JDK

sudo apt install -y openjdk-8-jdk

Elasticsearch

wget http://file.nuozhilin.site/7_db/elasticsearch-6.8.3.zip

unzip elasticsearch-6.8.3.zip

sudo mv elasticsearch-6.8.3 /opt/

cd /opt/elasticsearch-6.8.3/

./bin/elasticsearch-keystore create
# Created elasticsearch keystore in /opt/elasticsearch-6.8.3/config

vim ./config/elasticsearch.yml
# xpack.security.enabled: true
# xpack.security.transport.ssl.enabled: true

./bin/elasticsearch -d

./bin/elasticsearch-setup-passwords interactive
# Changed password for user [elastic]
# Changed password for user [apm_system]
# Changed password for user [kibana]
# Changed password for user [logstash_system]
# Changed password for user [beats_system]
# Changed password for user [remote_monitoring_user]

kill -9 `lsof -t -i:9200`

./bin/elasticsearch -d

curl --basic -u elastic:elastic http://localhost:9200/?pretty

Kibana

wget http://file.nuozhilin.site/7_db/kibana-6.8.3-linux-x86_64.tar.gz

tar xf kibana-6.8.3-linux-x86_64.tar.gz

sudo mv kibana-6.8.3-linux-x86_64 /opt

cd /opt/kibana-6.8.3-linux-x86_64

vim config/kibana.yml
# elasticsearch.username: "elastic"
# elasticsearch.password: "elastic"

./bin/kibana &

Nginx

sudo apt install -y nginx

sudo vim /etc/nginx/sites-enabled/elk.conf

server {
    listen 80;
    server_name 192.168.56.191.xip.io;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://127.0.0.1:5601;
        proxy_read_timeout 90;
    }
}

sudo nginx -t

sudo nginx -s reload

浏览器打开http://192.168.56.191.xip.io/

Redis

sudo apt install -y redis-server

sudo vim /etc/redis/redis.conf
# bind 192.168.56.191 127.0.0.1

sudo service redis restart

Logstash

wget http://file.nuozhilin.site/7_db/logstash-6.8.3.tar.gz

tar xf logstash-6.8.3.tar.gz

sudo mv logstash-6.8.3 /opt/

cd /opt/logstash-6.8.3

vim elk.conf

input {
    redis {
        host => "127.0.0.1"
        port => "6379"
        db => "1"
        key => "elk-log"
        data_type => "list"
    }
}

filter {
}

output {
    if [fields][category_tag] == "laravel" {
        if [fields][tag] == "laravel-test" {
            elasticsearch {
                hosts => ["127.0.0.1:9200"]
                user => "elastic"
                password => "elastic"
                index => "laravel-test-%{+YYYY.MM.dd}"
            }
        }
    }
}

./bin/logstash -f elk.conf &

Filebeat

wget http://file.nuozhilin.site/7_db/filebeat-6.8.3-linux-x86_64.tar.gz

tar xf filebeat-6.8.3-linux-x86_64.tar.gz

sudo mv filebeat-6.8.3-linux-x86_64 /opt/

cd /opt/filebeat-6.8.3-linux-x86_64

vim elk.yml

filebeat.inputs:
- type: log
  enable: true
  paths:
    - /home/vagrant/laravel-*.log
  fields:
    category_tag: laravel
    tag: laravel-test
  multiline:
    pattern: '^\[\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}'
    negate: true
    match: after
output.redis:
  hosts: ["192.168.56.191:6379"]
  db: 1
  key: "elk-log"
  timeout: 5

chmod 600 elk.yml

./filebeat -c elk.yml &

touch ~/laravel-test.log

chmod 666 ~/laravel-test.log

vim ~/laravel-test.log
# [2020-06-28 00:01:01.902220] local.INFO: admin-device-service-auto-stop-command-count:0
# [2020-06-28 17:32:09.271539] local.ERROR: Trying to get property of non-object {"userId":12,"exception":"[object] (ErrorException(code: 0): Trying to get property of non-object at /opt/sites/saas-admin/app/Http/Resources/FuelAlarmResource.php:89)"}