07_Elastic Stack 從入門到實踐（七）—1

一、Filebeat入門之讀取 Nginx 日志文件

1、首先啟動 Elasticsearch 集群 和 Nginx 服務，打開GoogleChrome 瀏覽器，點擊 elasticsearch-head 插件，連接Elasticsearch 集群 服務器。

# 查看網卡名
$  ip addr# 修改網卡配置，改為靜態IP
vim /etc/sysconfig/network-scripts/ifcfg-enp0s3[root@manager1 ~]# vim /etc/sysconfig/network-scripts/ifcfg-enp0s3
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
# BOOTPROTO=dhcp
BOOTPROTO=static
IPADDR=192.168.67.199
NETMASK=255.255.255.0
GATEWAY=192.168.67.1
DNS1=8.8.8.8
DNS2=114.114.114.114
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=enp0s3
UUID=43f2469a-7ff2-418f-ac9a-3bc5a3f14d46
DEVICE=enp0s3
ONBOOT=yes# 保存并退出編輯  :wq# 修改 elasticsearch 集群配置
vim /dzs168/es-cluster/elasticsearch-6.5.4/config/elasticsearch.yml #node1主節點
cluster.name: es-dzs168-cluster
node.name: node01
node.master: true
node.data: true
network.host: 0.0.0.0
http.port: 9200
discovery.zen.ping.unicast.hosts: ["192.168.67.199","192.168.67.71","192.168.67.207"]
discovery.zen.minimum_master_nodes: 2
http.cors.enabled: true
http.cors.allow-origin: "*"# node02 的配置
cluster.name: es-dzs168-cluster
node.name: node02
node.master: true
node.data: true
network.host: 0.0.0.0
http.port: 9200
discovery.zen.ping.unicast.hosts: ["192.168.67.199","192.168.67.71","192.168.67.207"]
discovery.zen.minimum_master_nodes: 2
http.cors.enabled: true
http.cors.allow-origin: "*"# node03從節點
cluster.name: es-dzs168-cluster
node.name: node03
node.master: true
node.data: true
network.host: 0.0.0.0
http.port: 9200
discovery.zen.ping.unicast.hosts: ["192.168.67.199","192.168.67.71","192.168.67.207"]
discovery.zen.minimum_master_nodes: 2
http.cors.enabled: true
http.cors.allow-origin: “*”# （192.168.67.199虛擬機上）關閉防火墻，切換到 elsearch用戶，啟動elasticsearch$ systemctl stop firewalld
$ su elsearch
$ /dzs168/es-cluster/elasticsearch-6.5.4/bin/elasticsearch# 查看80端口占用情況，如果占用，殺死進程ID
[root@manager1 ~]# netstat -tulpn | grep :80
tcp6  0      0 :::80    :::*      LISTEN      964/httpd           
[root@manager1 ~]# kill 964# 啟動nginx服務
$  /usr/local/nginx/nginx/sbin/nginx# 可通過瀏覽器訪問nginx頁面（默認80端口）:http://192.168.67.199/# （192.168.67.71虛擬機上）關閉防火墻，切換到 elsearc