不支援root啟動 乖乖建立使用者吧

groupadd elasticsearch

 useradd es

passwd es

usermod -G elasticsearch es

mkdir -pv /appdata/elk

cd  /appdata/elk

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.3.2.tar.gz

 tar xvf  elasticsearch-6.3.2.tar.gz

 chown -R es:elasticsearch elasticsearch-6.3.2 vim config/elasticsearch.yml

修改內容(沒有就新增):

cluster.name: zzx-elk

node.name: node-1

network.host: 0.0.0.0 

http.port: 9200

#因為Centos6不支援SecComp,而ES預設bootstrap.system_call_filter為true進行檢測

bootstrap.memory_lock: false

bootstrap.system_call_filter: false

修改/etc/sysctl.conf 

切換回root 使用者 執行

vim /etc/sysctl.conf

在檔案最後面新增內容:

vm.max_map_count=262144

儲存退出後,使用sysctl -p 重新整理生效
vi /etc/security/limits.conf
* soft nproc 4096
* hard nproc 4096　

vi /etc/security/limits.d/90-nproc.conf
 
* soft nproc 4096

ulimit -u  驗證必須是4096

不行就退出es重新su -es

es使用者啟動

bin/elasticsearch

 netstat -anltp|grep 9[23]00

tcp        0      0 :::9200                     :::*                        LISTEN      2383/java           

tcp        0      0 :::9300                     :::*                        LISTEN      2383/java   

http://192.168.67.11:9200/
內容如下

{
  "name" : "node-1",
  "cluster_name" : "zzx-elk",
  "cluster_uuid" : "BBw0RrOpRoKtEy2Kgw8Blw",
  "version" : {
    "number" : "6.3.2",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "053779d",
    "build_date" : "2018-07-20T05:20:23.451332Z",
    "build_snapshot" : false,
    "lucene_version" : "7.3.1",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  },
  "tagline" : "You Know, for Search"
}

ntpdate ntp.ntsc.ac.cn

 wget https://artifacts.elastic.co/downloads/kibana/kibana-6.3.2-linux-x86_64.tar.gz  --no-check-certificate

vim  config/kibana.yml
 取消註釋
server.port: 5601
server.host: "192.168.67.11"
 用來連線es服務
elasticsearch.url: "http://192.168.67.11:9200"

http://192.168.67.11:5601    驗證

wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.2.1-linux-x86_64.tar.gz  --no-check-certificate

 cat filebeat.yml|grep -v ^#|grep -v            '  #'|grep -v ^$
filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - /var/log/*.log
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
tags: ["log"]
setup.kibana:
  host: "192.168.67.11:5601"
output.elasticsearch:
  hosts: ["192.168.67.11:9200"]

 ./filebeat -e -c filebeat.yml

http://192.168.67.11:5601/   圖形介面配置