1.2 ELK软件安装教程

文章摘自课程链接：https://study.163.com/course/introduction/1005164019.htm

1、JDK安装

wget http://download.oracle.com/otn-pub/java/jdk/8u161-b12/2f38c3b165be4555a1fa6e98c45e0808/jdk-8u161-linux-x64.rpm?AuthParam=1521354303_69d11165a6315a843a2f28ba5600517c

rpm -ivh jdk-8u161-linux-x64.rpm #默认安装在/usr/java中

在文件/etc/profile末尾追加：

JAVA_HOME=/usr/java/jdk1.8.0_161JRE_HOME=/usr/java/jdk1.8.0_161/jrePATH=$PATH:$JAVA_HOME/bin:$JRE_HOME/binCLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar:$JRE_HOME/libexportJAVA_HOME JRE_HOME PATH CLASSPATH

执行生效：source /etc/profile

2、Elasticsearch安装

wgethttps://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.2.2.rpm

sudo rpm --install elasticsearch-6.2.2.rpm

mkdir  /esdata

chown elasticsearch:elasticsearch  /esdata

服务添加和启动

sudo /bin/systemctl daemon-reload

sudo /bin/systemctl enable elasticsearch.service

sudo systemctl start elasticsearch.service

sudo systemctl stop elasticsearch.service

elasticsearch.yml配置文件

[root@ElkNode01 ~]# grep -v "^#"  /etc/elasticsearch/elasticsearch.ymlcluster.name: my-NCMBnode.name: node-1path.data: /esdatapath.logs: /esdatanetwork.host: 172.31.44.210http.port: 9200http.cors.enabled: truehttp.cors.allow-origin: "*"node.master: truenode.data: truehttp.enabled: truediscovery.zen.ping.unicast.hosts: ["172.31.44.210"]discovery.zen.minimum_master_nodes: 1

验证：在浏览器中输入172.31.44.210:9200，看是否有True返回。

3、Logstash安装

wgethttps://artifacts.elastic.co/downloads/logstash/logstash-6.2.2.rpm

rpm -ivhlogstash-6.6.2.rpm

mkdir   /usr/share/logstash/config

chown -R logstash:logstash /usr/share/logstash/config/

cp /etc/logstash/log*  /usr/share/logstash/config/

创建测试：bin/logstash -e 'input { stdin { } } output { stdout {} }'

执行/usr/share/logstash/bin/logstash-f /etc/logstash/conf.d/xxx.conf

4、Kibana安装

wget  https://artifacts.elastic.co/downloads/kibana/kibana-6.2.2-x86_64.rpm

rpm –ivh kibana-6.2.2-x86_64.rpm

vi /etc/kibana/kibana.yml配置：

server.port: 5601server.host: "172.31.44.210"elasticsearch.url:"http://172.31.44.210:9200"kibana.index: ".kibana"

启动kibana：systemctl  restart kibana