在Ubuntu 14.04 上安装单机版ELK 2.*（脚本化）

1.判断是否为root权限

if [ "${UID}" -ne 0 ];

then

    echo "You must be root to run this program." >&2

    exit 3

fi

2.记录脚本运行日志（可以在ubuntu日志中找到对应的运行信息）

log()

{

	echo "$1"

	logger "$1"

}

3.设置脚本运行参数

# Set the VM name for the elasticsearch network.host

# Set the host name instead of internal ip

while getopts n:e: optname; do

    log "Option $optname set with value ${OPTARG}"

  case $optname in

    n)  #set the encoded configuration string

	  log "Setting the VM Name"

      VMNAME=${OPTARG}

      ;;

    e)  #set the encoded configuration string

	  log "Setting the encoded configuration string"

      CONF_FILE_ENCODED_STRING=${OPTARG}

      ;;

    \?) #unrecognized option - show help

      echo -e \\n"Option -${BOLD}$OPTARG${NORM} not allowed."

      help

      exit 2

      ;;

  esac

done

4.安装java 8

#install java8

install_java()

{

log "begin install java8"

sudo add-apt-repository -y ppa:webupd8team/java

sudo apt-get -y update  > /dev/null

echo debconf shared/accepted-oracle-license-v1-1 select true | sudo debconf-set-selections

echo debconf shared/accepted-oracle-license-v1-1 seen true | sudo debconf-set-selections

sudo apt-get -y install oracle-java8-installer > /dev/null

log "java8 has been installed"

}

5.安装Elasticsearch，配置Elasticsearch的主要参数

install_config_elasticsearch()

{

log "begin install elasticsearch"

wget -qO - https://packages.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

echo "deb http://packages.elastic.co/elasticsearch/2.x/debian stable main" | sudo tee -a /etc/apt/sources.list.d/elasticsearch-2.x.list

sudo apt-get update

sudo apt-get -y install elasticsearch

# configure the elasticsearch

sudo echo "bootstrap.mlockall: true" >> /etc/elasticsearch/elasticsearch.yml

sudo echo "network.host: $VMNAME" >> /etc/elasticsearch/elasticsearch.yml

sudo echo "http.port: 9200" >> /etc/elasticsearch/elasticsearch.yml

# configure elasticsearch heap

log "elasticsearch.yml has been configured . The elasticsearch heap begin to configure"

es_heap_size=$(free -m |grep Mem | awk '{if ($2/2 >31744)  print 31744;else print $2/2;}')

sudo printf "\nES_HEAP_SIZE=%sm\n" $es_heap_size >> /etc/default/elasticsearch

sudo printf "MAX_LOCKED_MEMORY=unlimited\n" >> /etc/default/elasticsearch

sudo echo "elasticsearch - nofile 65536" >> /etc/security/limits.conf

sudo echo "elasticsearch - memlock unlimited" >> /etc/security/limits.conf

log "es heap has been set"

sudo service elasticsearch restart

sudo update-rc.d elasticsearch defaults 95 10

log "elasticsearch has been installed"

}

6.安装主要插件，可选。

install_plugin()

{

cd /usr/share/elasticsearch/

sudo bin/plugin install lmenezes/elasticsearch-kopf

sudo bin/plugin install mobz/elasticsearch-head

sudo bin/plugin install license

sudo bin/plugin install watcher

#install marvel part0

sudo bin/plugin install marvel-agent

cd

}

7.安装配置kibana

install_config_kibana()

{

#install kibana

log "begin to install kibana"

echo "deb http://packages.elastic.co/kibana/4.4/debian stable main" | sudo tee -a /etc/apt/sources.list.d/kibana-4.4.x.list

sudo apt-get update

sudo apt-get -y install kibana

#configure kibana

# take care of the server.host name

sudo echo "server.host: '$VMNAME'" >> /opt/kibana/config/kibana.yml

sudo echo "elasticsearch.url: 'http://$VMNAME:9200'" >> /opt/kibana/config/kibana.yml

sudo update-rc.d kibana defaults 96 9

sudo service kibana start

#install marvel part1 . marvel need to be installed after kibana was done.

sudo bin/kibana plugin --install elasticsearch/marvel/2.1.0

log "kibana has been installed"

}

8.安装配置logstash

install_logstash()

{

# Install Logstash

# The Logstash package is available from the same repository as Elasticsearch . Install the public  key.

# Create the logstash source list

wget -qO - https://packages.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

log "begin to install logstash"

echo 'deb http://packages.elastic.co/logstash/2.2/debian stable main' | sudo tee /etc/apt/sources.list.d/logstash-2.2.x.list

sudo apt-get update

sudo apt-get install logstash

#configure

log "Decoding configuration string"

log "$CONF_FILE_ENCODED_STRING"

echo $CONF_FILE_ENCODED_STRING > logstash.conf.encoded

DECODED_STRING=$(base64 -d logstash.conf.encoded)

log "$DECODED_STRING"

echo $DECODED_STRING > ~/logstash.conf

#log "Installing user configuration file"

log "Installing user configuration named logstash.conf"

sudo \cp -f ~/logstash.conf /etc/logstash/conf.d/

# Configure Start

log "Configure start up service"

sudo update-rc.d logstash defaults 96 9

sudo service logstash start

}

9.运行方式

• 如果你不太熟悉，可以分段或分句复制，type到命令行然后运行。
• 如果你较为熟悉，可以复制整理所有的函数到一个elk.sh脚本中并调用，如下：

sudo bash elk.sh -n {parameter1} -e {parameter2}

#parameter1 是hostname

#parameter2 是logstash的配置文件，此处你可以简单带入如下：

"aW5wdXQgIHsgICBzdGRpbiB7fSB9IG91dHB1dCB7ICAgc3Rkb3V0IHsgY29kZWMgPT4gcnVieWRlYnVnIH0gfQ=="

#该字符串解码后为input { stdin {} } output { stdout { codec => rubydebug } }

#logstash无默认的配置文件，无法启动服务。因此需要导入一个简单的配置。然后根据后续进行修改