1、安装配置java
[root@elk ~]# yum install java-1.8.0-openjdk.x86_64 -y
[root@elk ~]# java -version
openjdk version "1.8.0_212"
OpenJDK Runtime Environment (build 1.8.0_212-b04)
OpenJDK 64-Bit Server VM (build 25.212-b04, mixed mode)
2、更新时间
yum install ntpdate -y
ntpdate time1.aliyun.com
3、安装配置elasticsearch
[root@elk ~]# mkdir elk_package
[root@elk ~]# cd elk_package
[root@elk elk_package]# ll
-rw-r--r--. 1 root root 114059630 Dec 21 10:26 elasticsearch-6.6.0.rpm
-rw-r--r--. 1 root root 185123116 Dec 21 10:26 kibana-6.6.0-x86_64.rpm
[root@elk elk_package]# rpm -ivh elasticsearch-6.6.0.rpm
warning: elasticsearch-6.6.0.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY
Preparing... ################################# [100%]
Creating elasticsearch group... OK
Creating elasticsearch user... OK
Updating / installing...
1:elasticsearch-0:6.6.0-1 ################################# [100%]
### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using systemd
sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
### You can start elasticsearch service by executing
sudo systemctl start elasticsearch.service
Created elasticsearch keystore in /etc/elasticsearch
4、相关配置目录及配置文件
[root@elk elk_package]# rpm -qc elasticsearch
/etc/elasticsearch/elasticsearch.yml
/etc/elasticsearch/jvm.options
/etc/elasticsearch/log4j2.properties
/etc/elasticsearch/role_mapping.yml
/etc/elasticsearch/roles.yml
/etc/elasticsearch/users
/etc/elasticsearch/users_roles
/etc/init.d/elasticsearch
/etc/sysconfig/elasticsearch
/usr/lib/sysctl.d/elasticsearch.conf
/usr/lib/systemd/system/elasticsearch.service
5、ES配置文件（home目录下空间较大，把data和log文件配置在home目录下）
mkdir -p /home/elasticsearch/{data,log}
chown -R elasticsearch.elasticsearch elasticsearch
root@elk elk_package]# vim /etc/elasticsearch/elasticsearch.yml
root@elk elk_package]# grep ^[a-z] /etc/elasticsearch/elasticsearch.yml
node.name: node-1
path.data: /home/elasticsearch/data/elasticsearch
path.logs: /home/elasticsearch/log/elasticsearch
bootstrap.memory_lock: true
network.host: 192.168.67.8,127.0.0.1
http.port: 9200
#配置指定内存值
vim /etc/elasticsearch/jvm.options
[root@elk-175 soft]# systemctl daemon-reload
[root@elk-175 soft]# systemctl enable elasticsearch.service
Created symlink from /etc/systemd/system/multi-user.target.wants/elasticsearch.service to /usr/lib/systemd/system/elasticsearch.service.
6、修改启动配置文件（注意解决锁定内存失败tail -f /var/log/elasticsearch/Linux.log）
vim /usr/lib/systemd/system/elasticsearch.service
#增加如下参数
[Service]
LimitMEMLOCK=infinity
#重新启动
systemctl daemon-reload
systemctl enable elasticsearch.service
systemctl start elasticsearch
systemctl status elasticsearch
7、检查启动是否成功
9200作为Http协议，主要用于外部通讯
9300作为Tcp协议，jar之间就是通过tcp协议通讯
ES集群之间是通过9300进行通讯
[root@elk-175 ~]# netstat -lntup|grep 9200
tcp6 0 0 192.168.67.8:9200 :::* LISTEN 15824/java
tcp6 0 0 127.0.0.1:9200 :::* LISTEN 15824/java
[root@elk-175 ~]# curl localhost:9200
{
"name" : "node-1",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "As5ZlEQ2Syq0ktLL0hg5XA",
"version" : {
"number" : "6.6.0",
"build_flavor" : "default",
"build_type" : "rpm",
"build_hash" : "a9861f4",
"build_date" : "2019-01-24T11:27:09.439740Z",
"build_snapshot" : false,
"lucene_version" : "7.6.0",
"minimum_wire_compatibility_version" : "5.6.0",
"minimum_index_compatibility_version" : "5.0.0"
},
"tagline" : "You Know, for Search"
}
8、安装配置es-head插件
官方下载地址https://github.com/mobz/elasticsearch-head
9、安装配置kibana
[root@elk elk_package]# mkdir -p /home/kibana/log
[root@elk elk_package]# chown -R kibana.kibana /home/kibana
[root@elk elk_package]# rpm -ivh kibana-6.6.0-x86_64.rpm
[root@elk elk_package]# grep "^[a-z]" /etc/kibana/kibana.yml
server.port: 5601
server.host: "192.168.67.8"
elasticsearch.hosts: ["http://192.168.67.8:9200"]
kibana.index: ".kibana"
logging.dest: /home/kibana/log/kibana.log
[root@elk elk_package]# systemctl daemon-reload
[root@elk elk_package]# systemctl enable kibana.service
[root@elk elk_package]# systemctl start kibana
[root@elk elk_package]# systemctl status kibana
[root@elk elk_package] netstat -lntup|grep 5601
tcp 0 0 192.168.67.8:5601 0.0.0.0:* LISTEN 16442/node
10、客户机安装filebeat
rpm -ivh filebeat-6.6.0-x86_64.rpm
11、配置filebeat
cp /etc/filebeat/filebeat.yml /etc/filebeat/filebeat.yml.ori
> /etc/filebeat/filebeat.yml
vim /etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
enabled: true
paths:
- /home/qiutanlogs/apiinfo/apiinfo.log
json.keys_under_root: true
json.overwrite_keys: true
tags: ["access"]
- type: log
enabled: true
paths:
- /home/qiutanlogs/apierror/apierror.log
tags: ["error"]
setup.kibana:
host: "192.168.67.8:5601"
output.elasticsearch:
hosts: ["192.168.67.8:9200"]
indices:
- index: "apiinfo-access-%{[beat.version]}-%{+yyyy.MM.dd}"
when.contains:
tags: "access"
- index: "apierror-error-%{[beat.version]}-%{+yyyy.MM.dd}"
when.contains:
tags: "error"
setup.template.name: "nginx"
setup.template.pattern: "nginx-*"
setup.template.enabled: false
setup.template.overwrite: true
离线安装开机启动配置
cat /usr/local/filebeat/filebeat.service
[Unit]
Description=filebeat
Documentation=https://www.elastic.co/guide/en/beats/filebeat/current/index.html
Wants=network-online.target
After=network-online.target
[Service]
User=root
ExecStart=/usr/local/filebeat/filebeat -c /usr/local/filebeat/filebeat.yml
#ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
Restart=always
[Install]
WantedBy=multi-user.target
/bin/cp -ap /usr/local/filebeat/filebeat.service /usr/lib/systemd/system
systemctl daemon-reload
systemctl enable filebeat > /dev/null 2>&1
11 启动
systemctl daemon-reload
systemctl enable filebeat.service
systemctl start filebeat
12 Kibana 启动不了故障
Kibana did not load properly. Check the server output for more information.
Kibana server is not ready yet
tail -f /home/kibana/log/kibana.log 查看日志提示
删除.kibana_1 and 重启kibana
启动不了提示400 500状态码
出现{"statusCode":400,"error":"Bad Request","message":"[illegal_argument_exception] application privileges must refer to at least one resource"}
在索引里删除kibana 相关索引，然后通过 重启 kibana 节点。
12.2 时间不同步故障：
tail -f /home/kibana/log/kibana.log 查看发现时间和现在的不同步。
12.3 file启动不了
systemctl status filebeat
提示
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)
Active: failed (Result: start-limit) since Thu 2020-01-09 15:38:33 CST; 2s ago
Docs: https://www.elastic.co/products/beats/filebeat
Process: 44698 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)
Main PID: 44698 (code=exited, status=1/FAILURE)
Jan 09 15:38:33 localhost.localdomain systemd[1]: Unit filebeat.service entered failed state.
Jan 09 15:38:33 localhost.localdomain systemd[1]: filebeat.service failed.
Jan 09 15:38:33 localhost.localdomain systemd[1]: filebeat.service holdoff time over, scheduling restart.
Jan 09 15:38:33 localhost.localdomain systemd[1]: start request repeated too quickly for filebeat.service
Jan 09 15:38:33 localhost.localdomain systemd[1]: Failed to start Filebeat sends log files to Logstash or direc...ch..
Jan 09 15:38:33 localhost.localdomain systemd[1]: Unit filebeat.service entered failed state.
Jan 09 15:38:33 localhost.localdomain systemd[1]: filebeat.service failed.
解决方法：
1 通过执行
/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
2 可以查看错误的提示行
Exiting: error loading config file: yaml: line 7: did not find expected key
检查第7行附近，是否缺少标点符号，或标点符号有误，或者空格缩进有误。
3 重新查看
[root@localhost apiinfo]# systemctl stop filebeat
[root@localhost apiinfo]# systemctl start filebeat
[root@localhost apiinfo]# systemctl status filebeat
12.4 Elasticsearch监控
1 节点状态 green
2 节点数量
curl -s -XGET 'http://localhost:9200/_cat/nodes?human&pretty' |wc -l
3 报警判断： 状态不是greep 或者 节点数（假设有3个节点）不是3
4 判断返回值，即如果返回值节点正常，如果有一个不为0，就不正常。
curl -s -XGET http://localhost:9200/
echo $?
如果正常结果为0
