目錄
資源列表
基礎環境
關閉防護墻
關閉內核安全機制
修改主機名
添加hosts映射
一、部署elasticsearch
修改limit限制
部署elasticsearch
修改配置文件
單節點
集群(3臺節點集群為例)
啟動
二、部署filebeat
部署filebeat
添加配置文件
啟動
三、部署kibana
單節點kibana
部署kibana
修改配置文件
啟動
多節點kibana
????????之前給大家分享的ELK，今天分享的是一個更加輕量級的日志收集EFK，主要就是有filebeat代替了logstash，filebeat采用go語言編寫占用資源少，更加輕量級。本文中涉及到的軟件包如果有需要可以評論區找我要，無償提供。
資源列表
| 操作系統 | 配置 | 主機名 | IP |
|---|---|---|---|
| CentOS7.3.1611 | 2C4G | es01 | 192.168.207.131 |
| CentOS7.3.1611 | 2C4G | kibana | 192.168.207.165 |
| CentOS7.3.1611 | 2C4G | filebeat | 192.168.207.166 |
基礎環境
關閉防護墻
systemctl stop firewalld
systemctl disable firewalld關閉內核安全機制
sed -i "s/.*SELINUX=.*/SELINUX=disabled/g" /etc/selinux/config
reboot修改主機名
hostnamectl set-hostname es01
hostnamectl set-hostname kibana
hostnamectl set-hostname filebeat添加hosts映射
cat >> /etc/hosts << EOF
192.168.207.131 es01
192.168.207.165 kibana
192.168.207.166 filebeat
EOF一、部署elasticsearch
修改limit限制
cat > /etc/security/limits.d/es.conf << EOF
* soft nproc 655360
* hard nproc 655360
* soft nofile 655360
* hard nofile 655360
EOF
?
cat >> /etc/sysctl.conf << EOF
vm.max_map_count=655360
EOF
sysctl -p部署elasticsearch
mkdir -p /data/elasticsearch
tar zxvf elasticsearch-7.14.0-linux-x86_64.tar.gz -C /data/elasticsearch修改配置文件
單節點
mkdir /data/elasticsearch/{data,logs}[root@es01 elasticsearch-7.14.0]# grep -v "^#" /data/elasticsearch/elasticsearch-7.14.0/config/elasticsearch.yml
cluster.name: my-application
node.name: es01
path.data: /data/elasticsearch/data
path.logs: /data/elasticsearch/logs
bootstrap.memory_lock: false
network.host: 0.0.0.0
http.port: 9200
cluster.initial_master_nodes: ["es01"]集群(3臺節點集群為例)
需要準備3臺機器，主機名分別是es01，es02，es03
[root@es01 ~]# grep -v "^#" /data/elasticsearch/elasticsearch-7.14.0/config/elasticsearch.yml
cluster.name: es
node.name: es01
path.data: /data/elasticsearch/data
path.logs: /data/elasticsearch/logs
bootstrap.memory_lock: false
network.host: 0.0.0.0
http.port: 9200
discovery.seed_hosts: ["es01","es02","es03"]
cluster.initial_master_nodes: ["es01","es02","es03"]
node.master: true
node.data: true
http.cors.enabled: true
http.cors.allow-origin: "*"
?
[root@es02 ~]# grep -v "^#" /data/elasticsearch/elasticsearch-7.14.0/config/elasticsearch.yml
cluster.name: es
node.name: es02
path.data: /data/elasticsearch/data
path.logs: /data/elasticsearch/logs
bootstrap.memory_lock: false
network.host: 0.0.0.0
http.port: 9200
discovery.seed_hosts: ["es01","es02","es03"]
cluster.initial_master_nodes: ["es02", "es01", "es03"]
node.master: true
node.data: true
http.cors.enabled: true
http.cors.allow-origin: "*"
?
?
[root@es03 ~]# grep -v "^#" /data/elasticsearch/elasticsearch-7.14.0/config/elasticsearch.yml
cluster.name: es
node.name: es03
path.data: /data/elasticsearch/data
path.logs: /data/elasticsearch/logs
bootstrap.memory_lock: false
network.host: 0.0.0.0
http.port: 9200
discovery.seed_hosts: ["es01","es02","es03"]
cluster.initial_master_nodes: ["es01", "es02", "es03"]
node.master: true
node.data: true
http.cors.enabled: true
http.cors.allow-origin: "*"啟動
useradd es
chown -R es:es /data/
su - es
/data/elasticsearch/elasticsearch-7.14.0/bin/elasticsearch -d二、部署filebeat
部署filebeat
mkdir -p /data/filebeat
tar zxvf filebeat-7.14.0-linux-x86_64.tar.gz -C /data/filebeat/添加配置文件
[root@filebeat filebeat-7.14.0-linux-x86_64]# cat filebeat.yml
filebeat.inputs:
- type: logenabled: truepaths:- /var/log/messages
# 定義模板的相關信息
# 不允許自動生成模板
setup.template.enabled: false
# 生成index模板的名稱
setup.template.name: "filebeat-test"
# 生成index模板的格式
setup.template.pattern: "filebeat-test-*"
# 7版本自定義ES的索引需要把ilm設置為false
setup.ilm.enabled: false
output.elasticsearch:hosts: ["192.168.207.131:9200"]index: "filebeat-test-%{+yyyy.MM.dd}"[root@filebeat filebeat-7.14.0-linux-x86_64]# cat filebeat.yml
filebeat.inputs:
- type: logenabled: truepaths:- /var/log/httpd/access_logfields:source: access
- type: logenabled: truepaths:- /var/log/httpd/error_logfields:source: error
setup.template.enabled: false
setup.template.name: "httpd"
setup.template.pattern: "httpd-*"
setup.ilm.enabled: false
output.elasticsearch:hosts: ["192.168.207.131:9200"]index: "httpd-%{[fields.source]}-*"indices:- index: "httpd-access-%{+yyyy.MM.dd}"when.equals:fields.source: "access"- index: "httpd-error-%{+yyyy.MM.dd}"when.equals:fields.source: "error"啟動
/data/filebeat/filebeat-7.14.0-linux-x86_64/filebeat -e -c filebeat.yml三、部署kibana
單節點kibana
部署kibana
mkdir -p /data/kibana
tar zxvf kibana-7.14.0-linux-x86_64.tar.gz -C /data/kibana/修改配置文件
grep -v "^#" /data/kibana/kibana-7.14.0-linux-x86_64/config/kibana.yml | grep -v "^$"
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://192.168.207.131:9200"]
kibana.index: ".kibana"啟動
useradd kibana
chown -R kibana:kibana /data
su - kibana
/data/kibana/kibana-7.14.0-linux-x86_64/bin/kibana多節點kibana
每個節點配置相同
[root@es01 ~]# grep -v "^#" /data/kibana/kibana-7.14.0-linux-x86_64/config/kibana.yml | grep -v "^$"
server.port: 5601
server.host: "0.0.0.0"
server.name: "your-hostname"
elasticsearch.hosts: ["http://es01:9200", "http://es02:9200", "http://es03:9200"]
kibana.index: ".kibana"
+獨立端)
開發平臺數據統計如何配置？)
