# ELK集群的部署
在这里提前准备好的jdk环境以及环境变量服务会报错，具体原因还在排查中，建议使用官方atp源
补充：排查结果在logstash的配置文件中有指定JAVA环境的配置，它不会去读取默认的系统环境。
```
add-apt-repository ppa:webupd8team/java
apt-get update
apt-get install oracle-java8-installer
```
安装logstash+elasticsearch集群+kibana
```
[root@localhost ~]# mv /var/lib/{elasticsearch,logstash} /data/
[root@localhost ~]# rpm –ivh https://artifacts.elastic.co/downloads/logstash/logstash-6.3.0.rpm
[root@localhost ~]# cat /etc/logstash/logstash.yml
path.data: /data/logstash
path.config: /etc/logstash/conf.d/*.conf
path.logs: /var/log/logstash
定义一个nginx日志输出格式的例子
[root@localhost ~]# vi /etc/logstash/conf.d/nginxlog.conf
input {
kafka {
bootstrap_servers => "192.168.11.215:9092"
topics => "nginxacc"
consumer_threads => 5
codec => "json"
}
}
filter {
ruby {
code => " if event.get('message')
event.set('message', event.get('message').gsub('\x','Xx'))
event.set('message', event.get('message').gsub('\\x','XXx'))
end
"
}
json {
remove_field => "message"
source => "message"
}
mutate {
gsub => ["client", ",.*", ""]
convert => { "size" => "integer" }
convert => { "requesttime" => "float" }
}
geoip {
source => "client"
target => "geoip"
remove_field => "client"
}
useragent {
source => "agent"
target => "user_agent"
remove_field => "agent"
}
}
output {
elasticsearch {
hosts => ["elasticsearch:9200"]
index => "logstash-nginxacc-%{+YYYY.MM.dd}"
}
}
启动logstash服务
[root@localhost ~]# systemctl start logstash
[root@localhost ~]# rpm -ivh https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.3.0.rpm
```
**# Elasticsearch的配置如下**
```
[root@localhost ~]# cat /etc/elasticsearch/elasticsearch.yml
path.data: /data/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 192.168.11.231
discovery.zen.ping.unicast.hosts: ["192.168.11.231:9300","192.168.11.232:9300","192.168.11.233:9300"]
discovery.zen.minimum_master_nodes: 2
http.cors.enabled: true
http.cors.allow-origin: "*"
其它两台network.host处也相应修改为本机ip
启动服务
[root@localhost ~]# systemctl start elasticsearch
```
**# Kibana配置：**
```
[root@localhost ~]# rpm –ivh https://artifacts.elastic.co/downloads/kibana/kibana-6.3.0-x86_64.rpm
[root@localhost ~]# cat /etc/kibana/kibana.yml
server.host: "192.168.11.231"
elasticsearch.url: http://192.168.11.231:9200
启动kibana服务
[root@localhost ~]# systemctl start kibana
```
# ELK效果图：
