北青永恒 - Kibana
type: channel
link: http://kococ.cn/tag/Kibana/
items: ELK日志收集系统概括

ELK日志收集系统概括
type: item
date: 2020-03-11T09:45:00+08:00
description: ELK收集日志作者：Andu 2019/6/30精华文章 第1章 ELK介绍没有日志收集平台的时候如何分析日志？什么是ELK/EFLK? ELK的数据流转流程?官方演示地址：https://demo.elastic.co/第2章 日志收集分类代理层：nginx,haproxyweb层：nginx,tomcat数据库层：mysql,redis,mongo,elasticsearch操作系统层：source,message第3章 安装部署ELK3.1 官方地址https://www.elastic.co/guide/index.html3.2 安装配置java[root@Andu ~]# yum install java-1.8.0-openjdk.x86_64 -y[[A1\]](#_msocom_1) [root@Andu ~]# java -version openjdk version "1.8.0_212" OpenJDK Runtime Environment (build 1.8.0_212-b04) OpenJDK 64-Bit Server VM (build 25.212-b04, mixed mode) 3.3 更新时间yum install ntpdate -y ntpdate time1.aliyun.com[[A2\]](#_msocom_2) 3.4 安装配置elasticsearch[root@Andu ~]# mkdir /data/soft/ -p [root@Andu ~]# cd /data/soft/ [root@Andu soft]# rz [root@Andu soft]# ll 总用量 506120 -rw-r--r-- 1 root root 114059630 2月 25 11:09 elasticsearch-6.6.0.rpm -rw-r--r-- 1 root root 36581177 4月 27 12:29 elasticsearch-head.tar.gz -rw-r--r-- 1 root root 11790119 2月 25 11:08 filebeat-6.6.0-x86_64.rpm -rw-r--r-- 1 root root 185123116 2月 25 11:11 kibana-6.6.0-x86_64.rpm -rw-r--r-- 1 root root 170703770 2月 25 11:38 logstash-6.6.0.rpm [root@Andu soft]# rpm -ivh elasticsearch-6.6.0.rpm 警告：elasticsearch-6.6.0.rpm: 头V4 RSA/SHA512 Signature, 密钥 ID d88e42b4: NOKEY 准备中... ################################# [100%] Creating elasticsearch group... OK Creating elasticsearch user... OK 正在升级/安装... 1:elasticsearch-0:6.6.0-1 ################################# [100%] \### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using systemd sudo systemctl daemon-reload sudo systemctl enable elasticsearch.service \### You can start elasticsearch service by executing sudo systemctl start elasticsearch.serviceCreated elasticsearch keystore in /etc/elasticsearch 3.4.1 相关配置目录及配置文件[root@Andu ~]# rpm -qc elasticsearch /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/jvm.options /etc/elasticsearch/log4j2.properties /etc/elasticsearch/role_mapping.yml /etc/elasticsearch/roles.yml /etc/elas…