详细介绍如何搭建ELK集群

1. Logstash
   1.1 安装
   注：安装在需要收集日志的机器上。

cd /data/softs
sudo wget https://download.elastic.co/logstash/logstash/logstash-2.4.0.tar.gz
sudo tar -zxf logstash-2.4.0.tar.gz
sudo mv logstash-2.4.0 /usr/local/logstash

1.2 创建配置

cd /usr/local/logstash
sudo vim logstash.conf
输入：

input {
    file {
        path => ["/data/logs/error/program.error.log"]
        type => "error"
        tags => ["error"]
        start_position => "beginning"
        #sincedb_path => "/dev/null"
        codec => "json"
    }
    file {
        path => ["/data/logs/error/program.warning.log"]
        type => "warning"
        tags => ["warning"]
        start_position => "beginning"
        #sincedb_path => "/dev/null"
        codec => "json"
    }
    #file {
    #    path => ["/data/logs/access/nginx.access.log"]
    #    type => "access"
    #    tags => ["access"]
    #    start_position => "beginning"
    #    codec => "json"
    #}
}
output {
    if "error" in [tags] {
        elasticsearch {
            hosts  => "10.0.0.23:9200"
            index  => "error_log"
        }
        stdout { codec=> rubydebug }
    }
    if "warning" in [tags] {
        elasticsearch {
            hosts  => "10.0.0.23:9200"
            index  => "warning_log"
        }
        stdout { codec=> rubydebug }
    }
    if "access" in [tags] {
        elasticsearch {
            hosts  => "10.0.0.23:9200"
            #index  => "access_log"
            index => "access_log_%{+YYYY.MM.dd}"
        }
        stdout { }
    }
}

1.3 启动

sudo /usr/local/logstash/bin/logstash agent -f /usr/local/logstash/logstash.conf 2>>/data/logs/error/logstash.error.log &

2. ElasticSearch集群（三台）
   2.1 安装

# 安装JDK
    sudo yum -y install java-1.8.0-openjdk

    # 下载ES RPM包
    sudo wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-2.4.0.rpm
    # 安装
    rpm -ivh elasticsearch-5.2.0.rpm
    
    # 开机启动
    sudo /bin/systemctl daemon-reload
    sudo /bin/systemctl enable elasticsearch.service

2.2 配置
2.2.1 elasticsearch01

    # 更改配置 
    sudo vim /etc/elasticsearch/elasticsearch.yml
    
    path.data: /data/components/elasticsearch
    path.plugins: /data/components/elasticsearch/plugins

    node.name: zt-elk01
    path.logs: /data/logs/
    network.host: 10.0.0.23
    http.port: 9200
    discovery.zen.ping.unicast.hosts: ["10.0.0.24","10.0.0.25"]
     
    # 重启
    sudo systemctl enable elasticsearch.service
    sudo systemctl restart elasticsearch.service

2.2.2 elasticsearch02

# 更改配置 
    sudo vim /etc/elasticsearch/elasticsearch.yml
    
    path.data: /data/components/elasticsearch
    path.plugins: /data/components/elasticsearch/plugins
    
    cluster.name: zt-elk
    node.name: zt-elk02
    path.logs: /data/logs/
    network.host: 10.0.0.24
    http.port: 9200
    discovery.zen.ping.unicast.hosts: ["10.0.0.23","10.0.0.25"]

    # 重启
    sudo systemctl enable elasticsearch.service
    sudo systemctl restart elasticsearch.service

2.2.3 elasticsearch03

# 更改配置 
    sudo vim /etc/elasticsearch/elasticsearch.yml
    
    path.data: /data/components/elasticsearch
    path.plugins: /data/components/elasticsearch/plugins
    
    cluster.name: zt-elk
    node.name: zt-elk03
    path.logs: /data/logs/
    network.host: 10.0.0.25
    http.port: 9200
    discovery.zen.ping.unicast.hosts: ["10.0.0.23","10.0.0.24"]

    # 重启
    sudo systemctl enable elasticsearch.service
    sudo systemctl restart elasticsearch.service

3. 安装Kibana
   3.1 安装
   注：安装在能对外访问的机器上。

cd /data/softs
sudo wget https://download.elastic.co/kibana/kibana/kibana-4.6.0-linux-x86_64.tar.gz
sudo tar -zxf kibana-4.6.0-linux-x86_64.tar.gz
sudo mv kibana-4.6.0-linux-x86_64 /usr/local/kibana

3.2 配置
更改相关配置：

cd /usr/local/kibana
vim config/kibana.yml

    server.port: 5601 
    server.host: "127.0.0.1"
    elasticsearch.url: "http://10.0.0.23:9200"

3.3 启动

sudo /usr/local/kibana/bin/kibana

4. tips
   4.1 删除索引

curl -XDELETE 'http://127.0.0.1:9200/applog'

PS:如果你想成为一名优秀的架构师，或者在工作中遇到瓶颈，想跳槽加薪，面试不过，
碰到难题等等一系列问题，可以加我的架构师群：554355695
这里有最专业的团队为你排忧解难，有最新的学习资源为你共享。