CentOS6.5安装elasticsearch+logstash+kibana详解.doc

CentOS6.5安装elasticsearch+logstash+kibana 部署中心节点如果有防火墙需要放开这些端口： port 80 (for the web interface) port 5544 (to receive remote syslog messages) port 9200 (so the web interface can access elasticsearch)安装 java环境和Apache服务 yum install -y java-1.7.0-openjdk httpd 安装ES环境 elasticsearch (JVM?Java 8 update 20 or later, or?Java 7 update 55 or later) wget https://download.elastic.co/elasticsearch/elasticsearch/elasticsearch-1.6.0.noarch.rpm yum install elasticsearch-1.6.0.noarch.rpm -y ? 安装logstash环境 wget https://download.elastic.co/logstash/logstash/packages/centos/logstash-1.5.1-1.noarch.rpm yum install logstash-1.5.1-1.noarch.rpm -y ? 安装kibana环境 wget /kibana/kibana/kibana-3.1.2.zip unzip kibana-3.1.2.zip mv kibana-3.1.2 /var/www/html/kibana ? 安装elasticsearch插件 cd /usr/share/elasticsearch/ ./bin/plugin -install mobz/elasticsearch-head ./bin/plugin -install lukas-vlcek/bigdesk/2.5.0 修改elasticsearch配置文件 vim /etc/elasticsearch/elasticsearch.yml : elasticsearch 去掉前面”#”号 http.cors.enabled: true http.cors.allow-origin: “01” 启动elasticsearch /etc/rc.d/init.d/elasticsearch start 测试elasticsearch[root@localhost ~]# curl :9200 { status : 200, name : Agamotto, cluster_name : elasticsearch, version : { number : 1.4.1, build_hash : 89d3241d670db65f994242c8e8383b169779e2d4, build_timestamp : 2015-11-26T15:49:29Z, build_snapshot : false, lucene_version : 4.10.2 }, tagline : You Know, for Search } [root@localhost ~]# 配置logstash，如下是Logstash的配置文件[root@localhost conf.d]# vim /etc/logstash/conf.d/logstasg_access.conf input { file { type = apache path = [/etc/httpd/logs/*_log,/var/log/nginx/*.log] } file { type = syslog path = [ /var/log/messages, /var/log/syslog ] } file { type = nova path = [ /var/log/nova/*.log ] } file { type = cinder path = [ /var/log/cinder/*.log ] } file { type = neutron path = [ /var/log/neutron/*.log ] } file { type = ceilometer path = [ /var/log/ceilometer/*.log ] } } filter { if [type]