ELK笔记00：安装

安装ES集群

下载：

wget https://mirrors.huaweicloud.com/elasticsearch/7.3.1/elasticsearch-7.3.1-linux-x86_64.tar.gz
tar -zvxf elasticsearch-7.3.1-linux-x86_64.tar.gz
           

环境变量：

vi /etc/profile
export ES_HOME=/usr/elasticsearch-7.3.1
export PATH=$PATH:$ES_HOME/bin
source /etc/profile
           

创建elsearch账户：

# 添加用户并修改所有权
groupadd elsearch
useradd elsearch -g elsearch
chown -R elsearch:elsearch ${ES_HOME}

# 创建数据目录和日志目录
mkdir -p /var/data/elasticsearch
chown -R elsearch:elsearch /var/data/elasticsearch
mkdir -p /var/log/elasticsearch
chown -R elsearch:elsearch /var/log/elasticsearch
           

系统参数修改：解决max file descriptors和max virtual memory areas

vim /etc/sysctl.conf
vm.max_map_count=262144
sysctl -p

# 修改limits：
vim /etc/security/limits.conf
elsearch  hard    nofile  65536
elsearch  soft    nofile  65536

#登录elsearch账户,查看是否生效
su elsearch
ulimit -Hn
           

修改配置文件：

主机1：10.90.15.45

vi ${ES_HOME}/config/elasticsearch.yml
cluster.name: es-cluster-test
node.name: node-1
node.master: true
node.data: true
#注意一定要是路径后面加上/var/data/elasticsearch/nodes，要不然无法加入集群
path.data: /var/data/elasticsearch/nodes
path.logs: /var/log/elasticsearch
network.host: 10.90.15.45
http.port: 9200
transport.tcp.port: 9300
http.cors.enabled: true
http.cors.allow-origin: "*"
xpack.security.enabled: false
# 注意：地址的话可以配置内网IP地址
discovery.seed_hosts: ["10.90.15.45", "10.90.15.43", "10.90.15.44"]
cluster.initial_master_nodes: ["10.90.15.45", "10.90.15.43", "10.90.15.44"]
           

主机2：10.90.15.43

vi ${ES_HOME}/config/elasticsearch.yml
cluster.name: es-cluster-test
node.name: node-2
node.master: true
node.data: true
#注意一定要是路径后面加上/var/data/elasticsearch/nodes，要不然无法加入集群
path.data: /var/data/elasticsearch/nodes
path.logs: /var/log/elasticsearch
network.host: 10.90.15.43
http.port: 9200
transport.tcp.port: 9300
http.cors.enabled: true
http.cors.allow-origin: "*"
xpack.security.enabled: false
# 注意：地址的话可以配置内网IP地址
discovery.seed_hosts: ["10.90.15.45", "10.90.15.43", "10.90.15.44"]
cluster.initial_master_nodes: ["10.90.15.45", "10.90.15.43", "10.90.15.44"]
           

主机3：10.90.15.44

vi ${ES_HOME}/config/elasticsearch.yml
cluster.name: es-cluster-test
node.name: node-3
node.master: true
node.data: true
#注意一定要是路径后面加上/var/data/elasticsearch/nodes，要不然无法加入集群
path.data: /var/data/elasticsearch/nodes
path.logs: /var/log/elasticsearch
network.host: 10.90.15.44
http.port: 9200
transport.tcp.port: 9300
http.cors.enabled: true
http.cors.allow-origin: "*"
xpack.security.enabled: false
# 注意：地址的话可以配置内网IP地址
discovery.seed_hosts: ["10.90.15.45", "10.90.15.43", "10.90.15.44"]
cluster.initial_master_nodes: ["10.90.15.45", "10.90.15.43", "10.90.15.44"]
           

三台机器都启动：

bin/elasticsearch -d
           

查看集群状态：

浏览器访问：http://10.90.15.45:9200/_cluster/health?pretty

{
  "cluster_name" : "es-cluster-test",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 3,
  "number_of_data_nodes" : 3,
  "active_primary_shards" : 0,
  "active_shards" : 0,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0
}
           

安装Kibana

wget http://mirrors.huaweicloud.com/kibana/7.3.1/kibana-7.3.1-linux-x86_64.tar.gz
tar -zxvf kibana-7.3.1-linux-x86_64.tar.gz
cd kibana-7.3.1-linux-x86_64
vi config/kibana.yml
server.host: "10.90.15.44"
elasticsearch.hosts: ["http://10.90.15.45:9200", "http://10.90.15.44:9200", "http://10.90.15.43:9200"]
           

安装Logstash

下载：

wget http://mirrors.huaweicloud.com/logstash/7.3.1/logstash-7.3.1.tar.gz
tar -zvxf logstash-7.3.1.tar.gz
cd logstash-7.3.1
bin/logstash -e 'input{stdin{}}output{stdout{codec=>rubydebug}}'
{
    "@version" => "1",
    "host" => "edi-bis",
    "message" => "Hello,World",
    "@timestamp" => 2019-09-04T01:00:27.441Z
}