centos7 分布式日志追踪:skywalking elasticsearch

skywalking的介绍，详情请看官网。本文章只要是介绍elasticsearch单机安装，以及skywalking结合elasticsearch的分布式日志追踪

一、环境：

        elasticsearch-6.7.0、apache-skywalking-apm-6.1.0

       注：（1）skywalking6.X版本，对应的elasticsearch必须是6.3.X及以上，不然日志跟踪时，端点名称查询会报错

               （2）skywalking的启动要在elasticsearch启动之后

二、elasticsearch安装

1、文件下载

官网下载：wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.7.0.tar.gz   

网盘下载：链接：https://pan.baidu.com/s/1tFfM--Qb7tM96QU5eF33fQ  提取码：m3lf 
 

2、解压

tar zxvf elasticsearch/elasticsearch-6.7.0.tar.gz   

3、修改配置信息

cd elasticsearch-6.7.0/config/
vi elasticsearch.yml

#此名称需要和collector配置文件一致。在skywalking配置中需要需要到
cluster.name: elasticsearch
# 数据存储目录
path.data: /data/esdata
# 日志存储目录
path.logs: /data/eslog
# 允许远程访问
network.host: 0.0.0.0
# 端口
http.port: 9200

# 赋予logstash创建索引的权限,
# 不加该行配置，skywalking 启动会报index_not_found_exception，错误
# 参考： https://ngx.hk/2016/11/08/logstash-outputs-elasticsearch-error-404- 
# index_not_found_exception-%E7%9A%84%E8%A7%A3%E5%86%B3%E5%8A%9E%E6%B3%95.html
action.auto_create_index: .security,.monitoring*,.watches,.triggered_watches,.watcher-history*,filebeat*

4、创建用户组、用户，并分配权限（elasticsearch不能用root账号登录）

sudo groupadd ELK #创建ELK组
sudo useradd elsearch -g ELK
sudo passwd elsearch

#分配权限
sudo chown -R elsearch:ELK /data
#切换用户
su elsearch

5、启动elasticsearch

sh ./bin/elasticsearch -d

6、测试验证，ip:9200

三 skywalking安装

1、文件下载

wget http://mirror.bit.edu.cn/apache/skywalking/6.1.0/apache-skywalking-apm-6.1.0.tar.gz 

2、解压

tar -zxvf apache-skywalking-apm-6.1.0.tar.gz 

3、修改配置

1）conf/application.yml

storage:
  elasticsearch:
    nameSpace: ${SW_NAMESPACE:"elasticsearch"} # elasticsearch需要和ES的配置一致
    clusterNodes: ${SW_STORAGE_ES_CLUSTER_NODES:10.0.1.116:9200}
    # user: ${SW_ES_USER:""}
    # password: ${SW_ES_PASSWORD:""}
    indexShardsNumber: ${SW_STORAGE_ES_INDEX_SHARDS_NUMBER:2}
    indexReplicasNumber: ${SW_STORAGE_ES_INDEX_REPLICAS_NUMBER:0}
    # Batch process setting, refer to https://www.elastic.co/guide/en/elasticsearch/client/java-api/5.5/java-docs-bulk-processor.html
    bulkActions: ${SW_STORAGE_ES_BULK_ACTIONS:2000} # Execute the bulk every 2000 requests
    bulkSize: ${SW_STORAGE_ES_BULK_SIZE:20} # flush the bulk every 20mb
    flushInterval: ${SW_STORAGE_ES_FLUSH_INTERVAL:10} # flush the bulk every 10 seconds whatever the number of requests
    concurrentRequests: ${SW_STORAGE_ES_CONCURRENT_REQUESTS:2} # the number of concurrent requests
    metadataQueryMaxSize: ${SW_STORAGE_ES_QUERY_MAX_SIZE:5000}
    segmentQueryMaxSize: ${SW_STORAGE_ES_QUERY_SEGMENT_SIZE:200}

2）修改 agent/config/agent.config

# Logging level 级别改为DEBUG，不然日志会特别大
logging.level=${SW_LOGGING_LEVEL:DEBUG}

4、启动： bin/startup.sh

5、测试验证，ip:8080  admin/admin

四 springboot项目，jar启动

1、启动

# skywalking-agent.jar 目录, service_name=XXX  XXX是skywalking中显示的服务名称
java -Xms512m -Xmx1024m -javaagent:/data/skywalking/agent/skywalking-agent.jar  -Dskywalking.agent.service_name=XXX -jar xxx.jar 

2、测试验证

五、日志跟踪使用