2.安裝java環境

cd /usr/local/src
tar zxf jdk-8u65-linux-x64.gz -C /usr/local/
ln -s jdk1.8.0_65 jdk
echo "PATH=/usr/local/jdk/bin:$PATH" >> /etc/profile
source /etc/profile
 

3.ELK環境配置
#修改系統文件
vi /etc/security/limits.conf
#增加的內容

* soft nofile 65536
* hard nofile 65536
* soft nproc 2048
* hard nproc 4096

#修改系統文件
vi /etc/security/limits.d/20-nproc.conf
#調整成以下配置

*          soft    nproc     4096
root       soft    nproc     unlimited

#修改系統文件
vi /etc/sysctl.conf

#增加的內容
vm.max_map_count=655360
fs.file-max=655360
sysctl -p
 

#創建ELK用戶
useradd elk

4.Elasticsearch 部署

mkdir /usr/local/elk6.0.1
cd /usr/local/src/
tar zxf elasticsearch-6.0.1.tar.gz -C /usr/local/elk6.0.1/
cd /usr/local/
ln -s elk6.0.1/elasticsearch-6.0.1 elasticsearch

修改配置文件：

vim kibana/config/kibana.yml
vi elasticsearch/config/elasticsearch.yml
    cluster.name: es-cluster               # 集群名稱
    node.name: node-master                 # master節點名稱
    node.master: true                      # 是否為master
    node.data: true                        # 是否為數據節點
    path.data: /home/apps/elasticsearch    # 數據保存路徑
    path.logs: /home/logs/elasticsearch    # 日誌路徑
    network.host: 172.16.8.8               # 監聽IP，若為0.0.0.0 表示監聽全網IP
    http.port: 9200                        # 端口
    discovery.zen.ping.unicast.hosts: ["172.16.8.8:9200"]   # 配置自動發現的主機
    discovery.zen.minimum_master_nodes: 1                   # 配置只有一個master
 

創建數據目錄：
mkdir -p /home/apps/elasticsearch /home/logs/elasticsearch
修改權限，開放端口訪問

chown -R elk:elk /usr/local/elk6.0.1 elasticsearch /home/apps/elasticsearch /home/logs/elasticsearch
firewall-cmd --add-port=9200/tcp --permanent
firewall-cmd --add-port=9300/tcp --permanent
firewall-cmd --reload

啟動服務：

su - elk；
/usr/local/elasticsearch/bin/elasticsearch -d

查看健康狀態(如果返回status=green表示正常)：
curl http://172.16.8.8:9200/_cluster/health?pretty

5.Logstash 部署

cd /usr/local/src/
tar zxf logstash-6.0.1.tar.gz -C /usr/local/elk6.0.1/
cd /usr/local/
ln -s elk6.0.1/logstash-6.0.1 logstash

修改配置文件：

vi logstash/config/logstash.yml
    path.logs: /home/logs/logstash   # 日誌路徑

創建數據目錄 && 授權：

mkdir -p /home/logs/logstash
chown -R elk:elk elk6.0.1/logstash-6.0.1 logstash /home/logs/logstash

6.Logstash 安裝JDBC插件
/usr/local/logstash/bin/logstash-plugin install logstash-input-jdbc
編寫配置文件：

vi /usr/local/logstash/config/mysqsl-jdbc.conf
input {
   stdin {}
   jdbc {
      jdbc_driver_library => "/usr/local/logstash/mysql-connector-java-5.1.3.jar"
      jdbc_driver_class => "com.mysql.jdbc.Driver"
      jdbc_connection_string => "jdbc:mysql://192.168.0.211:3306/main"
      jdbc_user => "ops"
      jdbc_password => "123"
      jdbc_paging_enabled => "true"
      jdbc_page_size => "50000"
      #statement_filepath => "jdbc.sql"
      statement => "SELECT * from qp_inquiry"
      schedule => "* * * * *"
      type => "jdbc"
   }
}

filter {
   json {
      source => "message"
      remove_field => ["message"]
   }
}

output {
   elasticsearch {
      hosts => "172.16.8.8:9200"
      index => "mysql_query"
      document_id => "%{id}"
   }
   stdout {
      codec => json_lines
   }
}

檢查配置 && 啟動logstash服務

/usr/local/bin/logstash -f config/mysqsl-jdbc.conf --config.test_and_exit
/usr/local/bin/logstash -f config/mysqsl-jdbc.conf

7.kibana 部署

cd /usr/local/src/
tar zxf kibana-6.0.1-linux-x86_64.tar.gz -C /usr/local/elk6.0.1/
cd /usr/local/
ln -s elk6.0.1/kibana-6.0.1-linux-x86_64 kibana

修改配置文件：

vi kibana/config/kibana.yml
    server.port: 5601                                # 端口
    server.host: "172.16.8.8"                        # 監聽IP
    elasticsearch.url: "http://172.16.8.8:9200"      # 配置ES的IP:PORT

修改權限，開放端口訪問

chown -R elk:elk elk6.0.1/kibana-6.0.1-linux-x86_64 kibana
firewall-cmd --add-port=5601/tcp --permanent
firewall-cmd --reload

切換賬號，啟動服務

su - elk;
nohup /usr/local/kibana/bin/kibana &

訪問：
瀏覽器訪問： 172.16.8.8:5601

CentOS7搭建ELK6.0.1