EFK日志搭建

安装java

安装java1.8以上的版本并验证

[root@localhost ~]# yum install java

[root@localhost ~]# java -version
openjdk version "1.8.0_222"
OpenJDK Runtime Environment (build 1.8.0_222-b10)
OpenJDK -Bit Server VM (build 25.222-b10, mixed mode)

安装Elasticsearch

安装Elasticsearch（Elasticsearch、Kibana、FileBeat版本最好一致）

[root@localhost ~]# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.2.4.tar.gz
[root@localhost ~]# tar -zxvf elasticsearch-6.2..tar.gz
[root@localhost ~]# mv elasticsearch-6.2.4 /usr/local/elasticsearch-6.2.4
[root@localhost ~]# cd /usr/local/elasticsearch-6.2.4
[root@localhost ~]# vi config/elasticsearch.yml
    network.host: 0.0.0.0
    http.port: 

#由于这里不能直接用root用户运行elasticsearch，所以要创建一个新用户
[root@localhost ~]# adduser fengzi
[root@localhost ~]# passwd fengzi
[root@localhost ~]# chmod -R  /usr/local/elasticsearch-6.2.
[root@localhost ~]# su fengzi

#启动elasticsearch
[root@localhost ~]# ./bin/elasticsearch

如果服务启动不起来，以下是解决办法

#添加以下4行内容
[root@localhost local]# vim /etc/security/limits.conf
        * soft nofile
        * hard nofile
        efk soft nproc
        efk hard nproc             

#修改成以下内容
[root@localhost local]# vim /etc/security/limits.d/-nproc.conf
        *          soft    nproc
        root       soft    nproc     unlimited    

#添加如下一行
[root@localhost local]# vim /etc/sysctl.conf
        vm.max_map_count=
[root@localhost local]# sysctl -p
#查看一下9200和9300端口有没有启
[root@localhost local]# ss -tnl
State       Recv-Q Send-Q              Local Address:Port                             Peer Address:Port
LISTEN                                         *:                                          *:*
LISTEN                                 127.0.0.1:                                          *:*
LISTEN                                         :::                                       :::*
LISTEN                                        :::                                       :::*
LISTEN                                        :::                                       :::*
LISTEN                                        :::                                         :::*
LISTEN                                       :::                                         :::*                  

安装Kibana

[root@localhost local]# wget https://artifacts.elastic.co/downloads/kibana/kibana-6.2.4-linux-x86_64.tar.gz
[root@localhost local]# tar -zxvf kibana-6.2.-linux-x86_64.tar.gz
[root@localhost local]# vi config/kibana.yml
        elasticsearch.url: "http://0.0.0.0:9200"
        server.host: "0.0.0.0"
        kibana.index: ".kibana"
#启动kibana服务
[root@localhost local]# ./bin/kibana

#查看5601端口有没有启动
[root@localhost local]# ss -tnl
State       Recv-Q Send-Q              Local Address:Port                             Peer Address:Port
LISTEN                                         *:                                          *:*
LISTEN                                 127.0.0.1:                                          *:*
LISTEN                                         *:                                        *:*
LISTEN                                         :::                                       :::*
LISTEN                                        :::                                       :::*
LISTEN                                        :::                                       :::*
LISTEN                                        :::                                         :::*
LISTEN                                       :::                                         :::*                 

安装FileBeat

[root@localhost local]# wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.2.4-linux-x86_64.tar.gz
[root@localhost local]# tar -zxvf filebeat-6.2.-linux-x86_64.tar.gz
[root@localhost local]# vi filebeat.yml
        enabled: true
[root@localhost local]# ./filebeat -c filebeat.yml

配置Kibana