環境：

OS：Centos 6.6

elasticsearch-5.6.3.tar.gz

jdk-8u151-linux-x64.tar.gz

kibana-5.6.3-linux-x86_64.tar.gz

logstash-5.6.3.tar.gz

node-v6.11.4-linux-x64.tar.xz

一、準備環境：

1、創建用戶，並給安裝目錄設置權限

[root@1inux ~]# groupadd elk
[root@1inux ~]# useradd -g elk elk
[root@1inux ~]# mkdir /elk
[root@1inux ~]# chown -R elk:elk /elk

修改系統某些參數值：【如不修改啟動時會報錯】

[root@1inux ~]# vim /etc/security/limits.conf  //添加一下內容
---------------------------
* soft nofile 65536
* hard nofile 65536
* soft nproc 2048
* hard nproc 4096
----------------------------
[root@bogon elk]# vim /etc/security/limits.d/90-nproc.conf  //添加如下內容
*          soft    nproc     2048

[root@1inux ~]# vim /etc/sysctl.conf // 添加一下內容
------------------
vm.max_map_count=655360
----------------------
[root@1inux ~]# sysctl -p     // 查看vm.max_map_count 值是否修改成功

安裝Java

[root@1inux elk]# mkdir /usr/local/Java

[root@1inux elk]# tar -zxvf jdk-8u151-linux-x64.tar.gz -C /usr/local/Java

添加環境變量：

[root@1inux jdk1.8.0_151]# vim /etc/profile

添加如下：

export JAVA_HOME=/usr/local/Java/jdk1.8.0_151
export PATH=$PATH:$JAVA_HOME/bin
exportCLASSPATH=.:$JAVA_HOME/lib/tools.jar:$JAVA_HOME/lib/dt.jar:$CLASSPAT

重新加載

[root@1inux jdk1.8.0_151]# source /etc/profile

查看是否安裝成功：

[root@1inux jdk1.8.0_151]# java -version
java version "1.8.0_151"
Java(TM) SE Runtime Environment (build 1.8.0_151-b12)
Java HotSpot(TM) 64-Bit Server VM (build 25.151-b12, mixed mode)

二：安裝ELK

1、安裝elasticsearch

# tar -zxvf elasticsearch-5.6.3.tar.gz
修改配置文件：
vim ./elasticsearch-5.6.3/config/elasticsearch.yml
//設置監聽IP及監聽端口：
network.host: 0.0.0.0    //   設置監聽IP
http.port: 9200    //設置監聽端口

註：elasticsearch不能使用root用戶啟動

啟動elasticsearch //第一次啟動有點慢：

[elk@1inux root]$ cd /elk/elasticsearch-5.6.3/bin
[elk@1inux bin]$ ./elasticsearch

然後查看端口：
[root@1inux ~]# ss -tnl | grep 9200
LISTEN     0      128      ::ffff:192.168.159.130:9200                    :::*     
[root@1inux ~]#

2、安裝kibana

[root@1inux elk]# tar -zxvf kibana-5.6.3-linux-x86_64.tar.gz

解壓後編輯配置文件；

[root@1inux bin]# vim ../config/kibana.yml    //修改為 elasticsearch 的訪問地址及端口如下
#server.host: "localhost"
server.host: "192.168.159.130"
#elasticsearch.url: "http://localhost:9200"
elasticsearch.url: "

然後保存啟動如下；

[root@1inux bin]# ./kibana
  log   [15:45:26.952] [info][status][plugin:[email protected]] Status changed from uninitialized to green - Ready
  log   [15:45:27.067] [info][status][plugin:[email protected]] Status changed from uninitialized to yellow - Waiting for Elasticsearch
  log   [15:45:27.118] [info][status][plugin:[email protected]] Status changed from uninitialized to green - Ready
  log   [15:45:27.136] [info][status][plugin:[email protected]] Status changed from uninitialized to green - Ready
  log   [15:45:27.566] [info][status][plugin:[email protected]] Status changed from uninitialized to green - Ready
  log   [15:45:27.697] [info][listening] Server running at http://localhost:5601
  log   [15:45:27.699] [info][status][ui settings] Status changed from uninitialized to yellow - Elasticsearch plugin is yellow

3、安裝 logstash-5.6.3.tar.gz

[root@1inux elk]# tar -zxvf logstash-5.6.3.tar.gz

解壓後編輯配置文件，然後就可以使用了

報錯：

1、

[root@bogon elk]# ./elasticsearch-5.6.3/bin/elasticsearch
[2017-10-25T06:29:04,996][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root

解決方案：使用elk用戶啟動

問題二、

ERROR: [4] bootstrap checks failed
[1]: max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]
[2]: max number of threads [1024] for user [elk] is too low, increase to at least [2048]
[3]: max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
[4]: system call filters failed to install; check the logs and fix your configuration or disable system call filters k

參考上面系統修改

本文出自 “無常” 博客，請務必保留此出處http://1inux.blog.51cto.com/10037358/1976229

ELK日誌分析平臺搭建全程