Elasticsearch and kibana and filebeat 輕量級日誌監控系統

Elasticsearch and kibana and filebeat
Elasticsearch and kibana and filebeat 輕量級日誌監控系統
說明：
elasticsearch 依賴java
Logstash 依賴於JVM，內存消耗比較高
filebeat go語言輕量級日誌監控系統

安裝

elasticsearch-6.2.3.tar.gz
filebeat-6.2.3-linux-x86_64.tar.gz
kibana-6.2.3-linux-x86_64.tar.gz
jdk-8u161-linux-x64.tar.gz

# tar -zxvf jdk-8u161-linux-x64.tar.gz -C /usr/local
# vi /etc/profile
 export JAVA_HOME=/usr/local/jdk1.8.0_161/
 export CLASSPATH=.:$JAVA_HOME/jre/lib/rt.jar:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
 export PATH=$JAVA_HOME/bin:$PATH
# java -version

# tar -zxvf elasticsearch-6.2.3.tar.gz -C /usr/local
# vi /etc/security/limits.conf
 * soft nofile  65536
 * hard nofile  131072
# vi /etc/sysctl.conf
 vm.max_map_count=262144
# vi /usr/local/elasticsearch-6.2.3/conf/elasticsearch.yml
 network.host: 0.0.0.0
 http.port: 9200
# useradd elastic
# chow -R elastic.elastic /usr/local/elasticsearch-6.2.3
# su - elastic
# /usr/local/elasticsearch-6.2.3/bin/elasticsearch -d
# curl 127.0.0.1:9200
{
 "name" : "8Wd9C8n",
 "cluster_name" : "elasticsearch",
 "cluster_uuid" : "9zevQvrfSMCuPFv-4eb3zw",
 "version" : {
     "number" : "6.2.3",
     "build_hash" : "c59ff00",
     "build_date" : "2018-03-13T10:06:29.741383Z",
     "build_snapshot" : false,
     "lucene_version" : "7.2.1",
     "minimum_wire_compatibility_version" : "5.6.0",
     "minimum_index_compatibility_version" : "5.0.0"
 },
 "tagline" : "You Know, for Search"
 }
# tar -zxvf kibana-6.2.3-linux-x86_64.tar.gz -C /usr/local
# mv /usr/local/kibana-6.2.3-linux-x86_64 /usr/local/kibana-6.2.3
# vi /usr/local/kibana-6.2.3/config/kibana.yml
 server.host: "0.0.0.0"
 elasticsearch.url: "http://127.0.0.1:9200"
# /usr/local/kibana-6.2.3/bin/kibana &

# tar -zxvf filebeat-6.2.3-linux-x86_64.tar.gz -C /usr/local/
# mv /usr/local/filebeat-6.2.3-linux-x86_64  /usr/local/filebeat-6.2.3
# vi /usr/local/filebeat-6.2.3/filebeat.yml
 filebeat.prospectors:
 - type: log
     paths:
        - /var/log/*
 output.elasticsearch:
     hosts: ["127.0.0.1:9200"]
# /usr/local/filebeat-6.2.3/filebeat &

通過瀏覽器輸入 IP+5601
192.168.1.1:5601
managenment > index patterns > filebeat-* > create