ELK【elasticsearch，kibana，logstash】安装部署

//查找安装列表
yum -y list java*
//安装
yum install java-1.8.0-openjdk.x86_64
//完成安装后验证
java -version

//关闭防火墙
systemctl stop firewalld.service
//禁止防火墙开机启动
systemctl disable firewalld.service
//添加用户
useradd es -g es -p es
//给用户添加目录的启动权限
chown -R es:es /data/es/elasticsearch-6.8.0
//切换到es账户
su es

node.name: node-1 //单节点名称
network.host: 0.0.0.0 //配置外网可访问
http.port: 9200         //默认端口号
cluster.initial_master_nodes: node-1 //主节点名称

//* 标识所有的系统用户有效
* hard nofile 655360
* soft nofile 131072
* hard nproc 4096
* hard nproc 2048

vm.max_map_count=655360
fs.file-max=655360

//直接运行
sh ./elasticsearch
//后台运行
nohup ./elasticsearch & 

{
  "name" : "node-1",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "a4_P0BS9TpuAZ1RslXEATQ",
  "version" : {
    "number" : "7.2.0",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "508c38a",
    "build_date" : "2019-06-20T15:54:18.811730Z",
    "build_snapshot" : false,
    "lucene_version" : "8.0.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

1594953433 02:37:13 elasticsearch green 1 1 2 2 0 0 0 0 - 100.0%

//Kibana默然端口
server.port: 5601
//授权访问
server.host: "0.0.0.0"
//es地址，数据来源
elasticsearch.hosts: ["http://ip:9200"]

//直接运行
sh ./Kibana
//后台运行
nohup ./Kibana & 

vi logstash-startup.config
//写入配置

input {
  stdin{}
}
output {
   stdout{codec=>"rubydebug"}
}

 //启动测试

./bin/logstash -f config/logstash-startup.config

input {
  beats {
    #监测的端口
    port => 5044
    codec => json     # 直接将filebeat保存在message中的json字串解析出来
  }
}
filter {
  json {
    source => "message"
  }
}
output {
  elasticsearch {
    hosts => ["ip:9200"]
    codec => json{
         charset => "UTF-8"
    }
    index => "log_visit"
  }
  stdout{codec=>"rubydebug"}
}