elk部署（实操一）

项目准备：

redhat7.6

es+logstash+kibana 6.1

192.168.0.10 elk1

192.168.0.10 elk2

192.168.0.10 elk3

新建主机初始化

安装依赖包

yum -y install tree lrzsz nmap nc telnet vim wget lsof network-tools bash-completion bash-completion-extras net-tools epel-release createrepo lvm2

更新yum源

wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repowget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

关闭防火墙

systemctl stop firewalld && systemctl disable firewalld

关闭SELINUX

setenforce 0 && sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config

安装elasticsearch

设置系统主机名以及 Host 文件的相互解析

hostnamectl set-hostname elk1 #三台相同操作这里不在重复vim /etc/hosts192.168.0.208 elk1192.168.0.48 elk2192.168.0.213 elk3

安装jdk

tar -xvf jdk-8u141-linux-x64.tar.gzmv jdk1.8.0_141/ /usr/local/vim /etc/profile #把下面内容写入到 /etc/profileexport JAVA_HOME=/usr/local/jdk1.8.0_141export PATH=$JAVA_HOME/bin:$PATH export CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar

执行source /etc/profile 刷新环境变量

执行java –version确认是否配置成功

如果报jdk错误做一个软连接which javaln -s /ziyun/jdk1.8.0_141/bin/java /usr/bin/

创建/data/es-data目录，用于elasticsearch数据的存放

修改该目录的拥有者为elasticsearch

mkdir -p /data/es-datachown -R elasticsearch:elasticsearch /data/es-data

创建/data/es-log目录，用于elasticsearch日志的存放

修改该目录的拥有者为elasticsearch

mkdir -p /data/es-logchown -R elasticsearch:elasticsearch /data/es-log

下载elasticsearch软件包并安装

下载地址：wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.1.0.rpm安装rpm -ivh elasticsearch-6.1.0.rpm

修改配置文件

先做个备份cp /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/elasticsearch.ymlbakvim /etc/elasticsearch/elasticsearch.yml#另外两台同样操作17 cluster.name: myelk #集群名23 node.name: elk3 # 节点名称，建议和主机名一致33 path.data: /data/es-data #数据存放路径37 path.logs: /data/es-log #日志路径55 network.host: 0.0.0.0 #监听地址59 http.port: 9200 #端口68 discovery.zen.ping.unicast.hosts: ["elk1", "elk2", "elk3"] #声明集群里主机还有谁http.cors.enabled: truehttp.cors.allow-origin: "*"

修改limit文件

vim /etc/security/limits.conf* soft memlock unlimited* hard memlock unlimited* soft nofile 131072* hard nofile 131072

vim /etc/security/limits.d/20-nproc.conf* soft nproc 2048root soft nproc unlimited

查看

ulimit -n

启动服务

启动systemctl restart elasticsearch.service查看状态systemctl status elasticsearch.service设置开机自启systemctl enable elasticsearch.service

查看端口

netstat -utnlp | grep 9200

访问服务

http://192.168.0.10:9200 #本机ip+端口