EFK日志搭建

[[email?protected] ~]# yum install java

[[email?protected] ~]# java -version
openjdk version "1.8.0_222"
OpenJDK Runtime Environment (build 1.8.0_222-b10)
OpenJDK 64-Bit Server VM (build 25.222-b10,mixed mode)

[[email?protected] ~]# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.2.4.tar.gz
[[email?protected] ~]# tar -zxvf elasticsearch-6.2.4.tar.gz
[[email?protected] ~]# mv elasticsearch-6.2.4 /usr/local/elasticsearch-6.2.4
[[email?protected] ~]# cd /usr/local/elasticsearch-6.2.4
[[email?protected] ~]# vi config/elasticsearch.yml
    network.host: 0.0.0.0 
    http.port: 9200

#由于这里不能直接用root用户运行elasticsearch，所以要创建一个新用户
[[email?protected] ~]# adduser fengzi
[[email?protected] ~]# passwd fengzi
[[email?protected] ~]# chmod -R 777 /usr/local/elasticsearch-6.2.4
[[email?protected] ~]# su fengzi

#启动elasticsearch
[[email?protected] ~]# ./bin/elasticsearch

#添加以下4行内容
[[email?protected] local]# vim /etc/security/limits.conf
        * soft nofile 65536
        * hard nofile 65536
        efk soft nproc 8192
        efk hard nproc 8192            

#修改成以下内容
[[email?protected] local]# vim /etc/security/limits.d/20-nproc.conf
        *          soft    nproc    4096
        root       soft    nproc     unlimited    

#添加如下一行
[[email?protected] local]# vim /etc/sysctl.conf 
        vm.max_map_count=655360
[[email?protected] local]# sysctl -p
#查看一下9200和9300端口有没有启
[[email?protected] local]# ss -tnl
State       Recv-Q Send-Q              Local Address:Port                             Peer Address:Port              
LISTEN      0      128                             *:22                                          *:*                  
LISTEN      0      100                     127.0.0.1:25                                          *:*                
LISTEN      0      80                             :::3306                                       :::*                  
LISTEN      0      128                            :::9200                                       :::*                  
LISTEN      0      128                            :::9300                                       :::*                  
LISTEN      0      128                            :::22                                         :::*                  
LISTEN      0      100                           ::1:25                                         :::*                  

[[email?protected] local]# wget https://artifacts.elastic.co/downloads/kibana/kibana-6.2.4-linux-x86_64.tar.gz
[[email?protected] local]# tar -zxvf kibana-6.2.4-linux-x86_64.tar.gz
[[email?protected] local]# vi config/kibana.yml
        elasticsearch.url: "http://0.0.0.0:9200"
        server.host: "0.0.0.0"
        kibana.index: ".kibana"
#启动kibana服务
[[email?protected] local]# ./bin/kibana

#查看5601端口有没有启动
[[email?protected] local]# ss -tnl
State       Recv-Q Send-Q              Local Address:Port                             Peer Address:Port              
LISTEN      0      128                             *:22                                          *:*                  
LISTEN      0      100                     127.0.0.1:25                                          *:*                  
LISTEN      0      128                             *:5601                                        *:*                  
LISTEN      0      80                             :::3306                                       :::*                  
LISTEN      0      128                            :::9200                                       :::*                  
LISTEN      0      128                            :::9300                                       :::*                  
LISTEN      0      128                            :::22                                         :::*                  
LISTEN      0      100                           ::1:25                                         :::*                 

[[email?protected] local]# wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.2.4-linux-x86_64.tar.gz
[[email?protected] local]# tar -zxvf filebeat-6.2.4-linux-x86_64.tar.gz
[[email?protected] local]# vi filebeat.yml
        enabled: true
[[email?protected] local]# ./filebeat -c filebeat.yml