linux安装ELK安装与使用(Elasticsearch + Logstash + Kibana)

    elk   elk

安装elasticsearch

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.4.3.tar.gz
tar -zxvf elasticsearch-5.4.3.zip
  • 运行
bin/elasticsearch
  • 测试访问
curl http://localhost:9200/

安装Logstash

  • 官网下载地址https://www.elastic.co/downloads/logstash
wget https://artifacts.elastic.co/downloads/logstash/logstash-5.5.0.tar.gz
tar -zxvf logstash-5.5.0.tar.gz
cd logstash-5.5.0
  • 编辑配置文件 vi logstash.conf 加入日志抓取文件
input {
    file {
        path => "/usr/local/var/logs/access.log"
        start_position => beginning
        ignore_older => 0
        sincedb_path => "/dev/null"
    }
}
filter {
    grok {
        match => { "message" => "%{COMBINEDAPACHELOG}"}
    }
    geoip {
        source => "clientip"
    }
}
output {
    elasticsearch {

    }
    stdout {}
}
  • 运行
bin/logstash -f logstash.conf

安装kibana

  • 下载地址 https://www.elastic.co/cn/downloads/kibana
wget https://artifacts.elastic.co/downloads/kibana/kibana-5.5.0-linux-x86_64.tar.gz
tar -zxvf kibana-5.5.0-linux-x86_64.tar.gz
cd kibana-5.5.0-linux-x86_64
bin/kibana -d // 后台运行
http://localhost:5601 //默认端口5601访问