碼上快樂

相關內容    簡體    繁體

ELK初學搭建(elasticsearch)

本文轉載自   查看原文   2016-11-14 15:05   2571 

ELK初學搭建(elasticsearch)

elasticsearch
logstash
kibana

ELK初學搭建 elasticsearch

1.環境准備

centos6.8_64 mini
IP:192.168.10.78
tar包：
logstash-2.4.0.tar.gz
elasticsearch-2.4.0.tar.gz
kibana-4.6.1-linux-x86_64.tar.gz
JDK環境

elasticsearch logstach kibana java
V2.4 V2.4 V4.6.1 V1.8.0_111
1.1環境准備
  1. [root@localhost ~]# yum install java-1.8.0-openjdk* -y 
  2. [root@localhost ~]# export JAVA_HOME=/usr/lib/jvm/java-1.8.0 
  3. [root@localhost ~]# export PATH=$JAVA_HOME/bin:$PATH 
  4. [root@localhost ~]# export CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar 
  5. [root@localhost ~]# java -version 
  6. openjdk version "1.8.0_111" 
  7. OpenJDK Runtime Environment (build 1.8.0_111-b15) 
  8. OpenJDK 64-Bit Server VM (build 25.111-b15, mixed mode) 

此時jdk環境已經正常可用。

2.軟件上傳之服務器並解壓到/usr/local目錄下
解壓，並重新命名文件夾：

[root@localhost ~]# xvf elasticsearch-2.4.0.tar.gz 
[root@localhost ~]# mv elasticsearch-2.4.0 /usr/local/elasticsearch

同理 將這三個軟件解壓...
3. 運行軟件

  1. [root@localhost elasticsearch]# ./bin/elasticsearch 
  2. Exception in thread "main" java.lang.RuntimeException: don't run elasticsearch as root. 
  3. at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:94) 
  4. at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:160) 
  5. at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:286) 
  6. at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:35) 
  7. Refer to the log for complete error details. 
  8. [root@localhost elasticsearch]#  

運行報錯，發現elasticsearch不允許在root下運行，解決：

  1. [root@localhost elasticsearch]# groupadd es 
  2. [root@localhost elasticsearch]# useradd -g es es 
  3. [root@localhost elasticsearch]# useradd -g es es 
  4. [root@localhost elasticsearch]# passwd es 
  5. Changing password for user es. 
  6. New password:  
  7. BAD PASSWORD: it is based on a dictionary word 
  8. Retype new password:  
  9. passwd: all authentication tokens updated successfully. 
  10. [root@localhost elasticsearch]# chown -R root . 
  11. [root@localhost elasticsearch]# chown -R es . 
  12. [root@localhost elasticsearch]# chgrp -R es . 
  13. [root@localhost elasticsearch]# ls -l 
  14. total 56 
  15. drwxr-xr-x 2 es es 4096 Nov 7 17:25 bin 
  16. drwxr-xr-x 3 es es 4096 Nov 7 19:37 config 
  17. drwxrwxr-x 3 es es 4096 Nov 7 17:34 data 
  18. drwxr-xr-x 2 es es 4096 Nov 7 17:25 lib 
  19. -rw-rw-r-- 1 es es 11358 Aug 24 00:46 LICENSE.txt 
  20. drwxrwxr-x 2 es es 4096 Nov 7 17:34 logs 
  21. drwxrwxr-x 5 es es 4096 Aug 29 17:23 modules 
  22. -rw-rw-r-- 1 es es 150 Aug 24 00:46 NOTICE.txt 
  23. drwxrwxr-x 4 es es 4096 Nov 7 17:50 plugins 
  24. -rw-rw-r-- 1 es es 8700 Aug 24 00:46 README.textile 

此時，ES 不能通過IP訪問，最好修改 config/elasticsearch.yml，配置一下 ES。
首先，找到“network.host”行，添加一行：

network.host: 192.168.10.78
再找到“http.port”行，添加一行：
http.port: 9200

否則，ES 每次啟動時，端口可能會變（端口被占用，ES 自己會改端口）~
如果還不能正常啟動 ES，並提示端口被占用，就查看一下什么程序占用 9200 端口，kill 掉，重啟 ES 就行。

就能通過IP，或瀏覽器訪問。
切換至es用戶先運行elasticsearch

  1. [root@localhost ~]# su es 
  2. [es@localhost root]$ cd /usr/local/elasticsearch/ 
  3. [es@localhost elasticsearch]$ ls 
  4. bin config data lib LICENSE.txt logs modules NOTICE.txt plugins README.textile 
  5. [es@localhost elasticsearch]$ ./bin/elasticsearch 
  6. [2016-11-07 21:50:45,580][WARN ][bootstrap ] unable to install syscall filter: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed 
  7. [2016-11-07 21:50:45,824][INFO ][node ] [Man-Eater] version[2.4.0], pid[1880], build[ce9f0c7/2016-08-29T09:14:17Z] 
  8. [2016-11-07 21:50:45,824][INFO ][node ] [Man-Eater] initializing ... 
  9. [2016-11-07 21:50:46,521][INFO ][plugins ] [Man-Eater] modules [reindex, lang-expression, lang-groovy], plugins [head, kopf], sites [head, kopf] 
  10. [2016-11-07 21:50:46,548][INFO ][env ] [Man-Eater] using [1] data paths, mounts [[/ (/dev/mapper/VolGroup-lv_root)]], net usable_space [5gb], net total_space [8.2gb], spins? [possibly], types [ext4] 
  11. [2016-11-07 21:50:46,548][INFO ][env ] [Man-Eater] heap size [1007.3mb], compressed ordinary object pointers [true] 
  12. [2016-11-07 21:50:46,548][WARN ][env ] [Man-Eater] max file descriptors [4096] for elasticsearch process likely too low, consider increasing to at least [65536] 
  13. [2016-11-07 21:50:49,052][INFO ][node ] [Man-Eater] initialized 
  14. [2016-11-07 21:50:49,053][INFO ][node ] [Man-Eater] starting ... 
  15. [2016-11-07 21:50:49,124][INFO ][transport ] [Man-Eater] publish_address {192.168.10.78:9300}, bound_addresses {192.168.10.78:9300} 
  16. [2016-11-07 21:50:49,130][INFO ][discovery ] [Man-Eater] elasticsearch/kAMEcJDUQ_2jK0jm7fVWeQ 
  17. [2016-11-07 21:50:52,210][INFO ][cluster.service ] [Man-Eater] new_master {Man-Eater}{kAMEcJDUQ_2jK0jm7fVWeQ}{192.168.10.78}{192.168.10.78:9300}, reason: zen-disco-join(elected_as_master, [0] joins received) 
  18. [2016-11-07 21:50:52,289][INFO ][http ] [Man-Eater] publish_address {192.168.10.78:9200}, bound_addresses {192.168.10.78:9200} 
  19. [2016-11-07 21:50:52,290][INFO ][node ] [Man-Eater] started 
  20. [2016-11-07 21:50:52,385][INFO ][gateway ] [Man-Eater] recovered [2] indices into cluster_state 
  21. [2016-11-07 21:50:53,045][INFO ][cluster.routing.allocation] [Man-Eater] Cluster health status changed from [RED] to [YELLOW] (reason: [shards started [[logstash-%{type}-2016.11.07][1], [.kibana][0]] ...]). 

此時，在另一個終端，訪問 elasticsearch：

  1. [root@localhost ~]# curl -X GET http://192.168.10.78:9200 
  2. { 
  3. "name" : "Egghead", 
  4. "cluster_name" : "elasticsearch", 
  5. "version" : { 
  6. "number" : "2.4.0", 
  7. "build_hash" : "ce9f0c7394dee074091dd1bc4e9469251181fc55", 
  8. "build_timestamp" : "2016-08-29T09:14:17Z", 
  9. "build_snapshot" : false, 
  10. "lucene_version" : "5.5.2" 
  11. } 
  12. "tagline" : "You Know, for Search" 
  13. } 

到這一不，ES 已經安裝成功。可用瀏覽器測試是都正常即可。

Head 插件

Head 是一個用來監控 ES 狀態的客戶端插件，可以為初學用戶提供很多便利，例如，使用 Head 提供的 HTTP 客戶端，通過 HTTP 方式來操作 ES。
ES 支持在線和本地安裝 Head。本地安裝時，從 Github 上下載 Head 插件，然后上傳到你的 ES 服務器，比如，Elasticsearch/plugins 目錄。
下面是在線安裝：

  1. [root@localhost elasticsearch]# ./bin/plugin install mobz/elasticsearch-head 
  2. -> Installing mobz/elasticsearch-head... 
  3. Trying https://github.com/mobz/elasticsearch-head/archive/master.zip ... 
  4. Downloading ...................................................................................................................................................................................................................................................................................................................................................................................................................................DONE 
  5. Verifying https://github.com/mobz/elasticsearch-head/archive/master.zip checksums if available ... 
  6. NOTE: Unable to verify checksum for downloaded plugin (unable to find .sha1 or .md5 file to verify) 
  7. Installed head into /usr/local/elasticsearch/plugins/head 

用瀏覽器訪問 http://192.168.10.78:9200/_plugin/head
enter description here

logstash-%{type}-2016.11.07是我自己創建的，后續介紹。
至此Elasticsearch Head 就成功安裝了。
Marvel 圖形化監控插件收費，安裝方法同上，本免費黨不測試了 哈哈~

安裝 kopf 網絡插件

[root@localhost elasticsearch]# ./bin/plugin install mobz/elasticsearch-kopf
-> Installing lmenezes/elasticsearch-kopf...
Trying https://github.com/lmenezes/elasticsearch-kopf/archive/master.zip...
Downloading ..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................DONE
Installed lmenezes/elasticsearch-kopf into /usr/local/elasticsearch/plugins/kopf

enter description here

kopf.png

至此elasticsearch准備就緒，下一章安裝losstach.


免責聲明！

本站轉載的文章為個人學習借鑒使用，本站對版權不負任何法律責任。如果侵犯了您的隱私權益，請聯系本站郵箱yoyou2525@163.com刪除。



猜您在找 搭建單機ELK——基於Elasticsearch 7.3.0 ELK搭建實時日志分析平台之一ElasticSearch搭建 搭建ELK日志分析平台（上）—— ELK介紹及搭建 Elasticsearch 分布式集群 ELK之使用docker-compose搭建elasticsearch和kibana ELK+Filebeat日志中心搭建（一）——ElasticSearch7.3.1安裝 ELK日志系統：Elasticsearch + Logstash + Kibana 搭建教程 ELK(ElasticSearch, Logstash, Kibana)搭建實時日志分析平台 elk搭建 搭建elk ELK之一-----Elasticsearch介紹與部署
 
粵ICP備18138465號   © 2018-2025 CODEPRJ.COM