ELKStack 安装部署实战
前言
大部分内容收集自网络，结合自己从零开始学习ELK的特点，记录部署安装最新版本的整个过程，总共由三个组件组成Elasticsearch、Logstash、Kibana。
一、ELKStack简介
（简称ELK）对于日志来说，最常见的需求就是收集、存储、查询、展示，开源社区正好有相对应的开源项目：logstash（收集）、elasticsearch（存储+搜索）、kibana（展示），我们将这三个组合起来的技术称之为ELKStack，所以说ELKStack指的是Elasticsearch、Logstash、Kibana技术栈的结合，一个通用的架构如下图所示：
二、Elasticsearch部署
Elasticsearch首先需要Java环境，所以需要提前安装好JDK，可以直接使用yum安装。也可以从Oracle官网下载JDK进行安装。开始之前要确保JDK正常安装并且环境变量也配置正确：
1.安装JDK
[root@linux-es1 ~]# yum install -y java [root@linux-es1 ~]# java -version openjdk version "1.8.0_65" OpenJDK Runtime Environment (build 1.8.0_65-b17) OpenJDK 64-Bit Server VM (build 25.65-b01, mixed mode)
2.安装ElasticSearch
目前最新版本是：Elasticsearch-6.5.2
官网：https://www.elastic.co/cn/downloads/elasticsearch
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.5.2.rpm yum install elasticsearch-6.5.2.rpm -y
3.修改Elasticsearch配置文件
在ES节点修改配置文件/etc/elasticsearch/elasticsearch.yml
cluster.name: hal #集群的名称， 名称相同的主机就是处于同一个集群 node.name: 192.168.1.24 #集群情况下， 当前node的名字， 每个node应该不一样,这里是根据节点ip设置 path.data: /var/lib/elasticsearch #数据目录 path.logs: /var/log/elasticsearch #日志目录 bootstrap.mlockall: true #服务启动时即锁定足够大的内存， 提高效率，不让数据进入SWAP交换分区 network.host: 192.168.1.24 #监听的地址 http.port: 9200 #客户端访问端口 discovery.zen.ping.unicast.hosts: ["192.168.1.24", "192.168.1.253"] ＃ 组播范围
4.启动Elasticsearch
systemctl start elasticsearch
5.验证
[root@linux-es1 ~]# netstat -lntp #查看端口9200是否正常启动 或 [root@linux-es1 ~]# curl 192.168.1.24:9200/_cat/nodes?pretty 或 [root@linux-es1 ~]# curl 192.168.1.24:9200
有返回类似信息则认为ES成功搭建
三、安装部署LogStash
LogStash部署与配置和Elasticsearch一样，在开始部署LogStash之前也需要你的环境中正确的安装的JDK。可以下载安装Oracle的JDK或者使用 yum安装openjdk。
1.安装JDK
[root@linux-es1 ~]# yum install -y java [root@linux-es1 ~]# java -version openjdk version "1.8.0_65" OpenJDK Runtime Environment (build 1.8.0_65-b17) OpenJDK 64-Bit Server VM (build 25.65-b01, mixed mode)
2.安装logstash
目前最新版本是6.5.2，一般部署在需要收集日志的机器上。
官网：https://www.elastic.co/downloads/logstash
wget https://artifacts.elastic.co/downloads/logstash/logstash-6.5.2.rpm yum install logstash-6.5.2.rpm -y
3、Logstarsh配置命令
测试命令
/usr/share/logstash/bin/logstash -e 'input { stdin{} } output { stdout{ codec => rubydebug }}'
/usr/share/logstash/bin/logstash -e 'input { stdin{} } output { file{ path => "/tmp/logstash.txt"}}'4、日志收集例子
messages.conf 配置文件
input {
file {
path => "/var/log/messages" #日志来源
start_position => "beginning" #从日志最开始的地方收集，默认不从开始收集
type => "systemlog-192.168.1.24"
stat_interval => "2" #2s写一次日志
}
}
output {
elasticsearch {
hosts => ["192.168.1.24:9200"] #写到ES里
index => "logstash-system-log-192.168.1.24-%{+YYYY.MM.dd}" #后面时间戳
}
}记得给收集的日志添加读取权限
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/messages.conf -t #-t为语法检查
通过logstash收集多个日志文件
[root@linux-host3 logstash]# cat /etc/logstash/conf.d/system-log.conf
input {
file {
path => "/var/log/messages" #日志路径
type => "systemlog" #事件的唯一类型
start_position => "beginning" #第一次收集日志的位置
stat_interval => "3" #日志收集的间隔时间
}
file {
path => "/var/log/secure"
type => "securelog"
start_position => "beginning"
stat_interval => "3"
}
}
output {
if [type] == "systemlog" {
elasticsearch {
hosts => ["192.168.56.11:9200"]
index => "system-log-%{+YYYY.MM.dd}"
}}
if [type] == "securelog" {
elasticsearch {
hosts => ["192.168.56.11:9200"]
index => "secury-log-%{+YYYY.MM.dd}"
}}
}
[root@linux-host3 ~]# chmod 644 /var/log/secure
[root@linux-host3 ~]# chmod 644 /var/log/messages
[root@linux-host3 logstash]# systemctl restart logstash收集tomcat和java日志.
#1tomcat日志转json
[root@linux-host6 tomcat]# vim conf/server.xml
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
prefix="tomcat_access_log" suffix=".log"
pattern="{"clientip":"%h","ClientUser":"%l","authenticated":"%u","AccessTime":"%t","method":"%r","status":"%s","SendBytes":"%b","Query?string":"%q","partner":"%{Referer}i","AgentVersion":"%{User-Agent}i"}"/>
[root@linux-host6 tomcat]# ./bin/catalina.sh stop
[root@linux-host6 tomcat]# rm -rf logs/* #删除或清空之前的访问日志
[root@linux-host6 tomcat]# ./bin/catalina.sh start #启动并访问tomcat界面
[root@linux-host6 tomcat]# tail -f logs/localhost_access_log.2017-04-20.txt#2在tomcat服务器安装logstash收集tomcat和系统日志
[root@linux-host6 ~]# yum install logstash-5.3.0.rpm -y
[root@linux-host6 ~]# vim /etc/logstash/conf.d/tomcat.conf
[root@linux-host6 ~]# cat /etc/logstash/conf.d/tomcat.conf
input {
file {
path => "/usr/local/tomcat/logs/localhost_access_log.*.txt"
start_position => "end"
type => "tomct-access-log"
}
file {
path => "/var/log/messages"
start_position => "end"
type => "system-log"
}
}
output {
if [type] == "tomct-access-log" {
elasticsearch {
hosts => ["192.168.56.11:9200"]
index => "logstash-tomcat-5616-access-%{+YYYY.MM.dd}"
codec => "json"
}}
if [type] == "system-log" {
elasticsearch {
hosts => ["192.168.56.12:9200"] #写入到不通的ES服务器
index => "system-log-5616-%{+YYYY.MM.dd}"
}}
}
[root@linux-host6 ~]# systemctl restart logstash #更改完配置文件重启logstash
[root@linux-host6 ~]# tail -f /var/log/logstash/logstash-plain.log #验证日志ab批量访问并验证数据：
[root@linux-host3 ~]# yum install httpd-tools –y [root@linux-host3 ~]# ab -n1000 -c100 http://192.168.56.16:8080/webdir/
收集java日志
[root@linux-host1 ~]# cat /etc/logstash/conf.d/java.conf
input {
file {
path => "/elk/logs/ELK-Cluster.log"
type => "javalog"
start_position => "beginning"
codec => multiline {
pattern => "^\["
negate => true
what => "previous"
}}
}
output {
if [type] == "javalog" {
elasticsearch {
hosts => ["192.168.56.11:9200"]
index => "javalog-5611-%{+YYYY.MM.dd}"
}}
}收集nginx访问日志
[root@linux-host6 nginx]# vim conf/nginx.conf
log_format access_json '{"@timestamp":"$time_iso8601",'
'"host":"$server_addr",'
'"clientip":"$remote_addr",'
'"size":$body_bytes_sent,'
'"responsetime":$request_time,'
'"upstreamtime":"$upstream_response_time",'
'"upstreamhost":"$upstream_addr",'
'"http_host":"$host",'
'"url":"$uri",'
'"domain":"$host",'
'"xff":"$http_x_forwarded_for",'
'"referer":"$http_referer",'
'"status":"$status"}';
access_log /var/log/nginx/access.log access_json;
[root@linux-host6 nginx]# mkdir /var/log/nginx
[root@linux-host6 nginx]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx-1.10.3/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx-1.10.3/conf/nginx.conf test is successful
#配置logstash收集nginx访问日志：
[root@linux-host6 conf.d]# vim nginx.conf
input {
file {
path => "/var/log/nginx/access.log"
start_position => "end"
type => "nginx-accesslog"
codec => json
}
}
output {
if [type] == "nginx-accesslog" {
elasticsearch {
hosts => ["192.168.56.11:9200"]
index => "logstash-nginx-accesslog-5616-%{+YYYY.MM.dd}"
}}
}logstash将日志写入数据库
#安装Mysql
[root@linux-host1 src]# tar xvf mysql-5.6.34-onekey-install.tar.gz
[root@linux-host1 src]# ./mysql-install.sh
[root@linux-host1 src]# /usr/local/mysql/bin/mysql_secure_installation
#授权用户登录：
[root@linux-host1 src]# ln -s /var/lib/mysql/mysql.sock /tmp/mysql.sock
mysql> create database elk character set utf8 collate utf8_bin;
Query OK, 1 row affected (0.00 sec)
mysql> grant all privileges on elk.* to elk@"%" identified by '123456';
Query OK, 0 rows affected (0.00 sec)
mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)
#logstash配置mysql-connector-java包：
#MySQL Connector/J是MySQL官方JDBC驱动程序，JDBC（Java Data Base Connectivity,java数据库连接）是一种用于执行SQL语句的Java API，可以为多种关系数据库提供统一访问，它由一组用Java语言编写的类和接口组成。
#官方下载地址：https://dev.mysql.com/downloads/connector/
[root@linux-host1 src]# mkdir -pv /usr/share/logstash/vendor/jar/jdbc
[root@linux-host1 src]# cp mysql-connector-java-5.1.42-bin.jar /usr/share/logstash/vendor/jar/jdbc/
[root@linux-host1 src]# chown logstash.logstash /usr/share/logstash/vendor/jar/ -R
#国外的gem源由于网络原因，从国内访问太慢而且不稳定，还经常安装不成功，因此之前一段时间很多人都是使用国内淘宝的gem源https://ruby.taobao.org/，现在淘宝的gem源虽然还可以使用已经停止维护更新，其官方介绍推荐使用https://gems.ruby-china.org。
[root@linux-host1 src]# yum install gem
[root@linux-host1 src]# gem sources --add https://gems.ruby-china.org/ --remove https://rubygems.org/
https://ruby.taobao.org/ added to sources
https://rubygems.org/ removed from sources
[root@linux-host1 src]# gem source list
*** CURRENT SOURCES ***
https://gems.ruby-china.org/
#安装配置插件：
[root@linux-host1 src]# /usr/share/logstash/bin/logstash-plugin list #当前已经安装的所有插件
[root@linux-host1 src]# /usr/share/logstash/bin/logstash-plugin install logstash-output-jdbc
#连接数据库创建表
#time的默认值设置为CURRENT_TIMESTAMP
[root@linux-host2 ~]# cat /etc/logstash/conf.d/mysql-es.conf
input {
redis {
host => "192.168.56.12"
port => "6379"
db => "1"
key => "system-log-5612"
data_type => "list"
password => "123456"
}
redis {
host => "192.168.56.12"
port => "6379"
db => "0"
key => "tomcat-accesslog-5612"
data_type => "list"
password => "123456"
codec => "json"
}
}
output {
if [type] == "system-log-5612" {
elasticsearch {
hosts => ["192.168.56.12:9200"]
index => "logstash-system-log-5612-%{+YYYY.MM.dd}"
}}
if [type] == "tomcat-accesslog-5612" {
elasticsearch {
hosts => ["192.168.56.12:9200"]
index => "logstash-tomcat-accesslog-5612-%{+YYYY.MM.dd}"
}
jdbc {
connection_string => "jdbc:mysql://192.168.56.11/elk?user=elk&password=123456&useUnicode=true&characterEncoding=UTF8"
statement => ["INSERT INTO elklog(host,clientip,status,AgentVersion) VALUES(?,?,?,?)", "host","clientip","status","AgentVersion"]
}}
}四、Kibana简介
Kibana 是为 Elasticsearch 设计的开源分析和可视化平台。你可以使用 Kibana 来搜索，查看存储在 Elasticsearch 索引中的数据并与之交互。你可以很容易实现高级的数据分析和可视化，以图表的形式展现出来。
1.安装kibana
目前最新版本是6.5.2
官网：https://www.elastic.co/downloads/kibana
wget https://artifacts.elastic.co/downloads/kibana/kibana-6.5.2-x86_64.rpm yum install -y kibana-6.5.2-x86_64.rpm
2.修改配置文件
server.host: "192.168.1.24" #Kibana 监听的ip lasticsearch.url: "http://192.168.1.24:9200" #ES节点的url
3.启动Kibana
systemctl start kibana
4.Kibana登陆认证
[root@linux-host2 conf]# yum install httpd-tools –y
[root@linux-host2 conf]# htpasswd -bc /usr/local/nginx/conf/htpasswd.users zhangjie 123456
Adding password for user zhangjie
[root@linux-host2 conf]# htpasswd -b /usr/local/nginx/conf/htpasswd.users zhangtao 123456
Adding password for user zhangtao
[root@linux-host2 conf]# cat /usr/local/nginx/conf/htpasswd.users
zhangjie:$apr1$x7K2F2rr$xq8tIKg3JcOUyOzSVuBpz1
zhangtao:$apr1$vBg99m3i$hV/ayYIsDTm950tonXEJ11
[root@linux-host2 conf]# vim /usr/local/nginx/conf/conf.d/kibana5612.conf
upstream kibana_server {
server 127.0.0.1:5601 weight=1 max_fails=3 fail_timeout=60;
}
server {
listen 80;
server_name www.kibana5612.com;
auth_basic "Restricted Access";
auth_basic_user_file /usr/local/nginx/conf/htpasswd.users;
location / {
proxy_pass http://kibana_server;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
}
[root@linux-host2 conf]# chown www.www /usr/local/nginx/ -R
[root@linux-host2 conf]# systemctl reload nginx
桂ICP备16010384号-1
停留在世界边缘，与之惜别