ELK

1.安装java环境

#将解压后的 jdk 或 jre 改至/usr/local/jdk目录，添加环境变量。

JAVA_HOME="/usr/local/jdk"
CLASSPATH="$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar"
PATH=$PATH:$JAVA_HOME/bin
export JAVA_HOME JAVA_BIN PATH CLASSPATH

#验证版本是否安装成功： java -version

1.安装elasticsearch

#将解压后的目录改至/usr/local/elasticsearch

#在/usr/local/elasticsearch/config/elasticsearch.yml文件中添加一行 network.host: 192.168.1.1(服务器IP)

#elasticsearch 2.0.0版建议以非ROOT用户运行服务，新建用户设好目录权限 chown -R NewUser. /usr/local/elasticsearch/

#切换用户 su - NewUser

#运行 /usr/local/elasticsearch/bin/elasticsearch -d

2.安装kibana

#将解压后的目录改至/usr/local/kibana

#修改文件 /usr/local/kibana/config/kibana.yml  选项: elasticsearch.url: "http://192.168.1.1:9200" (服务器IP)

#运行程序

/usr/local/kibana/bin/kibana

#验证 [info][status][plugin:elasticsearch] Status changed from yellow to green - Kibana index ready

#当Status为green时配置成功

3.Redis安装

#将解压后的文件改至/usr/local/redis

make

make install

#修改redis.conf 将daemonize选项改为yes

#启动redis

redis-server /usr/local/redis/redis.conf

4.安装logstash

#将解压后的logstash 改至 /usr/local/logstash

mkdir /usr/local/logstash/conf

cat > /usr/local/logstash/conf/access_logs.conf <<EOF
input {
redis {
    host => "127.0.0.1"
    port => "6379"
    key => "key_count"
    data_type => "list"
    codec => "json"
}
}

output {
   elasticsearch { hosts => ["elasticsearch_server:9200"]
        index => "nginx_logs"
        codec => "json"
    }
}
EOF

#运行logstash

/usr/local/logstash/bin/logstash -f /usr/local/logstash/conf/access_logs.conf