ELK(ElasticSearch, Logstash, Kibana) v5.3.2 分布式日志收集分析最佳解决方案 基于CentOS 7 ( 一 )

[root@localhost temp]# tar -zxvf logstash-5.3..tar.gz -C /usr/local/
[root@localhost temp]# vim logstatsh_test.conf
==============================================================================================================
input {
    stdin {
    }
}
output {
    stdout {
    codec => rubydebug {}
    }
}
==============================================================================================================
[root@localhost temp]# /usr/local/logstash-5.3./bin/logstash -f logstatsh_test.conf
Sending Logstash's logs to /usr/local/logstash-5.3.2/logs which is now configured via log4j2.properties
[--04T10::,][INFO ][logstash.pipeline        ] Starting pipeline {"id"=>"main", "pipeline.workers"=>, "pipeline.batch.size"=>, "pipeline.batch.delay"=>, "pipeline.max_inflight"=>}
[--04T10::,][INFO ][logstash.pipeline        ] Pipeline main started
The stdin plugin is now waiting for input:
[--04T10::,][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>}
I love you so much!
{
    "@timestamp" => --04T02::.058Z,
      "@version" => "",
          "host" => "localhost.localdomain",
       "message" => "I love you so much!"
}
Me too!
{
    "@timestamp" => --04T02::.527Z,
      "@version" => "",
          "host" => "localhost.localdomain",
       "message" => "Me too!"
}
==============================================================================================================

# 运行机器至少4G内存
[root@localhost temp]# tar -zxvf elasticsearch-5.3..tar.gz
[nescafe@localhost temp]$ mkdir elasticsearch
[nescafe@localhost temp]$ cd elasticsearch
[nescafe@localhost elasticsearch]$ mkdir data
[nescafe@localhost elasticsearch]$ mkdir logs
[root@localhost temp]# vim elasticsearch-5.3./config/elasticsearch.yml

path.data: /home/nescafe/temp/elasticsearch/data
path.logs: /home/nescafe/temp/elasticsearch/logs
network.host: 192.168.1.105
http.port:
discovery.zen.ping.unicast.hosts: ["127.0.0.1", "192.168.1.105"]
discovery.zen.minimum_master_nodes:

# 以下命令nescafe换成当前对应用户
[root@localhost temp]# cp /etc/security/limits.conf /etc/security/limits.conf.bak
[root@localhost temp]# cat /etc/security/limits.conf | grep -v "nescafe" > /tmp/system_limits.conf
[root@localhost temp]# echo "nescafe hard nofile 65536" >> /tmp/system_limits.conf
[root@localhost temp]# echo "nescafe soft nofile 65536" >> /tmp/system_limits.conf
[root@localhost temp]# mv /tmp/system_limits.conf /etc/security/limits.conf
mv：是否覆盖"/etc/security/limits.conf"？ y
[nescafe@localhost temp]$ ulimit -Hn

[root@localhost temp]# cat /etc/sysctl.conf | grep -v "vm.max_map_count" > /tmp/system_sysctl.conf
[root@localhost temp]# echo "vm.max_map_count=262144" >> /tmp/system_sysctl.conf
[root@localhost temp]# mv /tmp/system_sysctl.conf /etc/sysctl.conf
mv：是否覆盖"/etc/sysctl.conf"？ y
[root@localhost temp]# sysctl -p
vm.max_map_count = 

[root@localhost temp]# su nescafe
[nescafe@localhost temp]$ elasticsearch-5.3./bin/elasticsearch
==============================================================================================================
[--04T11::,][INFO ][o.e.n.Node               ] [AlphaGo] initializing ...
[--04T11::,][INFO ][o.e.e.NodeEnvironment    ] [AlphaGo] using [] data paths, mounts [[/home (/dev/mapper/cl-home)]], net usable_space [.7gb], net total_space [.9gb], spins? [possibly], types [xfs]
[--04T11::,][INFO ][o.e.e.NodeEnvironment    ] [AlphaGo] heap size [.9gb], compressed ordinary object pointers [true]
[--04T11::,][INFO ][o.e.n.Node               ] [AlphaGo] node name [AlphaGo], node ID [XifXogadR3-lA9yHSIumjw]
[--04T11::,][INFO ][o.e.n.Node               ] [AlphaGo] version[5.3.], pid[], build[/--24T16::.481Z], OS[Linux/3.10.-514.16..el7.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) -Bit Server VM/1.8.0_121/25.121-b13]
[--04T11::,][INFO ][o.e.p.PluginsService     ] [AlphaGo] loaded module [aggs-matrix-stats]
[--04T11::,][INFO ][o.e.p.PluginsService     ] [AlphaGo] loaded module [ingest-common]
[--04T11::,][INFO ][o.e.p.PluginsService     ] [AlphaGo] loaded module [lang-expression]
[--04T11::,][INFO ][o.e.p.PluginsService     ] [AlphaGo] loaded module [lang-groovy]
[--04T11::,][INFO ][o.e.p.PluginsService     ] [AlphaGo] loaded module [lang-mustache]
[--04T11::,][INFO ][o.e.p.PluginsService     ] [AlphaGo] loaded module [lang-painless]
[--04T11::,][INFO ][o.e.p.PluginsService     ] [AlphaGo] loaded module [percolator]
[--04T11::,][INFO ][o.e.p.PluginsService     ] [AlphaGo] loaded module [reindex]
[--04T11::,][INFO ][o.e.p.PluginsService     ] [AlphaGo] loaded module [transport-netty3]
[--04T11::,][INFO ][o.e.p.PluginsService     ] [AlphaGo] loaded module [transport-netty4]
[--04T11::,][INFO ][o.e.p.PluginsService     ] [AlphaGo] no plugins loaded
[--04T11::,][INFO ][o.e.n.Node               ] [AlphaGo] initialized
[--04T11::,][INFO ][o.e.n.Node               ] [AlphaGo] starting ...
[--04T11::,][INFO ][o.e.t.TransportService   ] [AlphaGo] publish_address {192.168.1.105:}, bound_addresses {192.168.1.105:}
[--04T11::,][INFO ][o.e.b.BootstrapChecks    ] [AlphaGo] bound or publishing to a non-loopback or non-link-local address, enforcing bootstrap checks
[--04T11::,][WARN ][o.e.n.Node               ] [AlphaGo] timed out while waiting for initial discovery state - timeout: 30s
[--04T11::,][INFO ][o.e.h.n.Netty4HttpServerTransport] [AlphaGo] publish_address {192.168.1.105:}, bound_addresses {192.168.1.105:}
[--04T11::,][INFO ][o.e.n.Node               ] [AlphaGo] started
==============================================================================================================
# http://192.168.1.105:9200/
{
  "name" : "AlphaGo",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "_na_",
  "version" : {
    "number" : "5.3.2",
    "build_hash" : "",
    "build_date" : "2017-04-24T16:15:59.481Z",
    "build_snapshot" : false,
    "lucene_version" : "6.4.2"
  },
  "tagline" : "You Know, for Search"
}
==============================================================================================================
[nescafe@localhost temp]$ git clone git://github.com/mobz/elasticsearch-head.git
正克隆到 'elasticsearch-head'...
remote: Counting objects: 4063, done.
remote: Total 4063 (delta 0), reused 0 (delta 0), pack-reused 4063
接收对象中: 100% (4063/4063), 2.10 MiB | 10.00 KiB/s, done.
处理 delta 中: 100% (2222/2222), done.