elk-6.8.1安裝-centos-7.6

下載rpm包
官方地址
https://www.elastic.co/cn/downloads/past-releases#kibana
騰訊鏡像地址（下載速度快）
https://mirrors.cloud.tencent.com/elasticstack/6.x/yum/6.8.1/

安裝elasticsearch

wget https://mirrors.cloud.tencent.com/elasticstack/6.x/yum/6.8.1/elasticsearch-6.8.1.rpm
rpm -ivh elasticsearch-6.8.1.rpm
修改配置文件簡單配置如下值

cat /etc/elasticsearch/elasticsearch.yml |grep -v ^#
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 172.16.0.43
http.port: 9200

啓動
systemctl start elasticsearch.service
此處會有報錯，多是編譯安裝的java須要手動指定變量值
/etc/profile寫入變量也未生效 報錯信息以下

journalctl -u elasticsearch.service
...
Jul 05 15:20:47 ol43 elasticsearch[20037]: which: no java in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin)
Jul 05 15:20:47 ol43 elasticsearch[20037]: warning: Falling back to java on path. This behavior is deprecated. Specify JAVA_H
Jul 05 15:20:47 ol43 elasticsearch[20037]: could not find java; set JAVA_HOME
...

手動指定變量值

head -n 2 /usr/share/elasticsearch/bin/elasticsearch-env
#!/bin/bash
JAVA_HOME=/usr/local/jdk1.8.0_202

啓動
systemctl start elasticsearch.service
驗證

curl 172.16.0.43:9200
{
  "name" : "azFRc7L",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "s8nLQgc_SWqSoRa5u7fqCg",
  "version" : {
    "number" : "6.8.1",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "1fad4e1",
    "build_date" : "2019-06-18T13:16:52.517138Z",
    "build_snapshot" : false,
    "lucene_version" : "7.7.0",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  },
  "tagline" : "You Know, for Search"
}

啓動成功

---

安裝kibana

wget https://mirrors.cloud.tencent.com/elasticstack/6.x/yum/6.8.1/kibana-6.8.1-x86_64.rpm
rpm -ivh kibana-6.8.1-x86_64.rpm
修改配置文件

cat /etc/kibana/kibana.yml |grep -Ev '^#|^$'
server.port: 5601
server.host: "172.16.0.43"
elasticsearch.hosts: ["http://172.16.0.43:9200"]

啓動
systemctl start kibana
驗證
瀏覽器訪問
172.16.0.43:5601

安裝filebeat

wget https://mirrors.cloud.tencent.com/elasticstack/6.x/yum/6.8.1/filebeat-6.8.1-x86_64.rpm
rpm -ivh filebeat-6.8.1-x86_64.rpm
修改配置文件

cat /etc/filebeat/filebeat.yml |grep -Ev '^#|^$|#'
filebeat.inputs:
- type: log
  enabled: false
  paths:
    - /var/log/*.log
- type: log
  enabled: true
  paths:
    - /opt/jar/app-service/app-service.log
  fields:
    doc_type: app-service
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
setup.kibana:
output.elasticsearch:
  hosts: ["172.16.0.43:9200"]

啓動
systemctl start filebeat
驗證
手動到kibana上查看索引
點擊index patterns

---

點擊 create index patterns 能看到對應記錄即爲成功

---

爲kibana添加登錄驗證

htpasswd -c /opt/app/nginx/conf/conf.d/.kibana-user admin
nginx配置

server {
    listen 80;

    server_name elk.888.com;

    auth_basic "Restricted Access";
    auth_basic_user_file /opt/app/nginx/conf/conf.d/.kibana-user;

    location / {
        proxy_pass http://172.16.0.43:5601; 
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

---

登錄驗證效果以下

---