一, 基础部署
环境准备:
配置管理的 用户
groupadd elk
useradd -g elk elk
chown -R elk:elk /elk
对防火墙规则不熟悉的建议关闭
Java 环境1.8
elasticsearch 6.6.0 https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.6.0.tar.gz
logstash 6.6.0 https://artifacts.elastic.co/downloads/logstash/logstash-6.6.0.tar.gz
kibana 6.6.0 https://artifacts.elastic.co/downloads/kibana/kibana-6.6.0-linux-x86_64.tar.gz
java 安装:
下载地址:
http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html
解压安装包
tar -xzvf jdk-8u111-linux-x64.tar.gz
配置环境
vim /etc/profile
vim config/elasticsearch.yml 修改默认配置
登入elk用户然后启动软件
su elk
/elk/elasticsearch/bin/elasticsearch &
错误二:
max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]
vi /etc/security/limits.conf elk soft nofile 819200 elk hard nofile 819200
max number of threads [1024] for user [work] likely too low, increase to at least [2048]
vi /etc/security/limits.d/90-nproc.conf * soft nproc 1024 #修改为： * soft nproc 2048
max virtual memory areas vm.max_map_count [65530] likely too low, increase to at least [262144]
vi /etc/sysctl.conf #增加改行配置： vm.max_map_count=655360
sysctl -p
另外再配置ES的时候，threadpool.bulk.queue_size 已经变成了thread_pool.bulk.queue_size ，ES_HEAP_SIZE，ES_MAX_MEM等配置都变为ES_JAVA_OPTS这一配置项，如限制内存最大最小为1G：
export ES_JAVA_OPTS="-Xms1g -Xmx1g" 
即配置成功
Logstash安装:
tar -zxvf logstash-6.6.0.tar.gzogstash-6.6.0 logstashcd logstashvim config/logstash.config# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.
input {
beats {
port => 5044
codec => "json"
}
}
filter {
#Only matched data are send to output.
#
}
output {
elasticsearch {
action => "index"
hosts => ["http://10.0.0.223:9200"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
user => "elk"
password => "123456"
}
}
启动logstash
/elk/logstash/bin/logstash -f /elk/logstash/config/logstash.conf &
kibana 安装:
tar -zxvf kibana-6.6.0-linux-x86_64.tar.gz ln -s kibana-6.6.0-linux-x86_64 kibana cd kibana vim config/kibana.yml server.port: 5601 server.host: “10.0.0.223” elasticsearch.url: http://10.0.0.223:9200 kibana.index: “.kibana”
第二步
这些是自动生成的域 也可以理解为 跟数据库中的字段类似,其中有一个message字段,就是我们想要的日志信息。
显示时间范围生成的日志
添加过滤
原文：https://www.cnblogs.com/kingle-study/p/10360189.html