Elastic Stack 5.1 部署（1）

安装JAVA环境

[root@tzgsqvelk01 tzg]# yum install java-1.8.0-openjdk
[root@tzgsqvelk01 tzg]# export JAVA_HOME=/usr/java

Elastic Stack安装步骤

  • 1、Elasticsearch
    X-Pack for Elasticsearch
  • 2、Kibana
    X-Pack for Kibana
  • 3、Logstash
  • 4、Beats
  • 5、Elasticsearch Hadoop
  • 6、redis

参考文档

https://www.elastic.co/guide/en/elastic-stack/current/installing-elastic-stack.html

1、安装Elasticsearch & X-pack（yum安装）

X-Pack是一个Elastic Stack的扩展，将安全，警报，监视，报告和图形功能包含在一个易于安装的软件包中。x-Pack安装之后有一个超级用户elastic ，其默认的密码是changeme，拥有对所有索引和数据的控制权，可以使用该用户创建和修改其他用户。通过kibana的web界面进行用户和用户组的管理，也可以使用shell 终端进行管理。

[root@tzgsqvelk01 tzg]# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

[root@tzgsqvelk01 tzg]# cat > /etc/yum.repos.d/elasticsearch.repo <<-EOF
[elasticsearch-5.x]
name=Elasticsearch repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF

[root@tzgsqvelk01 tzg]# yum install elasticsearch -y

[root@tzgsqvelk01 tzg]# /bin/systemctl daemon-reload
[root@tzgsqvelk01 tzg]# /bin/systemctl enable elasticsearch.service
Created symlink from /etc/systemd/system/multi-user.target.wants/elasticsearch.service to /usr/lib/systemd/system/elasticsearch.service.
[root@tzgsqvelk01 tzg]# systemctl start elasticsearch.service
[root@tzgsqvelk01 tzg]# systemctl stop elasticsearch.service

[root@tzgsqvelk01 tzg]# grep -v "^#" /etc/elasticsearch/elasticsearch.yml
node.name: tzg-elk01
path.data: /tzgData/elk/elasticsearch/data
path.logs: /opt/elk/elasticsearch/logs
network.host: 0.0.0.0

[root@tzgsqvelk01 tzg]# mkdir -p /tzgData/elk/elasticsearch/data
[root@tzgsqvelk01 tzg]# mkdir -p /opt/elk/elasticsearch/logs
[root@tzgsqvelk01 tzg]# chown -R elasticsearch.elasticsearch /tzgData/elk/
[root@tzgsqvelk01 tzg]# chown -R elasticsearch.elasticsearch /opt/elk/
[root@tzgsqvelk01 tzg]#
[root@tzgsqvelk01 tzg]# systemctl start elasticsearch.service
[root@tzgsqvelk01 tzg]#
[root@tzgsqvelk01 tzg]#
[root@tzgsqvelk01 tzg]# curl http://localhost:9200
{
  "name" : "tzg-elk01",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "K8bEym6OSpm9o1Y4CJrrEg",
  "version" : {
    "number" : "5.1.1",
    "build_hash" : "5395e21",
    "build_date" : "2016-12-06T12:36:15.409Z",
    "build_snapshot" : false,
    "lucene_version" : "6.3.0"
  },
  "tagline" : "You Know, for Search"
}


[root@tzgsqvelk01 tzg]# systemctl stop elasticsearch.service
[root@tzgsqvelk01 tzg]# /usr/share/elasticsearch/bin/elasticsearch-plugin install x-pack
[root@tzgsqvelk01 tzg]# systemctl start elasticsearch.service
[root@tzgsqvelk01 tzg]# curl -XPUT -u elastic 'localhost:9200/_xpack/security/user/elastic/_password' -d '{
"password" : "123456"
 }'
Enter host password for user 'elastic':
{}[root@tzgsqvelk01 tzg]#

[root@tzgsqvelk01 tzg]# systemctl stop elasticsearch.service
[root@tzgsqvelk01 tzg]# /usr/share/elasticsearch/bin/elasticsearch-plugin install x-pack
[root@tzgsqvelk01 tzg]# systemctl start elasticsearch.service

kibana & x-pack安装

[root@tzgsqvelk01 tzg]# cat > /etc/yum.repos.d/kibana.repo <<-EOF
[kibana-5.x]
name=Kibana repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF
[root@tzgsqvelk01 tzg]#
[root@tzgsqvelk01 tzg]#
[root@tzgsqvelk01 tzg]# yum install kibana -y

[root@tzgsqvelk01 tzg]# grep "^[a-z]" /etc/kibana/kibana.yml
server.host: "172.16.5.37"
elasticsearch.username: "elastic"
elasticsearch.password: "123456"

[root@tzgsqvelk01 tzg]# systemctl stop kibana.service
[root@tzgsqvelk01 tzg]# /usr/share/kibana/bin/kibana-plugin install file:///home/x-pack-5.1.1.zip
[root@tzgsqvelk01 tzg]# systemctl start kibana.service
[root@tzgsqvelk01 tzg]# curl -XPUT -u elastic 'localhost:9200/_xpack/security/user/kibana/_password' -d '{
  "password" : "123456"
}'
Enter host password for user 'elastic':

logstash 安装

[root@tzgsqvelk01 tzg]# cat > /etc/yum.repos.d/logstash.repo <<-EOF
[logstash-5.x]
name=Elastic repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF

[root@tzgsqvelk01 tzg]# yum install logstash -y

[root@tzgsqvelk01 tzg]# /usr/share/logstash/bin/logstash -e 'input { stdin{} } output { elasticsearch { hosts => "172.16.5.37:9200" user => elastic  password => 123456 } } '
hahahha
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs to console
The stdin plugin is now waiting for input:
10:47:39.397 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>["http://~hidden~:~hidden~@172.16.5.37:9200"]}}
10:47:39.400 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Running health check to see if an Elasticsearch connection is working {:url=>#<URI::HTTP:0x673e5894 URL:http://~hidden~:~hidden~@172.16.5.37:9200>, :healthcheck_path=>"/"}
10:47:39.617 [[main]-pipeline-manager] WARN  logstash.outputs.elasticsearch - Restored connection to ES instance {:url=>#<URI::HTTP:0x673e5894 URL:http://~hidden~:~hidden~@172.16.5.37:9200>}
10:47:39.617 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Using mapping template from {:path=>nil}
10:47:39.658 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Attempting to install template {:manage_template=>{"template"=>"logstash-*", "version"=>50001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"_default_"=>{"_all"=>{"enabled"=>true, "norms"=>false}, "dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword"}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date", "include_in_all"=>false}, "@version"=>{"type"=>"keyword", "include_in_all"=>false}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}}
10:47:39.772 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Installing elasticsearch template to _template/logstash
10:47:39.815 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["172.16.5.37:9200"]}
10:47:39.817 [[main]-pipeline-manager] INFO  logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>1000}
10:47:39.823 [[main]-pipeline-manager] INFO  logstash.pipeline - Pipeline main started
10:47:39.856 [Api Webserver] INFO  logstash.agent - Successfully started Logstash API endpoint {:port=>9600}
^C10:47:47.587 [SIGINT handler] WARN  logstash.runner - SIGINT received. Shutting down the agent.
10:47:47.592 [LogStash::Runner] WARN  logstash.agent - stopping pipeline {:id=>"main"}


[root@tzgsqvelk01 tzg]# /usr/share/logstash/bin/system-install
Successfully created system startup script for Logstash
[root@tzgsqvelk01 tzg]# chown -R logstash.logstash /usr/share/logstash/data/

redis安装

[root@ tzgsqvelk01 app]# wget http://download.redis.io/releases/redis-3.2.1.tar.gz
[root@ tzgsqvelk01 app]# yum install gcc -y
[root@ tzgsqvelk01 app]# tar zxvf redis-3.2.1.tar.gz
[root@ tzgsqvelk01 app]# cd redis-3.2.1
[root@tzgsqvelk01 redis-3.2.1]# make
[root@tzgsqvelk01 redis-3.2.1]# make install PREFIX=/opt/app/redis

[root@tzgsqvelk01 redis-3.2.1]# cat /opt/app/redis/conf/redis.conf
daemonize yes
pidfile /var/run/redis.pid
bind 172.16.5.37
port 6379
timeout 120
loglevel notice
logfile /opt/app/redis/logs/redis.log
databases 16
save 900 1
save 300 100
save 60 10000
stop-writes-on-bgsave-error yes
rdbcompression yes
rdbchecksum yes
dbfilename dump.rdb
dir /tzgData/redis/var
appendonly yes
appendfilename "appendonly.aof"
appendfsync everysec
no-appendfsync-on-rewrite no
auto-aof-rewrite-percentage 100
auto-aof-rewrite-min-size 64mb
aof-load-truncated yes
slowlog-log-slower-than 10000
slowlog-max-len 128
hash-max-ziplist-entries 512
hash-max-ziplist-value 64
list-max-ziplist-entries 512
list-max-ziplist-value 64
set-max-intset-entries 512
zset-max-ziplist-entries 128
zset-max-ziplist-value 64
hll-sparse-max-bytes 3000
activerehashing yes
maxmemory 4096000000
maxclients 10000
slave-serve-stale-data yes
slave-read-only yes
slave-priority 100
repl-diskless-sync no
repl-diskless-sync-delay 5
repl-disable-tcp-nodelay no

[root@tzgsqvelk01 redis-3.2.1]# cp utils/redis_init_script /etc/init.d/redisd
[root@tzgsqvelk01 redis-3.2.1]# vim /etc/init.d/redisd

#!/bin/sh
# chkconfig:   2345 90 10
# description:  Redis is a persistent key-value database
#

REDISPORT=6379
EXEC=/opt/app/redis/bin/redis-server
CLIEXEC=/opt/app/redis/bin/redis-cli

PIDFILE=/var/run/redis_${REDISPORT}.pid
CONF="/opt/app/redis/conf/redis.conf"

[root@tzgsqvelk01 tzg]# chkconfig redisd on
[root@tzgsqvelk01 tzg]# service redisd start

[root@tzgsqvelk01 app]# rm -rf redis-3.2.1
[root@tzgsqvelk01 app]# rm -rf redis-3.2.1.tar.gz

logstash和elasticsearch 无需授权配置

参考官方文档
https://www.elastic.co/guide/en/x-pack/current/anonymous-access.html

[root@ tzgsqvelk01 elasticsearch]# vim elasticsearch.yml

xpack.security.authc:
  anonymous:
    username: anonymous_user
    roles: logstash_logs
    authz_exception: true

######添加 logstash_logs的权限######
curl -XPOST -u elastic 'localhost:9200/_xpack/security/role/logstash_logs' -d '{
  "cluster": ["manage_index_templates", "monitor"],
  "indices": [
    {
      "names": [ "logstash-*","business-index-*"], 
      "privileges": ["write","delete","create_index"]
    }
  ]
}'


[root@ tzgsqvelk01 elasticsearch]# systemctl restart elasticsearch.service
[root@ tzgsqvelk01 elasticsearch]# /usr/share/logstash/bin/logstash -e 'input { stdin{} } output { elasticsearch { hosts => "192.168.3.210:9200"} } '
tzghahaha
Sending Logstash's logs to /var/log/logstash/logs which is now configured via log4j2.properties
The stdin plugin is now waiting for input:
[2016-12-30T08:48:07,332][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>["http://192.168.3.210:9200"]}}
[2016-12-30T08:48:07,342][INFO ][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:url=>#<URI::HTTP:0x52cfa9fa URL:http://192.168.3.210:9200>, :healthcheck_path=>"/"}
[2016-12-30T08:48:07,592][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>#<URI::HTTP:0x52cfa9fa URL:http://192.168.3.210:9200>}
[2016-12-30T08:48:07,599][INFO ][logstash.outputs.elasticsearch] Using mapping template from {:path=>nil}
[2016-12-30T08:48:07,753][INFO ][logstash.outputs.elasticsearch] Attempting to install template {:manage_template=>{"template"=>"logstash-*", "version"=>50001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"_default_"=>{"_all"=>{"enabled"=>true, "norms"=>false}, "dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword"}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date", "include_in_all"=>false}, "@version"=>{"type"=>"keyword", "include_in_all"=>false}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}}
[2016-12-30T08:48:07,773][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["192.168.3.210:9200"]}
[2016-12-30T08:48:07,784][INFO ][logstash.pipeline        ] Starting pipeline {"id"=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>500}
[2016-12-30T08:48:07,814][INFO ][logstash.pipeline        ] Pipeline main started
[2016-12-30T08:48:07,989][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
最后编辑于 ：
©著作权归作者所有,转载或内容合作请联系作者
  • 人面猴
    序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
    沈念sama阅读 211,884评论 6赞 492
  • 死咒
    序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
    沈念sama阅读 90,347评论 3赞 385
  • 救了他两次的神仙让他今天三更去死
    文/潘晓璐 我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
    开封第一讲书人阅读 157,435评论 0赞 348
  • 道士缉凶录：失踪的卖姜人
    文/不坏的土叔 我叫张陵，是天一观的道长。 经常有香客问我，道长，这世上最难降的妖魔是什么？ 我笑而不...
    开封第一讲书人阅读 56,509评论 1赞 284
  • 港岛之恋（遗憾婚礼）
    正文 为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
    茶点故事阅读 65,611评论 6赞 386
  • 恶毒庶女顶嫁案：这布局不是一般人想出来的
    文/花漫 我一把揭开白布。 她就那样静静地躺着，像睡着了一般。 火红的嫁衣衬着肌肤如雪。 梳的纹丝不乱的头发上，一...
    开封第一讲书人阅读 49,837评论 1赞 290
  • 城市分裂传说
    那天，我揣着相机与录音，去河边找鬼。 笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。 我是一名探鬼主播，决...
    沈念sama阅读 38,987评论 3赞 408
  • 双鸳鸯连环套：你想象不到人心有多黑
    文/苍兰香墨 我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
    开封第一讲书人阅读 37,730评论 0赞 267
  • 万荣杀人案实录
    序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
    沈念sama阅读 44,194评论 1赞 303
  • 护林员之死
    正文 独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋 以下内容为张勋视角 年9月15日...
    茶点故事阅读 36,525评论 2赞 327
  • 白月光启示录
    正文 我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。 大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
    茶点故事阅读 38,664评论 1赞 340
  • 活死人
    序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
    沈念sama阅读 34,334评论 4赞 330
  • 日本核电站爆炸内幕
    正文 年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
    茶点故事阅读 39,944评论 3赞 313
  • 男人毒药：我在死后第九天来索命
    文/蒙蒙 一、第九天 我趴在偏房一处隐蔽的房顶上张望。 院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
    开封第一讲书人阅读 30,764评论 0赞 21
  • 一桩弑父案，背后竟有这般阴谋
    文/苍兰香墨 我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。 一阵脚步声响...
    开封第一讲书人阅读 31,997评论 1赞 266
  • 情欲美人皮
    我被黑心中介骗来泰国打工， 没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。 一个月前我还...
    沈念sama阅读 46,389评论 2赞 360
  • 代替公主和亲
    正文 我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。 传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
    茶点故事阅读 43,554评论 2赞 349

推荐阅读更多精彩内容