ELK5.0安装教程-白红宇

安装Elasticsearch

在官网下载elsaticsearch安装包：

下载对应版本拷贝到服务器，然后执行下面命令解压缩:

tar -zxvf elasticsearch-5.2.2.tar.gz

解压后进入对应的目录,修改配置文件：

cluster.name: page-clusternode.name: node-104bootstrap.memory_lock: falsebootstrap.system_call_filter: falsenetwork.host: 0.0.0.0http.port: 9200discovery.zen.ping.unicast.hosts: ["other ip"]

其中bootstrap相关是为了解决一个报错：

ERROR: bootstrap checks failedsystem call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

修改参数vi /etc/sysctl.conf

fs.file-max=65536vm.max_map_count=262144

然后执行命令sysctl -p

修改系统参数vi /etc/security/limits.conf:

*               soft    nofile          65536*               hard    nofile          65536*               soft    nproc           65536*               hard    nproc           65536

修改参数vi /etc/security/limits.d/90-nproc.conf

* soft nproc 1024#修改为* soft nproc 2048

然后进入bin目录，切换新账户执行ulimit -u 2048，执行./elasticsearch

看到下面输出信息：

[2017-03-20T11:25:00,031][INFO ][o.e.n.Node               ] [node-104] initializing ...[2017-03-20T11:25:00,172][INFO ][o.e.e.NodeEnvironment    ] [node-104] using [1] data paths, mounts [[/ (/dev/sda3)]], net usable_space [1.4tb], net total_space [1.7tb], spins? [possibly], types [ext4][2017-03-20T11:25:00,173][INFO ][o.e.e.NodeEnvironment    ] [node-104] heap size [1.9gb], compressed ordinary object pointers [true][2017-03-20T11:25:00,174][INFO ][o.e.n.Node               ] [node-104] node name [node-104], node ID [T8UBB8IMT96Gh4bJx9u7ww][2017-03-20T11:25:00,176][INFO ][o.e.n.Node               ] [node-104] version[5.2.2], pid[30823], build[f9d9b74/2017-02-24T17:26:45.835Z], OS[Linux/2.6.32-642.11.1.el6.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0_65/25.65-b01][2017-03-20T11:25:00,974][INFO ][o.e.p.PluginsService     ] [node-104] loaded module [aggs-matrix-stats][2017-03-20T11:25:00,975][INFO ][o.e.p.PluginsService     ] [node-104] loaded module [ingest-common][2017-03-20T11:25:00,975][INFO ][o.e.p.PluginsService     ] [node-104] loaded module [lang-expression][2017-03-20T11:25:00,975][INFO ][o.e.p.PluginsService     ] [node-104] loaded module [lang-groovy][2017-03-20T11:25:00,975][INFO ][o.e.p.PluginsService     ] [node-104] loaded module [lang-mustache][2017-03-20T11:25:00,975][INFO ][o.e.p.PluginsService     ] [node-104] loaded module [lang-painless][2017-03-20T11:25:00,975][INFO ][o.e.p.PluginsService     ] [node-104] loaded module [percolator][2017-03-20T11:25:00,975][INFO ][o.e.p.PluginsService     ] [node-104] loaded module [reindex][2017-03-20T11:25:00,976][INFO ][o.e.p.PluginsService     ] [node-104] loaded module [transport-netty3][2017-03-20T11:25:00,976][INFO ][o.e.p.PluginsService     ] [node-104] loaded module [transport-netty4][2017-03-20T11:25:00,976][INFO ][o.e.p.PluginsService     ] [node-104] no plugins loaded[2017-03-20T11:25:02,888][INFO ][o.e.n.Node               ] [node-104] initialized[2017-03-20T11:25:02,888][INFO ][o.e.n.Node               ] [node-104] starting ...[2017-03-20T11:25:03,084][INFO ][o.e.t.TransportService   ] [node-104] publish_address {10.10.5.104:9300}, bound_addresses {[::]:9300}[2017-03-20T11:25:03,090][INFO ][o.e.b.BootstrapChecks    ] [node-104] bound or publishing to a non-loopback or non-link-local address, enforcing bootstrap checks[2017-03-20T11:25:06,136][INFO ][o.e.c.s.ClusterService   ] [node-104] new_master {node-104}{T8UBB8IMT96Gh4bJx9u7ww}{An_WWH5xTYWUAZ-mXid5JQ}{10.10.5.104}{10.10.5.104:9300}, reason: zen-disco-elected-as-master ([0] nodes joined)[2017-03-20T11:25:06,154][INFO ][o.e.h.HttpServer         ] [node-104] publish_address {1.1.1.1:9200}, bound_addresses {[::]:9200}[2017-03-20T11:25:06,154][INFO ][o.e.n.Node               ] [node-104] started[2017-03-20T11:25:06,229][INFO ][o.e.g.GatewayService     ] [node-104] recovered [0] indices into cluster_state^C[2017-03-20T11:28:30,939][INFO ][o.e.n.Node               ] [node-104] stopping ...[2017-03-20T11:28:30,977][INFO ][o.e.n.Node               ] [node-104] stopped[2017-03-20T11:28:30,977][INFO ][o.e.n.Node               ] [node-104] closing ...[2017-03-20T11:28:30,987][INFO ][o.e.n.Node               ] [node-104] closed

访问对应的地址:http://1.2.3.4:9200/

看到下面的信息，就正常了：

{"name": "node-104","cluster_name": "page-cluster","cluster_uuid": "jZsQmqpUSbS_Hwv-NcGWsg","version": {"number": "5.2.2","build_hash": "f9d9b74","build_date": "2017-02-24T17:26:45.835Z","build_snapshot": false,"lucene_version": "6.4.1"},"tagline": "You Know, for Search"}

安装Kibana

去官网下载Kibana安装包，

解压缩后，修改配置文件vi kibana.yml：

server.host: 0.0.0.0

运行./bin/kibana,看到输出:

[hdfs@localnode4 bin]$ ./kibana  log   [05:22:04.137] [info][status][plugin:kibana@5.2.2] Status changed from uninitialized to green - Ready  log   [05:22:04.224] [info][status][plugin:elasticsearch@5.2.2] Status changed from uninitialized to yellow - Waiting for Elasticsearch  log   [05:22:04.254] [info][status][plugin:console@5.2.2] Status changed from uninitialized to green - Ready  log   [05:22:04.476] [info][status][plugin:timelion@5.2.2] Status changed from uninitialized to green - Ready  log   [05:22:04.480] [info][listening] Server running at http://0.0.0.0:5601  log   [05:22:04.482] [info][status][ui settings] Status changed from uninitialized to yellow - Elasticsearch plugin is yellow  log   [05:22:09.490] [info][status][plugin:elasticsearch@5.2.2] Status changed from yellow to yellow - No existing Kibana index found  log   [05:22:10.331] [info][status][plugin:elasticsearch@5.2.2] Status changed from yellow to green - Kibana index ready  log   [05:22:10.331] [info][status][ui settings] Status changed from yellow to green - Ready

然后访问对应的页面即可：1.1.1.1:5601

安装logstash

Logstash我用的wondows版本，下载后解压就可以用。

在logstash_home/bin目录下创建logstash.conf文件，内容如下：

input {    stdin{}}output {    stdout{codec=>rubydebug}}

然后执行下面的命令logstash.bat -f logstash.conf:

C:\Users\xx\Documents\workspace\elk\logstash-5.2.2\bin>logstash.bat -f logstash.confCould not find log4j2 configuration at path /Users/xinghailong/Documents/workspace/elk/logstash-5.2.2/config/log4j2.properties. Using default config which logs to console09:10:25.692 [[main]-pipeline-manager] INFO  logstash.pipeline - Starting pipeline {
    "id"=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>500}09:10:25.758 [[main]-pipeline-manager] INFO  logstash.pipeline - Pipeline main startedThe stdin plugin is now waiting for input:09:10:26.229 [Api Webserver] INFO  logstash.agent - Successfully started Logstash API endpoint {:port=>9600}test{    "@timestamp" => 2017-03-20T06:31:49.209Z,      "@version" => "1",          "host" => "DESKTOP-JB5HET6",       "message" => "test\r"}success{    "@timestamp" => 2017-03-20T06:31:54.481Z,      "@version" => "1",          "host" => "DESKTOP-JB5HET6",       "message" => "success\r"}

本文转自博客园xingoo的博客，原文链接：，如需转载请自行联系原博主。