana

[Install]

WantedBy=multi-user.target

# systemctl enable kibana

#systemctl start kibana

Created symlink from /etc/systemd/system/multi-user.target.wants/kibana.service to /etc/systemd/system/kibana.service.

#systemctl status kibana

— kibana.service

Loaded: loaded (/etc/systemd/system/kibana.service; enabled; vendor preset: disabled)

Active: active (running) since Wed 2016-07-27 16:35:12 CST; 814ms ago

Main PID: 44722 (node)

CGroup: /system.slice/kibana.service

44722 /usr/local/kibana/bin/../node/bin/node /usr/local/kibana/b...

Jul 27 16:35:12 node236 systemd[1]: Started kibana.service.

Jul 27 16:35:12 node236 systemd[1]: Starting kibana.service...

# netstat -nltp

Active Internet connections (only servers)

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name

tcp        0      0 0.0.0.0:5601            0.0.0.0:*               LISTEN      44722/node

tcp6       0      0 192.168.1.236:9200      :::*                    LISTEN      44160/java

tcp6       0      0 192.168.1.236:9300      :::*                    LISTEN      44160/java

3，安装logstash

[root@node236 test]# tar zxvf logstash-2.3.4.tar.gz -C /usr/local/

[root@node236 test]# cd /usr/local/

[root@node236 local]# mv logstash-2.3.4/ logstash

[root@node236 logstash-2.3.4]# ls

bin  CHANGELOG.md  CONTRIBUTORS  Gemfile  Gemfile.jruby-1.9.lock  lib  LICENSE  NOTICE.TXT  vendor

测试一下，情况正常

[root@node236 logstash-2.3.4]# bin/logstash -e 'input { stdin { } } output { stdout {} }'

Settings: Default pipeline workers: 1

Pipeline main started

2016-07-27T08:41:53.637Z node236

fdfd

2016-07-27T08:41:58.875Z node236 fdfd

afdfad

2016-07-27T08:42:01.846Z node236 afdfad

加个证书支持

[root@node236 logstash]# cd /etc/pki/tls

[root@node236 tls]# openssl req -subj '/CN=node236/' -x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout private/logstash-

forwarder.key -out certs/logstash-forwarder.crt

Generating a 2048 bit RSA private key

..........................................+++

....+++

writing new private key to 'private/logstash-forwarder.key'

-----

手动安装是没有配置文件的，需要自己建立

[root@node236 tls]# cd /usr/local/logstash/

[root@node236 logstash]# mkdir conf

[root@node236 logstash]# vi conf/1.conf

内容如下，这是针对apache的日志的监控

input {

file {

path => "/var/log/httpd/access_log"

start_position => beginning

}

}

filter {

if [path] =~ "access" {

mutate { replace => { "type" => "apache_access" } }

grok {

match => { "message" => "%{COMBINEDAPACHELOG}" }

}

}

date {

match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]

}

}

output {

elasticsearch {

hosts => "192.168.1.246:9200"

index => "fuckyou_index"     #索引名称

}

stdout { codec => rubydebug }

}

"conf/1.conf" 26L, 471C written

[root@node236 logstash]# ./bin/logstash -f ./conf/1.conf   //启动

4,测试

yum -y install httpd 装个apache，之后随便用个awvs扫一下IP

以下是在ES里看到的内容，说明已经正确抓取

访问kibana，一切正常。