1.用户创建
useradd ctl
passwd ctl
准备包
wget https://artifacts.elastic.co/downloads/kibana/kibana-6.8.15-linux-x86_64.tar.gz
curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.15.tar.gz
curl -L -O https://artifacts.elastic.co/downloads/logstash/logstash-6.8.15.tar.gz
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.8.15-linux-x86_64.tar.gz
2.环境变量设置
vim /etc/profile
export JAVA_HOME=/home/software/jdk1.8.0_261
export PATH=$JAVA_HOME/bin:$PATH
vim /etc/security/limits.conf
* soft nofile 100000
* hard nofile 100000
* soft nproc 100000
* hard nproc 100000
* soft core 100000
* hard core 100000
ctl soft memlock unlimited
ctl hard memlock unlimited
vi /etc/sysctl.conf
vm.max_map_count=655360 然后执行sysctl -p
修改完需要关闭ssh连接重新进入
3.配置elasticsearch
cp elasticsearch.yml elasticsearch.yml.back
node.name: node-1 //注释去除
network.host: 192.168.3.9 //修改
http.port: 9200 //注释去除
bootstrap.memory_lock: false //修改
./elasticsearch -d 静默启动
http://192.168.3.9:9200 验证elasticsearch启动成功
4.配置logstash
cp logstash-sample.conf logstash.conf
修改 logstash.conf
hosts => ["http://192.168.3.9:9200"]
/home/ctl/logstash-6.8.15/bin/logstash -f /home/ctl/logstash-6.8.15/config/logstash.conf &
5.配置kibana
cp kibana.yml kibana.yml.back
server.port: 5601 //注释去除
server.host: "192.168.3.9" //修改
elasticsearch.hosts: ["http://192.168.3.9:9200"] //修改
/home/ctl/kibana-6.8.15-linux-x86_64/bin/kibana 启动服务
6.配置filebeat
cp filebeat.yml filebeat.yml.back
hosts: ["192.168.3.9:9200"] //修改
enabled: true //修改
paths: //修改指定要汇总到logstash的日志
- /root/tomcat/logs/catalina.out
执行
./filebeat setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["192.168.3.9:9200"]' (当filebeats配合logstash使用，需要手动load the index template in ElasticSearch，就是filberts直连ElasticSearch load 数据，命令如上)
/root/filebeat-6.8.15-linux-x86_64/filebeat -e -c /root/filebeat-6.8.15-linux-x86_64/filebeat.yml
7.查看日志
上面两个命令执行后看到新建index
就可以看到日志了
链接: https://pan.baidu.com/s/14GvLQl6JabW-mARsSo59Cg 提取码: e7j7 复制这段内容后打开百度网盘手机App，操作更方便哦