Linux下elk安装配置

安装jdk
JDK版本大于1.8

elk下载地址：
https://www.elastic.co/products
注意：elk三个版本都要保持一致。


rpm -ivh elasticsearch-5.4.0.rpm
rpm -ivh logstash-5.4.0.rpm
rpm -ivh kibana-5.4.0-x86_64.rpm

mkdir -p /data/elasticsearch/{logs,snapshots,nodes}
 

在文件最后 /etc/security/limits.conf 添加
vi /etc/security/limits.conf
elk       hard        nofile        65536
elk       soft        nofile        65536


在文件最后 /etc/sysctl.conf 添加
vi /etc/sysctl.conf
vm.max_map_count=655360
vm.swappiness = 1


使用 sysctl -p 命令来让参数

 
chown -R elasticsearch:elasticsearch   /data/elasticsearch/


修改 elasticsearch 配置文件
vi /etc/elasticsearch/elasticsearch.yml
cluster.name: bx-es
node.name: node-1
path.data: /data/elasticsearch/
path.logs: /data/elasticsearch/logs
path.repo: /data/elasticsearch/snapshots
network.host: ["192.168.56.10","localhost"]
http.port: 9200


修改 elasticsearch 内存
/etc/elasticsearch/jvm.options
-Xms300m
-Xmx300m


启动 elasticesrarch
/etc/init.d/elasticsearch start

或者（针对centos 7.X 及以上）：
systemctl start  elasticsearch


修改 logstash 配置文件
vi  /etc/logstash/logstash.yml
path.data: /var/lib/logstash
pipeline.workers: 2
pipeline.output.workers: 10
pipeline.batch.size: 10000
path.config: /etc/logstash/conf.d
config.reload.automatic: true
config.reload.interval: 60
config.debug: true
log.level: info
path.logs: /data/logstash/logs



启动 logstash
systemctl start logstash
 
 
 
修改 kibana 配置文件
vi  /etc/kibana/kibana.yml
server.port: 5601
server.host: "192.168.56.10"
server.name: "192.168.56.10"
elasticsearch.url: "http://192.168.56.10:9200"


启动 kibana
systemctl start kibana