filebeat+elasticsearch+kibana搭建:
elastic官网:
https://www.elastic.co/downloads
filebeat:
Filebeat是一个日志文件托运工具,在你的服务器上安装客户端后,filebeat会监控日志目录或者指定的日志文件,追踪读取这些文件,并且转发这些信息到elasticsearch或者logstarsh中存放。
下载地址(注意和elasticsearch版本保持一致):
https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.6.7-x86_64.rpm
https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.6.7-amd64.deb
rpm -i filebeat-5.6.7-x86_64.rpm
vi /etc/filebeat/filebeat.yml (Elasticsearch output)
username: "elastic"
password: "changeme"
:wq
service filebeat restart
elasticsearch:
Elasticsearch是一个分布式搜索服务
下载网址:
https://www.elastic.co/downloads/past-releases/elasticsearch-5-6-7
yum install java-1.8.0-openjdk
rpm -i elasticsearc-5.6.7-x86_64.rpm
/usr/share/elasticsearch/bin/elasticsearch-plugin install x-pack
service elasticsearch start
chkconfig --level 35 elasticsearch on
curl http://localhost:9200
elastic账号的默认密码为changeme
导入filebeat模板:
curl -u elastic -XPUT 'http://localhost:9200/_template/filebeat?pretty' -d@/etc/filebeat/filebeat.template.json
查看所有index:
curl http://localhost:9200/_cat/indices?v
创建icinga2索引:
curl -XPUT http://localhost:9200/icinga2
删除icinga2索引:
curl -XDELETE http://localhost:9200/icinga2
kibana(kibana需和elasticsearch版本保持一致):
Kibana是一套分析与可视化平台,构建于Elasticsearch之上,旨在帮助用户更好地实现数据理解。
下载网址:
https://artifacts.elastic.co/downloads/kibana/kibana-5.6.7-x86_64.rpm
rpm -i kibana-5.6.7-x86_64.rpm
/usr/share/kibana/bin/kibana-plugin install x-pack
vi /etc/kibana/kibana.yml
server.port: 5601 (默认为注释掉的)
server.host: "10.0.0.2" (默认为注释掉的,并改为ip)
elasticsearch.url: "http://localhost:9200" (默认为注释掉的)
kibana.index: ".kibana" (默认为注释掉的)
:wq
service kibana restart
页面访问:http://10.0.0.2:5601 (用户名:elastic 密码:changeme)
本文转自linux博客51CTO博客,原文链接http://blog.51cto.com/yangzhiming/2070665如需转载请自行联系原作者
yangzhimingg