安装ELK &＃xff0c;版本如下&＃xff1a;
Elasticsearch 2.3.5
Logstash 2.3.4
Kibana 4.5.4
下载地址&＃xff0c;请参考官网
https://www.elastic.co/downloads
一、ES
1、启动
[root&＃64;elasticseach1 bin]# ./elasticsearch start
ERROR: Parameter [start]does not start with --
[root&＃64;elasticseach1 bin]# ./elasticsearch
Exception in thread "main" java.lang.RuntimeException: don&＃39;t run elasticsearch as root.
at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:93)
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:144)
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:270)
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:35)
Refer to the log for complete error details.
解决方法1&＃xff1a;
在执行elasticSearch时加上参数-Des.insecure.allow.root&＃61;true&＃xff0c;完整命令如下&＃xff1a;
./elasticsearch -Des.insecure.allow.root&＃61;true
解决办法2&＃xff1a;
用vi打开elaticsearch执行文件&＃xff0c;在变量ES_JAVA_OPTS使用前添加以下命令&＃xff1a;
ES_JAVA_OPTS&＃61;"-Des.insecure.allow.root&＃61;true"
修改后&＃xff0c;./elasticsearch 启动成功
2、修改elasticsearch.yml
cluster.name 和 node.name
以及 network.host 为服务器ip
3、安装 elasticsearch 的插件head&＃xff1a;
安装&＃xff1a;
./elasticsearch/bin/plugin install mobz/elasticsearch-head
访问&＃xff1a;
http://localhost:9200/_plugin/head/
彻底解决启动elasticSearch 时&＃xff0c;建议不要用root 用户启动的warning &＃xff1a;
由于ElasticSearch可以接收用户输入的脚本并且执行&＃xff0c;为了系统安全考虑&＃xff0c;
建议创建一个单独的用户用来运行ElasticSearch
1、创建elsearch用户组及elsearch用户
groupadd elsearch
2、更改elasticsearch文件夹及内部文件的所属用户及组为elsearch:elsearch
useradd elsearch -g elsearch -p elasticsearch
3、屏蔽掉 bin/elasticsearch 文件的 ES_JAVA_OPTS&＃61;"-Des.insecure.allow.root&＃61;true"
4、给/elasticsearch/logs 和 data 里面的文件可写权限 chmod -R 777 logs&＃xff0c;chmod -R 777 data
5、切换到elsearch 用户&＃xff0c; su elsearch &＃xff0c;再运行
二、Logstash:
1、bin 目录下新建 etc 目录&＃xff0c;
vi logstash/etc/logstash_agent.conf
input {
file {
type &＃61;> "nginx.access"
path &＃61;>["/data/nginx/logs/access.log"]
}
}
output {
elasticsearch {
hosts &＃61;> ["10.100.100.60:9300"]
}
}
2、启动
[root&＃64;elasticseach1 bin]# ./logstash -f etc/logstash_agent.conf
Settings: Default pipeline workers: 2
The server failed to respond with a valid HTTP response {:class&＃61;>"Manticore::ClientProtocolException", :level&＃61;>:error}
Pipeline main started 报错
vi logstash/etc/logstash_agent.conf 修改为&＃xff1a;
input {
file {
type &＃61;> "nginx.access"
path &＃61;>["/data/nginx/logs/access.log"]
}
}
output {
# stdout{}
elasticsearch {
hosts &＃61;> ["10.100.100.60:9200"]
index &＃61;> "test_output-%{type}-%{&＃43;YYYY.MM.dd}"
}
}
重新启动&＃xff0c;成功
Settings: Default pipeline workers: 2
Pipeline main started
三、kibana
1、修改kibana.yml 里面的
server.host ,elasticsearch_url 以及 去掉 kibana.index 的注释
./kibana 启动
四、kibana 连接es 索引
1、导入json数据到es 中
curl -XPOST &＃39;10.100.100.60:9200/shakespeare/_bulk?pretty&＃39; --data-binary &＃64;shakespeare.json
2、从redis 中导入数据到es
# 10.100.100.60:6379 &＃xff0c;成功
input {
redis {
host &＃61;> "10.100.100.60"
type &＃61;> "redis-input"
data_type &＃61;> "list"
key &＃61;> "elk_data"
}
}
output {
elasticsearch {
hosts &＃61;> ["10.100.100.60:9200"]
index &＃61;> "logstash-%{type}-%{&＃43;YYYY.MM.dd}"
}
}
从 两台redis 里面导数据
input {
redis {
host &＃61;> "10.100.100.60"
type &＃61;> "redis-60-input"
data_type &＃61;> "list"
key &＃61;> "elk_data"
}
redis {
host &＃61;> "10.100.100.35"
type &＃61;> "redis-35-input"
data_type &＃61;> "list"
key &＃61;> "elk_data"
}
}
output {
elasticsearch {
hosts &＃61;> ["10.100.100.60:9200"]
index &＃61;> "logstash-%{type}-%{&＃43;YYYY.MM.dd}"
}
}
要注意 redis 能连接上
以上的服务启动都不是后台启动&＃xff0c;后台启动请加上 &
京公网安备 11010802041100号