elk部署實戰
阿新 • • 發佈：2018-07-26
handler elk部署 round 3.1 tput disabled water egrep 分享圖片 第1章 環境準備 1.3 關閉安全機制
1.1 系統環境
[root@LZH ~]# cat /etc/redhat-release CentOS Linux release 7.3.1611 (Core) [root@LZH ~]# uname -r 3.10.0-514.2.2.el7.x86_64 [root@LZH ~]# uname -m x86_64
1.2 修改主機名
1.2.1 方法1
[root@LZH ~]# hostnamectl set-hostname LZH
1.2.2 方法2
[root@LZH ~]# hostname LZH ==》臨時生效 [root@LZH ~]# vim /etc/sysconfig/network ==》永久生效 # Created by anaconda NETWORKING_IPV6=no PEERNTP=no HOSTNAME=LZH 一般兩者配合使用！！
1.3 關閉安全機制
################################關閉防火墻##################################### [root@LZH ~]# systemctl stop firewalld ==》臨時關閉 [root@LZH ~]# systemctl disable firewalld ==》永久關閉 ##################################關閉SELINUX################################ [root@LZH ~]# setenforce 0 [root@LZH ~]# sed -i "s#SELINUX=enable#SELINUX=disabled#" /etc/sysconfig/selinux 1.4 下載軟件包
1.4.1 elasticsearch
https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.4.1.tar.gz
1.4.2 kibana
https://artifacts.elastic.co/downloads/kibana/kibana-5.4.1-linux-x86_64.tar.gz
1.4.3 logstash
https://artifacts.elastic.co/downloads/logstash/logstash-5.4.1.tar.gz
1.5 創建目錄和用戶
1.5.1 創建目錄
[root@LZH ~]# mkdir -p /server/scripts/ ==》腳本存放目錄 [root@LZH ~]# mkdir -p /application/tools ==》軟件包存放目錄
1.5.2 創建用戶
[root@ZLH ~]# groupadd es [root@LZH ~]# useradd -g es es [root@LZH ~]# echo "123456"|passwd --stdin es ==》添加密碼
1.6 安裝jdk （安裝jdk1.8或1.8以上的版本）
[root@LZH ~]# yum install -y java-1.8.0-openjdk
第2章 安裝
2.1 安裝及啟動elasticsearch
2.1.1 安裝elasticsearch
[root@LZH ~]# cd /application/tools/
[root@LZH tools]# tar xf elasticsearch-5.4.1.tar.g
[root@LZH tools]# mv elasticsearch-5.4.1 /usr/local/elasticsearch
[root@LZH tools]# cd /usr/local/elasticsearch
[root@LZH elasticsearch]# mkdir -p /usr/local/elasticsearch/{data,logs}
[root@LZH elasticsearch]# cp config/elasticsearch.yml{,.bak}
[root@LZH elasticsearch]# ll config/
total 20
-rw-rw---- 1 root root 2854 May 30 2017 elasticsearch.yml
-rw-r----- 1 root root 2854 Jul 13 09:55 elasticsearch.yml.bak
-rw-rw---- 1 root root 3117 May 30 2017 jvm.options
-rw-rw---- 1 root root 4456 May 30 2017 log4j2.properties
[root@LZH elasticsearch]# egrep -v "^$|#" config/elasticsearch.yml.bak > config/elasticsearch.yml
[root@LZH elasticsearch]# vim config/elasticsearch.yml
cluster.name: lzh-elk
node-name: LZH
path.data: /usr/local/elasticsearch/data
path.logs: /usr/local/elasticsearch/logs
network.host: 59.110.228.53
http.port: 9200
discovery.zen.ping.unicast.hosts: ["LZH"]
[root@LZH elasticsearch]# chown -R es.es /usr/local/elasticsearch/
[root@LZH elasticsearch]# cp /etc/sysctl.conf{,.bak}
[root@LZH elasticsearch]# echo "vm.max_map_count = 655360" >> /etc/sysctl.conf
[root@LZH elasticsearch]# sysctl -p
[root@LZH elasticsearch]# cp /etc/security/limits.conf{,.bak}
[root@LZH elasticsearch]# vim /etc/security/limits.conf ==》新增如下內容
* soft nofile 65536
* hard nofile 65536
* soft nproc 65536
* hard nproc 65536
2.1.2 啟動
[root@LZH config]# su – es
[es@lzh ~]$ cd /usr/local/elasticsearch/
[es@lzh elasticsearch]$ ./bin/elasticsearch & ==》後臺啟動
[root@LZH logs]# netstat -tnulp |grep 9200 ==》查看端口
2.3 啟動報錯集錦
2.3.1 以root身份啟動
q 錯誤實例
[root@LZH elasticsearch]# ./bin/elasticsearch OpenJDK 64-Bit Server VM warning: If the number of processors is expected to increase from one, then you should configure the number of parallel GC threads appropriately using -XX:ParallelGCThreads=N [2018-07-13T10:53:17,809][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main] org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root
q 解決方法
用非root用戶啟動
2.3.2 內存不足
q 錯誤實例
[es@LZH elasticsearch]$ ./bin/elasticsearch OpenJDK 64-Bit Server VM warning: If the number of processors is expected to increase from one, then you should configure the number of parallel GC threads appropriately using -XX:ParallelGCThreads=N OpenJDK 64-Bit Server VM warning: INFO: os::commit_memory(0x0000000085330000, 2060255232, 0) failed; error='Cannot allocate memory' (errno=12) # # There is insufficient memory for the Java Runtime Environment to continue. # Native memory allocation (mmap) failed to map 2060255232 bytes for committing reserved memory. # An error report file with more information is saved as: # /usr/local/elasticsearch/hs_err_pid9843.log
q 解決方法
[root@LZH config]# vim jvm.options …… -Xms2g 修改為 Xms1g -Xmx2g Xmx1g …… 然後重新啟動即可
2.3.2 [Failed to bind to [9300-9400]
q 錯誤實例
[es@lzh elasticsearch]$ ./bin/elasticsearch …… [2018-0713T10:37:12,987][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main] org.elasticsearch.bootstrap.StartupException: BindTransportException[Failed to bind to [9300-9400]]; nested: BindException[Cannot assign requested address];
q 解決方法
[root@LZH config]# vim /usr/local/elasticsearch/config/elasticsearch.yml cluster.name: LZH-elk #node-name: LZH path.data: /usr/local/elasticsearch/data path.logs: /usr/local/elasticsearch/logs http.port: 9200 discovery.zen.ping.unicast.hosts: ["LZH"] 然後重新啟動即可
2.2 安裝及啟動logstash
2.2.1 安裝logstash
[root@LZH ~]# cd /application/tools/
[root@LZH tools]# tar xf logstash-5.4.1.tar.gz
[root@LZH tools]# mv logstash-5.4.1 /usr/local/logstash
[root@LZH logstash]# vim config/logstash.conf
input {
file {
path => ["/var/log/*.log", "/var/log/message"]
type => "system"
start_position => "beginning"
}
}
output {
elasticsearch {
hosts => '127.0.0.1'
}
stdout { codec => rubydebug }
}2.2.2 啟動logstash
[root@lzh logstash]# ./bin/logstash -f config/logstash.conf &
啟動成功後會出現下面的內容
2.3 安裝及啟動kibana
2.3.1 安裝kibana
[root@lzh kibana]# tar xf kibana-5.4.1-linux-x86_64.tar.gz
[root@lzh kibana]# mv kibana-5.4.1-linux-x86_64 /usr/local/kibana
[root@lzh kibana]# cd /usr/local/kibana
[root@lzh kibana]# cp kibana.yml{,.bak}
[root@lzh kibana]# egrep -v "^$|#" kibana.yml.bak >kibana.yml
[root@lzh kibana]# vim kibana.yml2.3.2 啟動
[root@lzh kibana]#./bin/kiban & [root@lzh kibana]# netstat -nulpt |grep kibana· [root@lzh kibana]# netstat -tnulp
啟動成功如下
elk部署實戰