关键字：debian、elk、安装、elasticsearch、kibana、logstash、nginx
时间：2018年8月
0. 环境
Debian GNU/Linux 9
1.安装Java运行环境
root@debian:~# apt-get install openjdk-8-jdk
2. 安装配置ElasticSearch
root@debian:~# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.3.2.deb
root@debian:~# dpkg -i elasticsearch-6.3.2.deb
...
root@debian:~# vim /etc/elasticsearch/elasticsearch.yml
...
#network.host:192.168.0.1
network.host:172.17.1.100
...
:wq
root@debian:~# systemctl start elasticsearch
root@debian:~# ss -ant|grep 9200
LISTEN 0 128 ::ffff:172.17.1.100:9200 :::*
root@debian:~# curl http://172.17.1.100:9200/_search?pretty
{
"took" : 14,
"timed_out" : false,
"_shards" : {
"total" : 0,
"successful" : 0,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : 0.0,
"hits" : [ ]
}
}
3. 安装Logstash
root@debian:~# wget https://artifacts.elastic.co/downloads/logstash/logstash-6.3.2.deb root@debian:~# dpkg -i logstash-6.3.2.deb root@debian:~# systemctl start logstash
4. 安装配置Kibana
root@debian:~# wget https://artifacts.elastic.co/downloads/kibana/kibana-6.3.2-amd64.deb root@debian:~# dpkg -i kibana-6.3.2-amd64.deb root@debian:~# vim /etc/kibana/kibana.yml ... #server.host: "localhost" server.host: "172.17.1.100" ... #elasticsearch.url: "http://localhost:9200" elasticsearch.url: "http://172.17.1.100:9200" ... :wq root@debian:~# systemctl start kibana root@debian:~# ss -ant|grep 5601 root@debian:~# ss -ant|grep 5601 root@debian:~# ss -ant|grep 5601 LISTEN 0 128 172.17.1.100:5601 *:*
注：启动kibana的时间有点长，请耐心等待。
5. Logstash收集Nginx的access日志
root@debian:~# apt-get intall nginx
root@debian:~# vim /etc/logrotate.d/nginx
...
create 0644 www-data adm
...
:wq
root@debian:~# curl http://localhost/
root@debian:~# chmod 644 /var/log/nginx/*
root@debian:~# vim /etc/logstash/conf.d/nginx_access.conf
input {
file {
path => ["/var/log/nginx/access.log"]
start_position => "beginning"
}
}
filter {
grok {
match => {
"message" => "%{HTTPD_COMBINEDLOG}"
}
}
urldecode {
all_fields => true
}
}
output {
elasticsearch {
hosts => ["172.17.1.100:9200"]
index => "logstash-nginx-access-%{+YYYY.MM.dd}"
}
stdout {
codec => rubydebug
}
}
:wq
root@debian:~# systemctl restart logstash
注：/var/log/nginx/access.log默认权限为600，logstash无法访问，需要修改为644。
6. Kibana查看nginx日志
6.1. 配置kibana
1、浏览器打开http://172.17.1.100:5601/
2、点击Managment菜单，显示Create Index Patterns页面
3、Step 1 of 2: Define index pattern页面，填写”logstash-nginx-access-*”（引号不填） -> 点击”Next Step”
4、Step 2 of 2: Configure settings页面，下拉选择”@timestamp”，点击”Create index pattern”
制造Nginx日志
root@debian:~# curl http://172.17.1.100/ root@debian:~# curl http://172.17.1.100/ root@debian:~# curl http://172.17.1.100/
6.2. 搜索日志
1、浏览器打开http://172.17.1.100:5601/
2、点击Discover菜单，点击放大镜按钮。
7. 补充
如需开机启动，请执行如下脚本。
root@debian:~# systemctl enable elasticsearch root@debian:~# systemctl enable logstash root@debian:~# systemctl enable kibana