手動配置ETK過程

1：安裝elasticsearch

到官網上下載最新的elasticsearch-5.4.0:
cd /home/soft
mkdir elasticsearch
cd elasticsearch 
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.4.0.tar.gz
tar xzvf elasticsearch-5.4.0.tar.gz
cd elasticsearch-5.4.0
./bin/elasticsearch
此時若是服務器的內存大於2g的話，則不會報內存heap size [268435456] not equal to maximum heap size [2147483648]的問題，若是報了，則須要修改：
vi ./config/jvm.options 
修改內存：
#-Xms2g
#-Xmx2g
-Xms256m
-Xmx256m

再次啓動，若是報如下錯誤：
max file descriptors [65535] for elasticsearch process is too low, increase to at least [65536]
則編輯一下文件：
vi  /etc/security/limits.conf
在文件末尾，新增以下內容：
* soft nofile 65536
* hard nofile 131072
* soft nproc 2048
* hard nproc 4096

elasticsearch-5.4.0在配置外網能夠訪問的時候，已經將配置：
network.host: xxx.xxx.xxx.xxx
http.port: 9200
啓動仍是報錯，報錯信息以下：
 [2017-05-12T09:49:32,544][INFO ][o.e.b.BootstrapChecks    ] [node-1] bound or publishing to a non-loopback or non-link-local address, enforcing bootstrap checks
ERROR: bootstrap checks failed
system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk

須要修改配置文件：
vi /home/soft/elastic/elasticsearch-5.4.0/config/elasticsearch.yml添加如下代碼：
discovery.zen.ping.unicast.hosts: ["xxx.xxx.xxx.xxx"]
discovery.zen.minimum_master_nodes: 3
bootstrap.system_call_filter: false
啓動服務：
cd /home/soft/elasticsearch
nohup ./elasticsearch-5.4.0/bin/elasticsearch &

2：安裝logstash
到官網上下載最新的logstash5.4.0,
cd /home/soft
mkdir logstash
cd logstash
wget https://artifacts.elastic.co/downloads/logstash/logstash-5.4.0.tar.gz
tar xzvf logstash-5.4.0.tar.gz
cd logstash-5.4.0
mkdir customer_conf
vi logstash_nginx.conf
輸入如下內容，配置簡單的讀取nginx日誌文件：
input {
        file {
                type => "nginx access log"
                path => ["/home/wwwlogs/access.log"]  #nginx日誌路徑
        }
}
filter {
  #Only matched data are send to output.
}
output {
    elasticsearch {
        hosts => ["127.0.0.1:9200"]
        index => "logstash-nginx-access-%{+YYYY.MM.dd}"
    }
    stdout {codec => rubydebug}
}

若是服務器內存不夠或者報內存溢出的話，須要調低內存配置，編輯一下配置文件：
vi /home/soft/logstash/logstash-5.4.0/config/jvm.options 
修改如下內容：
#-Xms256m
#-Xmx1g
-Xms100m
-Xmx200m

而後啓動服務：
cd /home/soft/logstash
nohup ./logstash-5.4.0/bin/logstash -f logstash-5.4.0input_data_conf/logstash_agent.conf &

3：安裝kibana
cd /home/soft
mkdir kibana
cd kibana
wget https://artifacts.elastic.co/downloads/kibana/kibana-5.4.0-linux-x86_64.tar.gz
tar xzvf kibana-5.4.0-linux-x86_64.tar.gz

編輯kibana配置文件
vi  kibana-5.4.0-linux-x86_64/config/kibana.yml 
配置如下內容：
server.host = xxx.xxx.xxx.xxx(IP地址)
elasticsearch.url: "http://localhost:9200"

啓動服務：
cd /home/soft/kibana
nohup ./kibana-5.4.0-linux-x86_64/bin/kibana &

經過瀏覽器訪問:xxx.xxx.xxx:5601便可