ELK日誌分析平臺搭建全程
阿新 • • 發佈:2017-10-26
elk
環境:
OS:Centos 6.6
elasticsearch-5.6.3.tar.gz
jdk-8u151-linux-x64.tar.gz
kibana-5.6.3-linux-x86_64.tar.gz
logstash-5.6.3.tar.gz
node-v6.11.4-linux-x64.tar.xz
一、準備環境:
1、創建用戶,並給安裝目錄設置權限
[root@1inux ~]# groupadd elk [root@1inux ~]# useradd -g elk elk [root@1inux ~]# mkdir /elk [root@1inux ~]# chown -R elk:elk /elk
修改系統某些參數值:【如不修改啟動時會報錯】
[root@1inux ~]# vim /etc/security/limits.conf //添加一下內容 --------------------------- * soft nofile 65536 * hard nofile 65536 * soft nproc 2048 * hard nproc 4096 ---------------------------- [root@bogon elk]# vim /etc/security/limits.d/90-nproc.conf //添加如下內容 * soft nproc 2048 [root@1inux ~]# vim /etc/sysctl.conf // 添加一下內容 ------------------ vm.max_map_count=655360 ---------------------- [root@1inux ~]# sysctl -p // 查看vm.max_map_count 值是否修改成功
安裝Java
[root@1inux elk]# mkdir /usr/local/Java
[root@1inux elk]# tar -zxvf jdk-8u151-linux-x64.tar.gz -C /usr/local/Java
添加環境變量:
[root@1inux jdk1.8.0_151]# vim /etc/profile
添加如下:
export JAVA_HOME=/usr/local/Java/jdk1.8.0_151 export PATH=$PATH:$JAVA_HOME/bin exportCLASSPATH=.:$JAVA_HOME/lib/tools.jar:$JAVA_HOME/lib/dt.jar:$CLASSPAT
重新加載
[root@1inux jdk1.8.0_151]# source /etc/profile
查看是否安裝成功:
[root@1inux jdk1.8.0_151]# java -version java version "1.8.0_151" Java(TM) SE Runtime Environment (build 1.8.0_151-b12) Java HotSpot(TM) 64-Bit Server VM (build 25.151-b12, mixed mode)
二:安裝ELK
1、安裝elasticsearch
# tar -zxvf elasticsearch-5.6.3.tar.gz 修改配置文件: vim ./elasticsearch-5.6.3/config/elasticsearch.yml //設置監聽IP及監聽端口: network.host: 0.0.0.0 // 設置監聽IP http.port: 9200 //設置監聽端口
註:elasticsearch不能使用root用戶啟動
啟動elasticsearch //第一次啟動有點慢:
[elk@1inux root]$ cd /elk/elasticsearch-5.6.3/bin [elk@1inux bin]$ ./elasticsearch 然後查看端口: [root@1inux ~]# ss -tnl | grep 9200 LISTEN 0 128 ::ffff:192.168.159.130:9200 :::* [root@1inux ~]#
2、安裝kibana
[root@1inux elk]# tar -zxvf kibana-5.6.3-linux-x86_64.tar.gz
解壓後編輯配置文件; [root@1inux bin]# vim ../config/kibana.yml //修改為 elasticsearch 的訪問地址及端口如下 #server.host: "localhost" server.host: "192.168.159.130" #elasticsearch.url: "http://localhost:9200" elasticsearch.url: "
然後保存啟動如下;
[root@1inux bin]# ./kibana log [15:45:26.952] [info][status][plugin:[email protected]] Status changed from uninitialized to green - Ready log [15:45:27.067] [info][status][plugin:[email protected]] Status changed from uninitialized to yellow - Waiting for Elasticsearch log [15:45:27.118] [info][status][plugin:[email protected]] Status changed from uninitialized to green - Ready log [15:45:27.136] [info][status][plugin:[email protected]] Status changed from uninitialized to green - Ready log [15:45:27.566] [info][status][plugin:[email protected]] Status changed from uninitialized to green - Ready log [15:45:27.697] [info][listening] Server running at http://localhost:5601 log [15:45:27.699] [info][status][ui settings] Status changed from uninitialized to yellow - Elasticsearch plugin is yellow
3、安裝 logstash-5.6.3.tar.gz
[root@1inux elk]# tar -zxvf logstash-5.6.3.tar.gz 解壓後編輯配置文件,然後就可以使用了
報錯:
1、
[root@bogon elk]# ./elasticsearch-5.6.3/bin/elasticsearch [2017-10-25T06:29:04,996][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main] org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
解決方案:使用elk用戶啟動
問題二、
ERROR: [4] bootstrap checks failed [1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536] [2]: max number of threads [1024] for user [elk] is too low, increase to at least [2048] [3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144] [4]: system call filters failed to install; check the logs and fix your configuration or disable system call filters k 參考上面系統修改
本文出自 “無常” 博客,請務必保留此出處http://1inux.blog.51cto.com/10037358/1976229
ELK日誌分析平臺搭建全程