ELK Stack latest version test installation article_PHP tutorial

Test and installation of the latest version of ELK Stack

Let’s cut the nonsense and get to the point
Look at the version first
filebeat1.0.0-rc2 logstash2.0.0-1 elasticsearch2.0.0 kibana4.2

So much content can be simply summarized as follows:
Term explanation

Elasticsearch storage index
Kibana UI
Kibana dashboard visual mind map
Logstash Input Beats plugin collects events
Elasticsearch output plugin sends transactions
Filebeat log data shipper
Topbeat lightweight server monitoring
Packetbeat online network packet analysis




Architecture




1. Client installation


filebeat architecture




https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html#filebeat-installation


nginx log client Install filebeat


Install filebeat
curl -L -O https://download.elastic.co/beats/filebeat/filebeat-1.0.0-rc2-x86_64.rpm
rpm -vi filebeat-1.0.0-rc2-x86_64.rpm
config filebeat
/etc/filebeat/filebeat.yml


Filebeat configuration:
filebeat:
prospectors :
-
paths:
- "/var/log/*.log"
fields:
type: syslog
output:
elasticsearch:
enabled: true
hosts: ["http://localhost:5043"]


Start filebeat


[root@backup01 filebeat]# curl -XPUT 'http: //192.168.0.58:9200/_template/filebeat?pretty' -d@/etc/filebeat/filebeat.template.json
{
"acknowledged" : true
}




topbeat
https://www.elastic.co/guide/en/beats/topbeat/current/topbeat-getting-started.html


curl - L -O https://download.elastic.co/beats/topbeat/topbeat-1.0.0-rc2-x86_64.rpm
rpm -vih topbeat-1.0.0-rc2-x86_64.rpm


packetbeat
https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-getting-started.html
yum install libpcap
curl -L -O https ://download.elastic.co/beats/packetbeat/packetbeat-1.0.0-rc2-x86_64.rpm
rpm -vi packetbeat-1.0.0-rc2-x86_64.rpm




Second, server-side installation


Install elk
https://www.elastic.co/guide/en/beats/libbeat/1.0.0-rc2/getting -started.html#logstash-setup


It can not only analyze logs, monitor server status, but also analyze network data packets such as http protocol.


elasticsearch installation


yum install java-1.7.0-openjdk
curl -L -O https://download.elastic.co/elasticsearch/elasticsearch /elasticsearch-2.0.0.rpm
rpm -ivh elasticsearch-2.0.0.rpm


Configuration startup
cat /etc/elasticsearch/elasticsearch.yml |grep -Ev "^ $|^#"
path.data: /data
path.logs: /data/elklogs
network.host: 192.168.0.58


chmod elasticsearch:elasticsearch /data /elasticsearch/ -R
chmod elasticsearch:elasticsearch /data/elklogs/ -R


service elasticsearch start




Test elasticsearch
[root@localhost ~]# curl http://127.0.0.1:9200
{
"name" : "Redwing",
"cluster_name" : "elasticsearch",
"version" : {
"number" : "2.0.0",
"build_hash" : "de54438d6af8f9340d50c5c786151783ce7d6be5",
"build_timestamp" : "2015-10-22T08:09:48Z",
"build_snapshot " : false,
"lucene_version" : "5.2.1"
},
"tagline" : "You Know, for Search"
}




logstash installation (102.131)


curl -L -O https://download.elastic.co/logstash/logstash/packages/centos/logstash-2.0.0-1.noarch .rpm
rpm -ivh logstash-2.0.0-1.noarch.rpm




logstash configuration
cat nginxconf.json
input {
beats {
port => 5044
}
}


output {
elasticsearch {
hosts => "192.168.0.58:9200"
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{ YYYY.MM.dd}"
document_type => "%{[@metadata ][type]}"
}
}




kibana installation


curl -L -O https://download .elastic.co/kibana/kibana/kibana-4.2.0-linux-x64.tar.gz
tar xzvf kibana-4.2.0-linux-x64.tar.gz
cd kibana-4.2.0- linux-x64/
./bin/kibana


First modify kibana.yml to set the port number, elaticsearch
mv kibana-4.2.0-linux-x64 /var/kibana
nohup /var/kibana/bin/kibana -e http://192.168.0.58:9200 &


log [13:14:14.588] [info][status][plugin:kibana ] Status changed from uninitialized to green - Ready
log [13:14:14.617] [info][status][plugin:elasticsearch] Status changed from uninitialized to yellow - Waiting for Elasticsearch
log [13:14:14.630] [info][status][plugin:kbn_vislib_vis_types] Status changed from uninitialized to green - Ready
log [13:14:14.639] [info][status][plugin:markdown_vis] Status changed from uninitialized to green - Ready
log [13:14:14.646] [info][status][plugin:metric_vis] Status changed from uninitialized to green - Ready
log [13:14:14.655] [info][status][plugin:spyModes] Status changed from uninitialized to green - Ready
log [13:14:14.658] [info][status][plugin:statusPage] Status changed from uninitialized to green - Ready
log [13:14:14.661] [info][status][plugin:elasticsearch] Status changed from yellow to green - Kibana index ready
log [13:14:14.663] [info][status][plugin:table_vis] Status changed from uninitialized to green - Ready
log [13:14:14.675] [info][listening] Server running at http://0.0.0.0:5601




kibana dashboard加载
curl -L -O http://download.elastic.co/beats/dashboards/beats-dashboards-1.0.0-rc2.tar.gz
tar xzvf beats-dashboards-1.0.0-rc2.tar.gz
cd beats-dashboards-1.0.0-rc2/
./load.sh


./load.sh http://192.168.0.58:9200
curl
Loading search Cache-transactions:
{"_index":".kibana","_type":"search","_id":"Cache-transactions","_version":1,"_shards":{"total":2,"successful":1,"failed":0},"created":true}
Loading search DB-transactions:
{"_index":".kibana","_type":"search","_id":"DB-transactions","_version":1,"_shards":{"total":2,"successful":1,"failed":0},"created":true}


最后测试索引的命令如下：
curl 192.168.0.58:9200/_cat/indices
yellow open .kibana 1 1 93 0 69kb 69kb
yellow open filebeat-2015.11.18 5 1 4109 0 2.9mb 2.9mb
详细配置可以参考配置篇
http://blog.chinaunix.net/uid-25057421-id-5576272.html

http://www.bkjia.com/PHPjc/1081462.htmlwww.bkjia.comtruehttp://www.bkjia.com/PHPjc/1081462.htmlTechArticleELK Stack最新版本测试一安装篇 咱们废话少说，直接切入正题 先看版本 filebeat1.0.0-rc2 logstash2.0.0-1 elasticsearch2.0.0 kibana4.2 那么多内容可以简单...