ELK

1.安裝java環境

#將解壓後的 jdk 或 jre 改至/usr/local/jdk目錄，添加環境變量。

JAVA_HOME="/usr/local/jdk"
CLASSPATH="$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar"
PATH=$PATH:$JAVA_HOME/bin
export JAVA_HOME JAVA_BIN PATH CLASSPATH

#驗證版本是否安裝成功： java -version

1.安裝elasticsearch

#將解壓後的目錄改至/usr/local/elasticsearch

#在/usr/local/elasticsearch/config/elasticsearch.yml文件中添加一行 network.host: 192.168.1.1(服務器IP)

#elasticsearch 2.0.0版建議以非ROOT用戶運行服務，新建用戶設好目錄權限 chown -R NewUser. /usr/local/elasticsearch/

#切換用戶 su - NewUser

#運行 /usr/local/elasticsearch/bin/elasticsearch -d

2.安裝kibana

#將解壓後的目錄改至/usr/local/kibana

#修改文件 /usr/local/kibana/config/kibana.yml  選項: elasticsearch.url: "http://192.168.1.1:9200" (服務器IP)

#運行程序

/usr/local/kibana/bin/kibana

#驗證 [info][status][plugin:elasticsearch] Status changed from yellow to green - Kibana index ready

#當Status爲green時配置成功

3.Redis安裝

#將解壓後的文件改至/usr/local/redis

make

make install

#修改redis.conf 將daemonize選項改爲yes

#啓動redis

redis-server /usr/local/redis/redis.conf

4.安裝logstash

#將解壓後的logstash 改至 /usr/local/logstash

mkdir /usr/local/logstash/conf

cat > /usr/local/logstash/conf/access_logs.conf <<EOF
input {
redis {
    host => "127.0.0.1"
    port => "6379"
    key => "key_count"
    data_type => "list"
    codec => "json"
}
}

output {
   elasticsearch { hosts => ["elasticsearch_server:9200"]
        index => "nginx_logs"
        codec => "json"
    }
}
EOF

#運行logstash

/usr/local/logstash/bin/logstash -f /usr/local/logstash/conf/access_logs.conf