搭建elk

1. 准备java环境,略过

2. 安装Elasticsearch

• 下载Elasticsearch

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.2.3.tar.gz

• 解压文件

•  创建ES用户和组

groupadd elsearch
useradd elsearch -g elsearch
chown -R elsearch:elsearch elasticsearch-6.2.3

• 新建用户文件夹

su elsearch  cd到elsearch目录,新建data,log等文件夹

cd /home/elsearch/
mkdir program
mkdir program/es/data
mkdir program/es/logs

   

el配置跨域:elasticsearch.yml 最后加

http.cors.enabled: true
http.cors.allow-origin: "*"

• 报错

• 包含两个错误
• 第一个:max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]

• #切换到root用户修改

  vim /etc/security/limits.conf

  # 在最后面追加下面内容

  * hard nofile 65536

  * soft nofile 65536

          切回elsearch用户

扫描二维码关注公众号，回复： 768798 查看本文章

• 第二个:please set [discovery.zen.minimum_master_nodes] to a majority of the number of master eligible 

• vim config/elasticsearch.yml

• 修改 discovery.zen.minimum_master_nodes: 1

java.lang.RuntimeException: bootstrap checks failed
max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]
please set [discovery.zen.minimum_master_nodes] to a majority of the number of master eligible nodes in your cluster
	at org.elasticsearch.bootstrap.BootstrapCheck.check(BootstrapCheck.java:125)
	at org.elasticsearch.bootstrap.BootstrapCheck.check(BootstrapCheck.java:85)
	at org.elasticsearch.bootstrap.BootstrapCheck.check(BootstrapCheck.java:65)
	at org.elasticsearch.bootstrap.Bootstrap$5.validateNodeBeforeAcceptingRequests(Bootstrap.java:183)
	at org.elasticsearch.node.Node.start(Node.java:337)
	at org.elasticsearch.bootstrap.Bootstrap.start(Bootstrap.java:198)
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:257)
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:96)
	at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:91)
	at org.elasticsearch.cli.SettingCommand.execute(SettingCommand.java:54)
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:91)
	at org.elasticsearch.cli.Command.main(Command.java:53)
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:70)
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:63)
	Suppressed: java.lang.IllegalStateException: max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]
		at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193)
		at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1374)
		at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481)
		at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471)
		at java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:151)
		at java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:174)
		at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
		at java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:418)
		at org.elasticsearch.bootstrap.BootstrapCheck.check(BootstrapCheck.java:126)
		... 13 more
	Suppressed: java.lang.IllegalStateException: please set [discovery.zen.minimum_master_nodes] to a majority of the number of master eligible nodes in your cluster
		at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193)
		at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1374)
		at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:481)
		at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471)
		at java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:151)
		at java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:174)
		at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
		at java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:418)
		at org.elasticsearch.bootstrap.BootstrapCheck.check(BootstrapCheck.java:126)
		... 13 more

错误3:

max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]

切换root

vi /etc/sysctl.conf 
vm.max_map_count=655360
sysctl -p

• 下载elasticseatch-head插件,下载nodjs,配置环境：

git clone git://github.com/mobz/elasticsearch-head.git


wget https://nodejs.org/dist/v4.6.1/node-v4.6.1-linux-x64.tar.gz


//解压head和nojs
//cd 到 head 下
./../node-v4.6.1-linux-x64/bin/npm install
//太慢的话换调nojs地址
//执行成功后启动
./../node-v4.6.1-linux-x64/bin/npm start

3.

wget https://artifacts.elastic.co/downloads/kibana/kibana-6.2.3-linux-x86_64.tar.gz

4. logstash

启动命令:

./bin/logstash -h config/log.config

config:

input {
     stdin
          {
          }
     tcp {
        port => 4569
        codec => "json"
         }
       }
output {
     stdout {
            codec => rubydebug
            }
     elasticsearch {
             hosts => "192.168.11.250:9200"
             index => "log-%{+YYYY.MM.dd}"
                    }
        }