安裝elasticsearch

rpm -ivh elasticsearch-6.8.1.rpm
修改配置檔案簡單配置以下值

cat /etc/elasticsearch/elasticsearch.yml |grep -v ^#
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 172.16.0.43
http.port: 9200

啟動 systemctl start elasticsearch.service 此處會有報錯，可能是編譯安裝的java需要手動指定變數值
報錯資訊如下

journalctl -u elasticsearch.service
...
Jul 05 15:20:47 ol43 elasticsearch[20037]: which: no java in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin)
Jul 05 15:20:47 ol43 elasticsearch[20037]: warning: Falling back to java on path. This behavior is deprecated. Specify JAVA_H
Jul 05 15:20:47 ol43 elasticsearch[20037]: could not find java; set JAVA_HOME
...
 

手動指定變數值

head -n 2 /usr/share/elasticsearch/bin/elasticsearch-env
#!/bin/bash
JAVA_HOME=/usr/local/jdk1.8.0_202

啟動
systemctl start elasticsearch.service
驗證

 curl 172.16.0.43:9200
{
  "name" : "azFRc7L",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "s8nLQgc_SWqSoRa5u7fqCg",
  "version" : {
    "number" : "6.8.1",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "1fad4e1",
    "build_date" : "2019-06-18T13:16:52.517138Z",
    "build_snapshot" : false,
    "lucene_version" : "7.7.0",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  },
  "tagline" : "You Know, for Search"
}

 

啟動成功

安裝kibana

rpm -ivh kibana-6.8.1-x86_64.rpm
修改配置檔案

cat /etc/kibana/kibana.yml |grep -Ev '^#|^$'
server.port: 5601
server.host: "172.16.0.43"
elasticsearch.hosts: ["http://172.16.0.43:9200"]

啟動
systemctl start kibana' 驗證 瀏覽器訪問172.16.0.43:5601`

安裝filebeat

rpm -ivh filebeat-6.8.1-x86_64.rpm

 cat /etc/filebeat/filebeat.yml |grep -Ev '^#|^$|#'
filebeat.inputs:
- type: log
  enabled: false
  paths:
    - /var/log/*.log
- type: log
  enabled: true
  paths:
    - /opt/jar/app-service/app-service.log
  fields:
    doc_type: app-service
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
setup.kibana:
output.elasticsearch:
  hosts: ["172.16.0.43:9200"]

啟動
systemctl start filebeat
驗證
手動到kibana上檢視索引

為kibana新增登陸驗證

htpasswd -c /opt/app/nginx/conf/conf.d/.kibana-user admin
nginx配置

server {
    listen 80;

    server_name elk.888.com;

    auth_basic "Restricted Access";
    auth_basic_user_file /opt/app/nginx/conf/conf.d/.kibana-user;

    location / {
        proxy_pass http://172.16.0.43:5601; 
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgra