實驗環境：
redhat6.5 server1 172.25.35.1
redhat6.5 server1 172.25.35.2
redhat6.5 server1 172.25.35.3
準備安裝包；
[[email protected] elk]# ls
bigdesk-master.zip jemalloc-devel-3.6.0-1.el6.x86_64.rpm
elasticsearch-2.3.3.rpm kibana-4.5.1-1.x86_64.rpm
elasticsearch-head-master.zip logstash-2.3.3-1.noarch.rpm
elk日誌分析平臺.pdf nginx-1.8.0-1.el6.ngx.x86_64.rpm
jemalloc-3.6.0-1.el6.x86_64.rpm redis-3.0.6.tar.gz
安裝：
elasticsearch-2.3.3.rpm jdk-8u121-linux-x64.rpm因系統環境依賴
[

[email protected] elk]# rpm -ivh elasticsearch-2.3.3.rpm
[[email protected] elk]# cd /etc/elasticsearch/
[[email protected] elasticsearch]# vim elasticsearch.yml 寫 配置檔案
cluster.name: my-es
node.name: server1
network.host: 172.25.35.1
#

Set a custom port for HTTP:

#
http.port: 9200
bootstrap.mlockall: true 記憶體鎖定開啟
[

[email protected] ~]# rpm -ivh jdk-8u121-linux-x64.rpm
[[email protected] ~]# which java 檢查java環境
/usr/bin/java
[[email protected] ~]# which javac
/usr/bin/javac
[[email protected] ~]# /etc/init.d/elasticsearch start
[[email protected] elasticsearch]# cd /var/log/elasticsearch/
[[email protected] elasticsearch]# cat my-es.log 看日誌會有報錯：
elasticsearch soft memlock unlimited
elasticsearch hard memlock unlimited 會有這兩行報錯
這是沒有記憶體鎖定
[[email protected] elasticsearch]# vim /etc/security/limits.conf
將這兩行加到檔案末尾，重起服務。注意虛擬機器記憶體不可小於1G否則會報錯
[[email protected] elasticsearch]# /etc/init.d/elasticsearch restart
[[email protected] elasticsearch]# netstat -antlp 檢視埠
瀏覽器測試： 172.25.35.1：9200
[[email protected] elasticsearch]# /usr/share/elasticsearch/bin/plugin install file:/root/elk/elasticsearch-head-master.zip 安裝master端
[[email protected] elasticsearch]# cd /usr/share/elasticsearch/plugins/
[[email protected] plugins]# cd head/
[[email protected] head]# /usr/share/elasticsearch/bin/plugin list
Installed plugins in /usr/share/elasticsearch/plugins:

• head
  瀏覽器等入：http://172.25.35.1:9200/_plugin/head/
  簡單新增一個測試一下

[[email protected] head]# vim /etc/elasticsearch/elasticsearch.yml 新增節點
node.master: true #控制節點
node.data: false

將安裝包發給 jdk-8u121-linux-x64.rpm，elasticsearch-2.3.3.rpm server2和server3 安裝
配置同server1方法一致：以server2為例：
node.name: server2
node.master: false
node.data: true
network.host: 172.25.35.2
http.port: 9200
cluster.name: my-es
bootstrap.mlockall: true
同時所有server配置檔案開啟：
discovery.zen.ping.unicast.hosts: ["server1", "server2","server3"]
加上叢集
[[email protected] head]# /etc/init.d/elasticsearch reload 重起服務

[[email protected] head]# rpm -ivh logstash-2.3.3-1.noarch.rpm
[[email protected] head]# cd /opt/logstash/
[[email protected] logstash]# cd /opt/logstash/
[[email protected] logstash]# cd bin/
[[email protected] bin]# ls
[[email protected] bin]# ./logstash -e 'input {stdin { } } output { stdout {} }'
[[email protected] bin]# ./logstash -e 'input {stdin { } } output { elasticsearch {hosts => ["172.25.35.1"] index => "logstash-%{+YYYY.MM.dd}" }}'
[[email protected] bin]# ./logstash -e 'input {stdin { } } output { elasticsearch {hosts => ["172.25.35.1"] index => "logstash-%{+YYYY.MM.dd}" } stdout {codec => rubydebug} }' 互動式新增幾個檔案看一下
[[email protected] bin]# cd /etc/logstash/
[[email protected] logstash]# cd conf.d/ 建立以conf結尾的配置檔案
[[email protected] conf.d]# vim es.conf
input {
stdin {}
}

output {
elasticsearch {
hosts => ["172.25.35.1"]
index => "index-%{+YYYY.MM.dd}"
}
stdout {
codec => rubydebug
}
}
[[email protected] conf.d]# /opt/logstash/bin/logstash -f /etc/logstash/conf.d/es.conf 執行瀏覽器驗證