ELK初探

中文文檔：https://kibana.logstash.es/content/

Elasticsearch　Kibana　Logstash

下載地址：https://www.elastic.co/downloads

JAVA

基礎環境：yum install java-1.8.0-openjdk

Logstash

安裝：rpm -ivh logstash-5.4.1.rpm

路徑：/usr/share/logstash/bin/logstash

啓動：nohup /usr/share/logstash/bin/logstash --path.settings /etc/logstash -f /etc/logstash/conf.d/log4j.conf &　#後臺

配置：/etc/logstash/conf.d/*.conf

實例：Tomcat or Jetty的log4j配置

log4j.rootLogger=DEBUG, A1, logstash
###SocketAppender###
log4j.appender.logstash=org.apache.log4j.net.SocketAppender
log4j.appender.logstash.Port=4560
log4j.appender.logstash.RemoteHost=127.0.0.1
log4j.appender.logstash.ReconnectionDelay=60000
log4j.appender.logstash.LocationInfo=true

log4j.conf

Elasticsearch

安裝：rpm -ivh elasticsearch-5.4.1.rpm

路徑：/usr/share/elasticsearch

配置：/etc/elasticsearch/elasticsearch.yml

啓動：service elasticsearch start

實例：elasticsearch_nodel配置

# ---------------------------------- Cluster -----------------------------------
cluster.name: Elastic Search
# ------------------------------------ Node -----------------------------------
node.name: node-1
# ----------------------------------- Paths ------------------------------------
path.data: /tmp/elasticsearch/data
path.logs: /tmp/elasticsearch/logs
# ---------------------------------- Network ----------------------------------
network.host: 10.124.0.97#localhost
http.port: 9200

elasticsearch.yml

Kibana

安裝：rpm -ivh kibana-5.4.1-x86_64.rpm

路徑：/usr/share/kibana

配置：/etc/kibana/elasticsearch.yml

啓動：service kibana restart

實例：kibana.yml配置

server.port: 5601
server.host: "10.124.0.97"
elasticsearch.url: "http://10.124.0.97:9200" #localhost:9200
kibana.index: ".kibana"

kibana.yml