ELK 日志分析平台

点击此处即可查看elk的官方文档

安装包：

elasticsearch-6.6.1.rpm

[root@server1 ~]# ls
elasticsearch-6.6.1.rpm
#报错，需要java程序
[root@server1 ~]# rpm -ivh elasticsearch-6.6.1.rpm 

安装包：

jdk-8u181-linux-x64.rpm

[root@server1 ~]# ls
elasticsearch-6.6.1.rpm  jdk-8u181-linux-x64.rpm
[root@server1 ~]# rpm -ivh jdk-8u181-linux-x64.rpm 
[root@server1 ~]# rpm -ivh elasticsearch-6.6.1.rpm 

[root@server1 ~]# ps aux

[root@server1 ~]# scp elasticsearch-6.6.1.rpm jdk-8u181-linux-x64.rpm server2:
[root@server1 ~]# scp elasticsearch-6.6.1.rpm jdk-8u181-linux-x64.rpm server3:

[root@server1 ~]# cd /etc/elasticsearch/
[root@server1 elasticsearch]# ls
elasticsearch.keystore  jvm.options        role_mapping.yml  users
elasticsearch.yml       log4j2.properties  roles.yml         users_roles
[root@server1 elasticsearch]# vim elasticsearch.yml 
#############################
cluster.name: my-es                  #集群名
node.name: server1                   #节点名
path.data: /var/lib/elasticsearch    #数据目录
path.logs: /var/log/elasticsearch    #日志名
bootstrap.memory_lock: true          #锁定内存
network.host: 172.25.66.1            #网络主机
http.port: 9200                      #程序端口

注意：需要解析

[root@server1 ~]# vim /etc/hosts
#################
172.25.66.1 server1

[root@server1 elasticsearch]# systemctl start elasticsearch.service
[root@server1 elasticsearch]# netstat -antlp | grep 99200

[root@server1 elasticsearch]# vim /etc/security/limits.conf 
#############################
elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited

elasticsearch - nofile 65536
elasticsearch - nproc 4096

[root@server1 elasticsearch]# vim /usr/lib/systemd/system/elasticsearch.service 
#############################
LimitMEMLOCK=infinity

[root@server1 elasticsearch]# systemctl daemon-reload
[root@server1 elasticsearch]# netstat -antlp | grep 9200
[root@server1 elasticsearch]# netstat -antlp | grep 9200
tcp6       0      0 172.25.66.1:9200        :::*                    LISTEN      3580/java  

网页访问： http://172.25.66.1:9200/

[root@server1 elasticsearch]# curl -XGET http://172.25.66.1:9200/_cat/health?v
epoch      timestamp cluster status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent
1555125750 03:22:30  my-es   green           1         1      0   0    0    0        0             0                  -                100.0%
[root@server1 elasticsearch]# curl -XGET http://172.25.66.1:9200/_cat/nodes
172.25.66.1 11 97 0 0.00 0.01 0.05 mdi * server1
[root@server1 elasticsearch]# curl -XGET http://172.25.66.1:9200/_cat/health
1555125780 03:23:00 my-es green 1 1 0 0 0 0 0 0 - 100.0%

安装包：

nodejs-9.11.2-1nodesource.x86_64.rpm

[root@server1 ~]# ls
elasticsearch-6.6.1.rpm  nodejs-9.11.2-1nodesource.x86_64.rpm
jdk-8u181-linux-x64.rpm  phantomjs-2.1.1-linux-x86_64.tar.bz2
[root@server1 ~]# rpm -ivh nodejs-9.11.2-1nodesource.x86_64.rpm 
warning: nodejs-9.11.2-1nodesource.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID 34fa74dd: NOKEY
Preparing...                          ################################# [100%]
Updating / installing...
   1:nodejs-2:9.11.2-1nodesource      ################################# [100%]
[root@server1 ~]# node -v
v9.11.2
[root@server1 ~]# npm -v
5.6.0

让虚拟机能上网

[root@server1 ~]# ping www.baidu.com -w1 -c1

安装包：

elasticsearch-head-master.zip

[root@server1 ~]# yum install -y unzip
[root@server1 ~]# unzip elasticsearch-head-master.zip

phantomjs-2.1.1-linux-x86_64.tar.bz2

[root@server1 ~]# cd elasticsearch-head-master
[root@server1 elasticsearch-head-master]# ls
Dockerfile                          package.json
Dockerfile-alpine                   phantomjs-2.1.1-linux-x86_64.tar.bz2
elasticsearch-head.sublime-project  plugin-descriptor.properties
Gruntfile.js                        proxy
grunt_fileSets.js                   README.textile
index.html                          _site
LICENCE                             src
node_modules                        test
[root@server1 elasticsearch-head-master]# tar jxf phantomjs-2.1.1-linux-x86_64.tar.bz2 

[root@server1 elasticsearch-head-master]# cd phantomjs-2.1.1-linux-x86_64
[root@server1 phantomjs-2.1.1-linux-x86_64]# npm install --registry=https://registry.npm.taobao.org

[root@server1 phantomjs-2.1.1-linux-x86_64]# cd ..
[root@server1 elasticsearch-head-master]# npm install --registry=https://registry.npm.taobao.org

[root@server1 elasticsearch-head-master]# vim _site/app.js 

[root@server1 elasticsearch-head-master]# npm run start &
[1] 4797
[root@server1 elasticsearch-head-master]# netstat -antlp | grep :9100
tcp        0      0 0.0.0.0:9100            0.0.0.0:*               LISTEN      4807/grunt  

网页测试：http://172.25.66.1:9100/ 发现无法连接

解决方案：

[root@server1 ~]# cd /etc/elasticsearch/
[root@server1 elasticsearch]# vim elasticsearch.yml 
#############################
http.cors.enabled: true
http.cors.allow-origin: '*'

[root@server1 elasticsearch]# systemctl restart elasticsearch

刷新网页：

创建索引：

[root@server2 ~]# ls
elasticsearch-6.6.1.rpm  jdk-8u181-linux-x64.rpm 
[root@server2 ~]# rpm -vih jdk-8u181-linux-x64.rpm
[root@server2 ~]# rpm -ivh elasticsearch-6.6.1.rpm