CentOS 6 安装ELK(Elastic Search、Logstash、Kibana)
首先安装 java环境
yum install java-1.7.0-openjdk httpd unzip
安装Elastic Search
下载公钥
rpm --import http://packages.elasticsearch.org/GPG-KEY-elasticsearch
在 /etc/yum.repos.d/ 目录下新增档案，例如 elasticsearch.repo，内容如下
vi /etc/yum.repos.d/elasticsearch.repo
[elasticsearch-1.3]
name=Elasticsearch repository for 1.3.x packages
baseurl=http://packages.elasticsearch.org/elasticsearch/1.3/centos
gpgcheck=1
gpgkey=http://packages.elasticsearch.org/GPG-KEY-elasticsearch
enabled=1
安装Elastersearch
yum install elasticsearch
设定Elasticsearch
编辑 /etc/elasticsearch/elasticsearch.yml
vi /etc/elasticsearch/elasticsearch.yml
cluster.name: "LogCluster"
node.name: "LogMaster"
node.master: true
node.data: true
path.conf: /etc/elasticsearch
path.data: /datapool/data1
path.work: /datapool/work
path.logs: /datapool/log
mkdir /datapool
mkdir /datapool/data1
mkdir /datapool/work
mkdir /datapool/log
将服务加入系统
chkconfig --add elasticsearch
启动服务
/etc/init.d/elasticsearch start
测试启动是否成功
curl localhost:9200/_nodes/process?pretty
安装Logstash
安装金钥
rpm --import http://packages.elasticsearch.org/GPG-KEY-elasticsearch
在 /etc/yum.repos.d/ 目录下新增档案，例如 logstash.repo，内容如下
vi /etc/yum.repos.d/logstash.repo
[logstash-1.4]
name=logstash repository for 1.4.x packages
baseurl=http://packages.elasticsearch.org/logstash/1.4/centos
gpgcheck=1
gpgkey=http://packages.elasticsearch.org/GPG-KEY-elasticsearch
enabled=1
安装Logstash
yum install logstash
配置logstash，如下是Logstash的配置文件
vi /etc/logstash/conf.d/logstasg_access.conf
input {
file {
path => "/var/log/httpd/access_log"
type => "apache" # a type to identify those logs (will need this later)
}
}
filter {
if [type] == "apache" { # this is where we use the type from the input section
grok {
match => [ "message", "%{COMBINEDAPACHELOG}" ]
}
date {
# Try to pull the timestamp from the 'timestamp' field (parsed above with
# grok). The apache time format looks like: "18/Aug/2011:05:44:34 -0700"
match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
}
if [user-agent] != "-" and [user-agent] != "" {
useragent {
add_tag => [ "UA" ]
source => "user-agent"
}
}
if "UA" in [tags] {
if [device] == "Other" { mutate { remove_field => "device" } }
if [name] == "Other" { mutate { remove_field => "name" } }
if [os] == "Other" { mutate { remove_field => "os" } }
}
}
}
output {
elasticsearch {
host => "localhost"
cluster => "LogCluster"
node_name => "LogMaster"
}
}
启动 logstash 服务
cd /opt/logstash/bin/
./logstash -f /etc/logstash/conf.d/logstasg_access.conf
安装Kibana
wget https://download.elasticsearch.org/kibana/kibana/kibana-3.1.2.zip && unzip kibana-3.1.2.zip && mv kibana-3.1.2 kibana && mv kibana /var/www/html/
设定apache
vi /etc/httpd/conf/httpd.conf
ServerAdmin admin@opsnotes.com
DocumentRoot /var/www/html/kibana
ServerName kibana.opsnotes.net
ErrorLog logs/kibana.opsnotes.net-error_log
CustomLog logs/kibana.opsnotes.net-access_log common
设定防火墙
#
# 开启HTTP 80 port
#
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
#
# 设定ElasticSearch使用的port 9200-9300
#
iptables -A INPUT -p tcp --dport 9200:9300 -j ACCEPT
重启 apache 服务
service httpd restart
建立第一个Logstash设定档
安装完ELK之后，可以尝试建立第一个设定档。由于Kibana是设定在Apache服务中，我们就先拿apache access log来测试(位于 /var/log/httpd/access_log)
请到 /etc/logstash/conf.d 目录下新增第一个设定档，名称可以任意定，例如 apache_access.conf。主要分成叁个段落
input : 设定输入的类型、位置等资讯
以档案 file 的形式输入
指定档案位置
filter : 设定解析的方式、衍生栏位等
logstash已经有内建解析access log的方式，请直接用 grok 的设定。
output : 输出的位置
本範例直接输出到 elasticsearch 中
若您的elasticsearch有指定 cluster名称及node名称，请记得设定在这边，以免找不到服务。
input {
file {
path => "/var/log/httpd/access_log"
type => "apache" # a type to identify those logs (will need this later)
}
}
filter {
if [type] == "apache" { # this is where we use the type from the input section
grok {
match => [ "message", "%{COMBINEDAPACHELOG}" ]
}
}
}
output {
elasticsearch {
host => "localhost"
cluster => "LogCluster"
node_name => "LogMaster"
}
}
设定完成后，还要修改 /etc/init.d/logstash ，将启动的使用者及群组改为root，以免权限不足没办法读取access_log。
LS_USER=root
LS_GROUP=root
最后重新启动logstash服务
# service logstash restart
Killing logstash (pid 1993) with SIGTERM
Waiting logstash (pid 1993) to die...
Waiting logstash (pid 1993) to die...
logstash stopped.
logstash started.
- 评论列表（网友评论仅供网友表达个人看法，并不表明本站同意其观点或证实其描述）
要顶的啊，博主辛苦了，谢谢
看看吧，大家都会支持你