filebeat+elk搭建日志服务器

末蓝、 2023-01-19 03:08 212阅读 0赞

1.用户创建
    useradd ctl
    passwd ctl 
    准备包
    wget https://artifacts.elastic.co/downloads/kibana/kibana-6.8.15-linux-x86_64.tar.gz
    curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.15.tar.gz
    curl -L -O https://artifacts.elastic.co/downloads/logstash/logstash-6.8.15.tar.gz
    curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.8.15-linux-x86_64.tar.gz
    
    2.环境变量设置
    vim /etc/profile
    export JAVA_HOME=/home/software/jdk1.8.0_261
    export PATH=$JAVA_HOME/bin:$PATH
    
    vim  /etc/security/limits.conf
    *     soft   nofile    100000
    *     hard   nofile    100000
    *     soft   nproc     100000
    *     hard   nproc     100000
    *     soft   core      100000
    *     hard   core      100000
    ctl   soft memlock unlimited
    ctl   hard memlock unlimited
    
    vi /etc/sysctl.conf 
    vm.max_map_count=655360 然后执行sysctl -p 
    修改完需要关闭ssh连接重新进入
    
    3.配置elasticsearch
    cp elasticsearch.yml elasticsearch.yml.back
    node.name: node-1 //注释去除
    network.host: 192.168.3.9 //修改
    http.port: 9200 //注释去除
    bootstrap.memory_lock: false //修改
    ./elasticsearch -d  静默启动
    http://192.168.3.9:9200 验证elasticsearch启动成功
    
    4.配置logstash
    cp logstash-sample.conf logstash.conf
    修改 logstash.conf
    hosts => ["http://192.168.3.9:9200"]
    /home/ctl/logstash-6.8.15/bin/logstash -f /home/ctl/logstash-6.8.15/config/logstash.conf  &
    
    5.配置kibana
    cp kibana.yml kibana.yml.back
    server.port: 5601 //注释去除
    server.host: "192.168.3.9"  //修改
    elasticsearch.hosts: ["http://192.168.3.9:9200"]  //修改
    /home/ctl/kibana-6.8.15-linux-x86_64/bin/kibana    启动服务
    
    6.配置filebeat
    
    cp filebeat.yml filebeat.yml.back
    hosts: ["192.168.3.9:9200"]  //修改
    enabled: true    //修改
    paths:     //修改指定要汇总到logstash的日志
    - /root/tomcat/logs/catalina.out  
    执行
    ./filebeat setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["192.168.3.9:9200"]'   (当filebeats配合logstash使用，需要手动load the index template in ElasticSearch，就是filberts直连ElasticSearch load 数据，命令如上)
    
     /root/filebeat-6.8.15-linux-x86_64/filebeat -e -c /root/filebeat-6.8.15-linux-x86_64/filebeat.yml
    7.查看日志
    上面两个命令执行后看到

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0NUTExJTg_size_16_color_FFFFFF_t_70][]

新建index

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0NUTExJTg_size_16_color_FFFFFF_t_70 1][]

就可以看到日志了

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0NUTExJTg_size_16_color_FFFFFF_t_70 2][]

链接: https://pan.baidu.com/s/14GvLQl6JabW-mARsSo59Cg 提取码: e7j7 复制这段内容后打开百度网盘手机App，操作更方便哦

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0NUTExJTg_size_16_color_FFFFFF_t_70]: /images/20221021/2bc036795ac542289f07e5afe06a73b0.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0NUTExJTg_size_16_color_FFFFFF_t_70 1]: /images/20221021/5f079fafd12c4744acf47c816c575a49.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L0NUTExJTg_size_16_color_FFFFFF_t_70 2]: /images/20221021/74c058dd3de54daca08746359211a72a.png