安装EPEL
sudo yum -y install epel-release
安装Redis
sudo yum -y install redis
设置开机自启动然后启动：
sudo systemctl daemon-reload
sudo systemctl enable redis.service
sudo systemctl start redis.service
安装ELK
只安装ELK：Elasticsearch、Logstash、Kibana，Elastic Stack的其他组件没装。
sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
新增文件/etc/yum.repos.d/elasticsearch.repo：
[elasticsearch-5.x]
name=Elasticsearch repository for 5.x packages
baseurl=https://mirrors.tuna.tsinghua.edu.cn/elasticstack/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
用的是清华的源。
安装：
sudo yum -y install elasticsearch kibana logstash
Systemd开启开机自启动：
sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
sudo systemctl enable kibana.service
启动：
sudo systemctl start elasticsearch.service
sudo systemctl start kibana.service
sudo systemctl start logstash.service
验证一下Elasticsearch：
curl http://localhost:9200
{
"name" : "Nv3NQKr",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "Rx24DAWoS_ySLqeDCPNm0g",
"version" : {
"number" : "5.1.1",
"build_hash" : "5395e21",
"build_date" : "2016-12-06T12:36:15.409Z",
"build_snapshot" : false,
"lucene_version" : "6.3.0"
},
"tagline" : "You Know, for Search"
}
Elasticsearch和Kibana基本是开箱即用，默认配置就能跑起来。
配置LogStash
增加配置文件/etc/logstash/conf.d/logstash_indexer.conf:
input {
redis {
key => "logstash:phplogs"
data_type => ["list"]
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
}
}
意思是从本机redis的logstash:phplogs里列表里读数据，写入本机的Elasticsearch。改完配置重新启动LogStash
Laravel写日志
写日志方法多样，我这里把日志写到Redis，让LogStash收集。
Laravel文档说在bootstrap/app.php配置Monolog，但是这个时候各种Service都没起来，难道要自己在这里连Redis？所以我用一个Service Provider配置Monolog：
<?php
namespace App\Providers;
use Illuminate\Support\ServiceProvider;
use Log;
use Monolog\Logger;
use Monolog\Handler\RedisHandler;
use Monolog\Formatter\LogstashFormatter;
use Redis;
use Config;
class LogServiceProvider extends ServiceProvider
{
public function boot()
{
$monolog = Log::getMonolog();
$formatter = new LogstashFormatter(Config::get('app.name'));
$redisHandler = new RedisHandler(Redis::connection('log'), 'logstash:phplogs');
$redisHandler->setFormatter($formatter);
$monolog->pushHandler($redisHandler);
}
public function register()
{
//
}
}
Kibana
有日志写入后，就可在Kibana看到：
Kibana
参考
-
Elasticsearch、Logstash、Kibana搭建统一日志分析平台
内容有点旧。用两个服务器部署，其中一台有完整的ELK，另一台有LogStash收集日志，流程是LogStash收集日志文件 -> Redis -> LogStash -> ElasticSearch。 -
How to use Logstash with Monolog
参考了Redis和Monolog配置。
