EFK日志搭建 | 易学教程

安装java

安装java1.8以上的版本并验证

[root@localhost ~]# yum install java

[root@localhost ~]# java -version openjdk version "1.8.0_222" OpenJDK Runtime Environment (build 1.8.0_222-b10) OpenJDK 64-Bit Server VM (build 25.222-b10, mixed mode)

安装Elasticsearch

安装Elasticsearch（Elasticsearch、Kibana、FileBeat版本最好一致）

[root@localhost ~]# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.2.4.tar.gz [root@localhost ~]# tar -zxvf elasticsearch-6.2.4.tar.gz[root@localhost ~]# mv elasticsearch-6.2.4 /usr/local/elasticsearch-6.2.4[root@localhost ~]# cd /usr/local/elasticsearch-6.2.4 [root@localhost ~]# vi config/elasticsearch.yml     network.host: 0.0.0.0      http.port: 9200  #由于这里不能直接用root用户运行elasticsearch，所以要创建一个新用户 [root@localhost ~]# adduser fengzi [root@localhost ~]# passwd fengzi [root@localhost ~]# chmod -R 777 /usr/local/elasticsearch-6.2.4 [root@localhost ~]# su fengzi#启动elasticsearch[root@localhost ~]# ./bin/elasticsearch

如果服务启动不起来，以下是解决办法

#添加以下4行内容 [root@localhost local]# vim /etc/security/limits.conf         * soft nofile 65536         * hard nofile 65536         efk soft nproc 8192         efk hard nproc 8192              #修改成以下内容 [root@localhost local]# vim /etc/security/limits.d/20-nproc.conf         *          soft    nproc    4096         root       soft    nproc     unlimited      #添加如下一行 [root@localhost local]# vim /etc/sysctl.conf          vm.max_map_count=655360 [root@localhost local]# sysctl -p #查看一下9200和9300端口有没有启 [root@localhost local]# ss -tnl State       Recv-Q Send-Q              Local Address:Port                             Peer Address:Port               LISTEN      0      128                             *:22                                          *:*                   LISTEN      0      100                     127.0.0.1:25                                          *:*                 LISTEN      0      80                             :::3306                                       :::*                   LISTEN      0      128                            :::9200                                       :::*                   LISTEN      0      128                            :::9300                                       :::*                   LISTEN      0      128                            :::22                                         :::*                   LISTEN      0      100                           ::1:25                                         :::*

安装Kibana

[root@localhost local]# wget https://artifacts.elastic.co/downloads/kibana/kibana-6.2.4-linux-x86_64.tar.gz [root@localhost local]# tar -zxvf kibana-6.2.4-linux-x86_64.tar.gz [root@localhost local]# vi config/kibana.yml         elasticsearch.url: "http://0.0.0.0:9200"         server.host: "0.0.0.0"         kibana.index: ".kibana" #启动kibana服务[root@localhost local]# ./bin/kibana#查看5601端口有没有启动 [root@localhost local]# ss -tnl State       Recv-Q Send-Q              Local Address:Port                             Peer Address:Port               LISTEN      0      128                             *:22                                          *:*                   LISTEN      0      100                     127.0.0.1:25                                          *:*                   LISTEN      0      128                             *:5601                                        *:*                   LISTEN      0      80                             :::3306                                       :::*                   LISTEN      0      128                            :::9200                                       :::*                   LISTEN      0      128                            :::9300                                       :::*                   LISTEN      0      128                            :::22                                         :::*                   LISTEN      0      100                           ::1:25                                         :::*

安装FileBeat

[root@localhost local]# wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.2.4-linux-x86_64.tar.gz [root@localhost local]# tar -zxvf filebeat-6.2.4-linux-x86_64.tar.gz [root@localhost local]# vi filebeat.yml         enabled: true [root@localhost local]# ./filebeat -c filebeat.yml

配置Kibana

来源：博客园

作者：疯子7314

链接：https://www.cnblogs.com/fengzi7314/p/11462714.html

标签

ElasticSearch

kibana

filebeat