filebeat+elk搭建日志服务器

1.用户创建
useradd ctl
passwd ctl 
准备包
wget https://artifacts.elastic.co/downloads/kibana/kibana-6.8.15-linux-x86_64.tar.gz
curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.8.15.tar.gz
curl -L -O https://artifacts.elastic.co/downloads/logstash/logstash-6.8.15.tar.gz
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.8.15-linux-x86_64.tar.gz

2.环境变量设置
vim /etc/profile
export JAVA_HOME=/home/software/jdk1.8.0_261
export PATH=$JAVA_HOME/bin:$PATH

vim  /etc/security/limits.conf
*     soft   nofile    100000
*     hard   nofile    100000
*     soft   nproc     100000
*     hard   nproc     100000
*     soft   core      100000
*     hard   core      100000
ctl   soft memlock unlimited
ctl   hard memlock unlimited

vi /etc/sysctl.conf 
vm.max_map_count=655360 然后执行sysctl -p 
修改完需要关闭ssh连接重新进入

3.配置elasticsearch
cp elasticsearch.yml elasticsearch.yml.back
node.name: node-1 //注释去除
network.host: 192.168.3.9 //修改
http.port: 9200 //注释去除
bootstrap.memory_lock: false //修改
./elasticsearch -d  静默启动
http://192.168.3.9:9200 验证elasticsearch启动成功

4.配置logstash
cp logstash-sample.conf logstash.conf
修改 logstash.conf
hosts => ["http://192.168.3.9:9200"]
/home/ctl/logstash-6.8.15/bin/logstash -f /home/ctl/logstash-6.8.15/config/logstash.conf  &

5.配置kibana
cp kibana.yml kibana.yml.back
server.port: 5601 //注释去除
server.host: "192.168.3.9"  //修改
elasticsearch.hosts: ["http://192.168.3.9:9200"]  //修改
/home/ctl/kibana-6.8.15-linux-x86_64/bin/kibana    启动服务

6.配置filebeat

cp filebeat.yml filebeat.yml.back
hosts: ["192.168.3.9:9200"]  //修改
enabled: true    //修改
paths:     //修改指定要汇总到logstash的日志
- /root/tomcat/logs/catalina.out  
执行
./filebeat setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["192.168.3.9:9200"]'   (当filebeats配合logstash使用，需要手动load the index template in ElasticSearch，就是filberts直连ElasticSearch load 数据，命令如上)

 /root/filebeat-6.8.15-linux-x86_64/filebeat -e -c /root/filebeat-6.8.15-linux-x86_64/filebeat.yml
7.查看日志
上面两个命令执行后看到

新建index

就可以看到日志了

链接: https://pan.baidu.com/s/14GvLQl6JabW-mARsSo59Cg 提取码: e7j7 复制这段内容后打开百度网盘手机App，操作更方便哦

标签：elk,filebeat,15,192.168,elasticsearch,日志,logstash,6.8
来源： https://blog.csdn.net/CTLLIN/article/details/116484210