elk安装（简）

1.到官网下载对应的版本注意最好使用版本相同的3个软件

elasticsearch-6.8.7.rpm

kibana-6.8.7-x86_64.rpm

logstash-6.8.7.rpm

我这里使用6.8.7版本的rpm包直接安装，基本注意事项：防火墙，firewall，等关闭，java环境注意修改家目录。

2.elasticsearch更改配置

vi elasticsearch.yml

主要设置的内容：
cluster.name: my_test_elk
node.name: node-1 
network.host: 0.0.0.0 
http.port: 9200

#设置在集群中的所有节点名称
discovery.zen.ping.unicast.hosts: ["node-1"]
bootstrap.memory_lock: false
bootstrap.system_call_filter: false

#解决跨域问题
http.cors.enabled: true
http.cors.allow-origin: "*"
http.cors.allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE
http.cors.allow-headers: "X-Requested-With, Content-Type, Content-Length, X-User"

vim /etc/sysctl.conf

fs.file-max=65536
vm.max_map_count=262144

vim /etc/security/limits.conf

*               soft    nofile          65536
*               hard    nofile          65536
*               soft    nproc           65536
*               hard    nproc           65536

vim /etc/security/limits.d/20-nproc.conf

*  s   oft      nproc    2048

#启动服务

systemctl  restart  elasticsearch.service

#测试服务：网页http://localhost:9200

{
  "name" : "node-1",
  "cluster_name" : "my_elk_test",
  "cluster_uuid" : "EtcNS12HQaW7mSHJmrtAJg",
  "version" : {
    "number" : "6.8.7",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "c63e621",
    "build_date" : "2020-02-26T14:38:01.193138Z",
    "build_snapshot" : false,
    "lucene_version" : "7.7.2",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  },
  "tagline" : "You Know, for Search"
}

3.logstash安装

systemctl start logstash.service

更改部分根据条件处理

4.kibana安装

vim /etc/kibana/kibana.yml

server.host: 0.0.0.0

elasticsearch.hosts: ["http://192.168.132.60:9200"]

i18n.locale: "zh-CN"   #语言设置

起服务

systemctl start  kibana.service

5.访问页面http://localhost:5601