准备环境：两台centos7
规划如下：
ip地址：
服务端：192.168.232.135：
jdk
kibana
logstash
elasticsearch
redis
192.168.232.136：
jdk
elasticsearch
filebeat
Apache
1.关闭防火墙：
1systemctl stop firewalld 2setenforce 0
2.上传ELK压缩包并解压：
3.安装jdk（两台都安装）
[root@localhost ELK]# rpm -ivh jdk-8u131-linux-x64_.rpm
4.安装elasticsearch（两台都装）
rpm -ivh elasticsearch-6.6.2.rpm
5.配置192.168.232.135的elasticsearch配置文件
[root@localhost ELK]# vim /etc/elasticsearch/elasticsearch.yml
开启elasticsearch
[root@localhost ELK]# systemctl start elasticsearch
验证：
5.1配置192.168.232.136的elasticsearch配置文件
开启elasticsearch
[root@localhost ELK]# systemctl start elasticsearch
验证：
6.服务端安装redis
1[root@localhost ~]# tar zxf redis-5.0.0.tar.gz 2[root@localhost ~]# cp -r redis-5.0.0 /usr/local/redis 3[root@localhost ~]# cd /usr/local/redis/ 4[root@localhost redis]# yum -y install gcc-c++ 5[root@localhost redis]# make 6[root@localhost redis]# make MALLOC=libc 71.给redis做软链接 8 [root@localhost redis]# ln -sv /usr/local/redis/src/redis-server /usr/bin/redis- server 9 "/usr/bin/redis-server" -> "/usr/local/redis/src/redis-server" 10 [root@localhost redis]# ln -sv /usr/local/redis/src/redis-cli /usr/bin/redis-cli 11 "/usr/bin/redis-cli" -> "/usr/local/redis/src/redis-cli" 122.修改配置文件 13 [root@localhost redis]# vim /usr/local/redis/redis.conf 14 69行修改： 15 bind 192.168.232.135 16 508行添加： 17 requirepass 123321 18 3.启动redis： 19 [root@localhost redis]# redis-server ./redis.conf 20 4.把511追加到/proc/sys/net/core/somaxconn： 21 [root@localhost redis]# echo 511 >> /proc/sys/net/core/somaxconn 22 5.去/etc/sysctl.conf最后一行添加下面命令： 23 [root@localhost redis]# vim /etc/sysctl.conf 24 vm.overcommit_memory = 1 25 6.在/etc/rc.local里面添加： 26 echo never > /sys/kernel/mm/transparent_hugepage/enabled 27 7.进入redis配置文件136行将daemonize no修改为yes 28 [root@localhost redis]# vim /usr/local/redis/redis.conf 29 136行将daemonize no修改为daemonize yes 30 8.重启redis： 31 [root@localhost redis]# redis-server ./redis.conf 32 9.测试： 33 192.168.232.135:6379> auth 123321 34 OK 35 192.168.232.135:6379> get * 36 (nil) 37
7.客户端安装httpd并启动：
1[root@localhost ELK]# yum -y install httpd 2[root@localhost ELK]# systemctl start httpd
8.客户端安装filebeat：
[root@localhost ~]# rpm -ivh filebeat-6.8.1-x86_64.rpm
9.配置filebeat.yml文件收集httpd的日志
1[root@localhost ~]# cd /etc/filebeat/ 2备份一份原配置文件，以防改错： 3[root@localhost filebeat]# cp filebeat.yml filebeat.yml.bak 4[root@localhost filebeat]# vim filebeat.yml 5filebeat.inputs: 6- type: log 7 enabled: true 8 paths: 9 - /var/log/httpd/access_log 10filebeat.config.modules: 11 path: ${path.config}/modules.d/*.yml 12 reload.enabled: false 13 setup.ilm.enabled: false 14 setup.template.name: "filebeat-httpd" 15 setup.template.pattern: "filebeat-httpd-*" 16setup.template.settings: 17 index.number_of_shards: 3 18setup.kibana: 19output.redis: 20 hosts: ["192.168.232.135:6379"] 21 key: "filebeat-httpd" 22 db: 1 23 timeout: 5 24 password: 123321 25 26processors: 27 - add_host_metadata: ~ 28 - add_cloud_metadata: ~
10.服务端安装logstash
[root@localhost ELK]# rpm -ivh logstash-6.6.0.rpm
11.配置logstash文件添加httpd的索引
1[root@localhost ELK]# cd /etc/logstash/conf.d/ 2[root@localhost conf.d]# vim httpd.conf 3input { 4 5 6 redis { 7 8 9 data_type => "list" 10 host => "192.168.232.135" 11 password => "123321" 12 port => "6379" 13 db => "1" 14 key => "filebeat-httpd" 15 } 16} 17 18output { 19 20 21 22 elasticsearch { 23 24 25 hosts => ["192.168.232.135:9200"] 26 index => "redis-httpdlog-%{+YYYY.MM.dd}" 27 28 29 30 31 } 32} 33
12.开启logstash并验证：
11.[root@localhost conf.d]# systemctl start logstash 22.[root@localhost conf.d]# netstat -nltp |grep 9600
13.安装kibana：
1.[root@localhost ELK]# rpm -ivh kibana-6.6.2-x86_64.rpm
13.1.修改kibana配置文件：
[root@localhost ELK]# vim /etc/kibana/kibana.yml
13.2.开启kibana服务并验证：
1[root@localhost ELK]# systemctl start kibana 2[root@localhost ELK]# netstat -nltp |grep 5601
14.http://192.168.232.135:5601/浏览器访问kibana页面：
附加：如果进入页面之后索引出不来就进入httpd网页刷新页面httpd索引就会出来了
