Linux修行之路 - 技术博客

cp /etc/apt/sources.list /etc/apt/sources.list.back
echo "" >  /etc/apt/sources.list 

cat <<EOF > /etc/apt/sources.list 
deb http://mirrors.aliyun.com/debian/ bullseye main non-free contrib
deb-src http://mirrors.aliyun.com/debian/ bullseye main non-free contrib
deb http://mirrors.aliyun.com/debian-security/ bullseye-security main
deb-src http://mirrors.aliyun.com/debian-security/ bullseye-security main
deb http://mirrors.aliyun.com/debian/ bullseye-updates main non-free contrib
deb-src http://mirrors.aliyun.com/debian/ bullseye-updates main non-free contrib
deb http://mirrors.aliyun.com/debian/ bullseye-backports main non-free contrib
deb-src http://mirrors.aliyun.com/debian/ bullseye-backports main non-free contrib
EOF

apt update
apt -y upgrade

cd /opt
tar -zxvf elasticsearch-7.7.0-linux-x86_64.tar.gz
mv elasticsearch-7.7.0-linux-x86_64 elasticsearch-7.7.0
cd elasticsearch-7.7.0/config
vim elasticsearch.yml

cluster.name: ELK-Cluster    #ELK的集群名称，名称相同即属于是同一个集群
node.name: elk-node1    #本机在集群内的节点名称
path.data: /opt/elasticsearch-7.7.0/config/data    #数据存放目录
path.logs: /opt/elasticsearch-7.7.0/config/data/log    #日志保存目录
bootstrap.memory_lock: true    #服务启动的时候锁定足够的内存，防止数据写入swap
network.host: 192.168.8.107    #监听的IP地址
http.port: 9200    #服务监听的端口
discovery.seed_hosts: ["192.168.8.107"]   #单播配置一台即可
cluster.initial_master_nodes: ["elk-node1"]

vim jvm.options

-Xms2g
-Xmx2g	

mkdir -p /opt/elasticsearch-7.7.0/config/{data,data/log}
groupadd elk
useradd -g elk elk
passwd elk
chown -R elk:elk /opt/elasticsearch-7.7.0 -R
su elk
cd bin/
./elasticsearch
# 启动报错：需要修改文件的最大打开数以及内存锁定

su elk
cd /opt/elasticsearch-7.7.0/bin/
./elasticsearch

netstat -nltup |grep 9200 #验证服务

cd /opt
tar xf kibana-7.7.0-linux-x86_64.tar.gz 
mv kibana-7.7.0-linux-x86_64 kibana-7.7.0
cd kibana-7.7.0/config/

server.port: 5601    #监听端口
server.host: "192.168.8.107"    #监听地址
elasticsearch.hosts: ["http://192.168.8.107:9200"] #elasticsearch服务器地址

xpack.reporting.capture.browser.chromium.disableSandbox: true
xpack.reporting.capture.browser.chromium.proxy.enabled: false
xpack.reporting.enabled: false

i18n.locale: "zh-CN"    #修改为中文

cd /opt/kibana-7.7.0/bin
nohup ./kibana --allow-root &
netstat -lntp | grep 5601 #验证

cd /opt
tar xf filebeat-7.7.0-linux-x86_64.tar.gz
mv filebeat-7.7.0-linux-x86_64 filebeat-7.7.0
cd filebeat-7.7.0

### Filebeat inputs
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /mnt/opt/service_log/*.log
  #配置多行日志合并规则，已时间为准，一个时间发生的日志为一个事件      
  multiline.pattern: '^\d{4}-\d{2}-\d{2}'
  multiline.negate: true
  multiline.match: after

### Filebeat modules
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

### Kibana
setup.kibana:

setup.kibana.host: "http://192.168.8.107:5601"
setup.dashboards.enabled: true

### Outputs
#--- Elasticsearch output ---
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["192.168.8.107:9200"]
  index: "filebeat-%{+yyyy.MM.dd}"

setup.template.name: "my-log"
setup.template.pattern: "my-log-*"
json.keys_under_root: false
json.overwrite_keys: true
#设置解析json格式日志的规则
processors:
- decode_json_fields:
    fields: [""]
    target: json

nohup ./filebeat -e -c ./filebeat.yml &