规划

/etc/hosts
20.0.0.210 logstash kibana
20.0.0.211 es1
20.0.0.212 es2
20.0.0.213 es3

es集群

安装

tar xf elasticsearch-7.12.1-linux-x86_64.tar.gz -C /apps/
cd /apps/
ln -s elasticsearch-7.12.1 es

自带 jdk16

useradd es
chown -R es.es /apps/es/

远程访问参数

cat > /etc/security/limits.d/es.conf <es soft nofile 65536
es hard nofile 131072
es soft nproc 4096
es hard nproc 4096
end

cat >> /etc/sysctl.conf << end
# es
vm.max_map_count=655360
end

sysctl -p

配置文件

/apps/es/config/elasticsearch.yml

es1
cluster.name: elk
node.name: es1
network.host: 0.0.0.0
discovery.seed_hosts: [“es1”, “es2”,”es3”]
cluster.initial_master_nodes: [“es1”, “es2”,”es3”]
es2
cluster.name: elk
node.name: es2
network.host: 0.0.0.0
discovery.seed_hosts: [“es1”, “es2”,”es3”]
cluster.initial_master_nodes: [“es1”, “es2”,”es3”]
es3
cluster.name: elk
node.name: es3
network.host: 0.0.0.0
discovery.seed_hosts: [“es1”, “es2”,”es3”]
cluster.initial_master_nodes: [“es1”, “es2”,”es3”]

启动

su es -c ‘/apps/es/bin/elasticsearch -d’

集群状态

curl es3:9200/_cat/health?v （任一 es 主机）

curl es3:9200/_cat/nodes?v （任一 es 主机）

kibana

安装

tar xf kibana-7.12.1-linux-x86_64.tar.gz -C /apps/
cd /apps/
ln -s kibana-7.12.1-linux-x86_64 kibana

配置文件

/apps/kibana/config/kibana.yml
server.host: “0.0.0.0”
elasticsearch.hosts: [“http://es1:9200","http://es2:9200","http://es3:9200“]
i18n.locale: “zh-CN”

以root启动

/apps/kibana/bin/kibana —allow-root

logstash

安装

tar xf logstash-7.12.1-linux-x86_64.tar.gz -C /apps/
cd /apps/
ln -s logstash-7.12.1 logstash

自带 jdk11

filebeat

安装

tar xf filebeat-7.12.1-linux-x86_64.tar.gz -C /apps/
cd /apps/
ln -s filebeat-7.12.1-linux-x86_64 filebeat

cat >> /usr/lib/systemd/system/filebeat.service << end
[Unit]
Description=filebeat server daemon
Wants=network-online.target
After=network-online.target
[Service]
User=root
Group=root
Environment="BEAT_CONFIG_OPTS=-c /apps/filebeat/filebeat.yml"
ExecStart=/apps/filebeat/filebeat \$BEAT_CONFIG_OPTS
Restart=always
[Install]
WantedBy=multi-user.target
end

/etc/supervisord.d/filebeat.ini
[program:filebeat]
command=/apps/filebeat/filebeat -c /apps/filebeat/filebeat.yml
numprocs=1                                     
directory=/apps/filebeat/                        
autostart=true                                 
autorestart=true                               
startsecs=30                                   
startretries=3                                 
exitcodes=0,2                                  
stopsignal=QUIT                                
stopwaitsecs=10                                
user=root                                      
redirect_stderr=true                           
stdout_logfile=/apps/filebeat/supervisor.log   
stdout_logfile_maxbytes=64MB                   
stdout_logfile_backups=4                       
stdout_capture_maxbytes=1MB                    
stdout_events_enabled=false                    
stopasgroup=true
killasgroup=true