RedHat7部署ELK日志分析系统

一、ELK的组成
二、工作流程
三、环境准备
四、正式安装

操作系统：Red Hat Enterprise Linux Server release 7.2
本机IP地址：192.168.96.128

所需文件及版本：

logstash-2.4.0.tar.gz
kibana-4.6.1-linux-x86_64.tar.gz
elasticsearch-2.4.1.tar.gz

注意：为了避免影响测试，临时将firewall与selinux关闭。
# systemctl stop firewalld.service # setenforce 0

[root@localhost ~]# java -version
openjdk version "1.8.0_101"
OpenJDK Runtime Environment (build 1.8.0_101-b13)
OpenJDK 64-Bit Server VM (build 25.101-b13, mixed mode)

[root@localhost ~]# wget https://download.elastic.co/logstash/logstash/logstash-2.4.0.tar.gz

[root@localhost ~]# tar zxf logstash-2.4.0.tar.gz -C /usr/local/

[root@localhost ~]# echo "export PATH=\$PATH:/usr/local/logstash-2.4.0/bin/" > /etc/profile.d/logstash.sh
[root@localhost ~]# . /etc/profile

[root@localhost ~]# logstash -e "input{stdin{}} output{stdout{}}"
hello world　　　　　　　　　　　　　　　　　　　　\\手动输入hello world后，稍等片刻会直接返回如下结果
Settings: Default pipeline workers: 1
Pipeline main started
2016-10-18T06:06:08.873Z localhost.localdomain hello world

[root@localhost ~]# logstash -e 'input{stdin{}} output{stdout{codec => rubydebug}}'
hello world　　　　　　　　　　　　　　　　　　　　\\手动输入hello world后，稍等片刻会以json格式返回如下结果
Settings: Default pipeline workers: 1
Pipeline main started
{
"message" => "hello world",
"@version" => "1",
"@timestamp" => "2016-10-18T06:10:02.765Z",
"host" => "localhost.localdomain"
}

[root@localhost ~]#  wget https://download.elastic.co/elasticsearch/release/org/elasticsearch/distribution/tar/elasticsearch/2.4.1/elasticsearch-2.4.1.tar.gz

  [root@localhost ~]# tar zxf elasticsearch-2.4.1.tar.gz -C /usr/local/

[root@localhost ~]# cd /usr/local/elasticsearch-2.4.1/
[root@localhost elasticsearch-2.4.1]# vim config/elasticsearch.yml

编辑和新增以下内容
network.host: 192.168.96.128

[root@localhost config]# /usr/local/elasticsearch-2.4.1/bin/elasticsearch 
Exception in thread "main" java.lang.RuntimeException: don't run elasticsearch as root.
...

[root@localhost config]# groupadd elsearch
[root@localhost config]# useradd elsearch -g elsearch -p elasticsearch
[root@localhost elasticsearch-2.4.1]# chown -R elsearch:elsearch /usr/local/elasticsearch-2.4.1/
[root@localhost elasticsearch-2.4.1]# su - elsearch　　　　　　　　　　　　\\切换至新用户

[elsearch@localhost ~]$ cd /usr/local/elasticsearch-2.4.1/bin/
[elsearch@localhost bin]$ ./elasticsearch　　　　　　　　　　　　　　　　　　　\\再次尝试启动elasticsearch
[2016-10-18 16:08:32,546][INFO ][node ] [Alex] version[2.4.1], pid[71956], build[c67dc32/2016-09-27T18:57:55Z]

...
[2016-10-18 16:08:40,728][INFO ][node ] [Alex] started

[root@localhost logstash]# cat logstash_agent.conf 
input {
    file {
        type => "messages"
        path => ["/var/log/messages"]
    }
}
output {
    elasticsearch {
        hosts => "192.168.96.128"
    }
}

[elsearch@localhost elk]$ cd /usr/local/elasticsearch-2.4.1/bin/
[elsearch@localhost bin]$ ./plugin install lmenezes/elasticsearch-kopf
...
Installed kopf into /usr/local/elasticsearch-2.4.1/plugins/kopf

[root@localhost elk_file]# wget https://download.elastic.co/kibana/kibana/kibana-4.6.1-linux-x86_64.tar.gz

[root@localhost elk_file]# tar zxf kibana-4.6.1-linux-x86_64.tar.gz -C /usr/local

[root@localhost elk_file]# vim /usr/local/kibana-4.6.1-linux-x86_64/config/kibana.yml

编辑添加内容：

 elasticsearch.url: "http://192.168.96.128:9200"

[root@localhost elk_file]# /usr/local/kibana-4.6.1-linux-x86_64/bin/kibana 
  log   [18:30:42.720] [info][status][plugin:kibana@1.0.0] Status changed from uninitialized to green - Ready
  log   [18:30:42.757] [info][status][plugin:elasticsearch@1.0.0] Status changed from uninitialized to yellow - Waiting for Elasticsearch
  log   [18:30:42.778] [info][status][plugin:kbn_vislib_vis_types@1.0.0] Status changed from uninitialized to green - Ready
  log   [18:30:42.799] [info][status][plugin:markdown_vis@1.0.0] Status changed from uninitialized to green - Ready