关键字:debian、elk、安装、elasticsearch、kibana、logstash、nginx
时间:2018年8月
0. 环境
Debian GNU/Linux 9
1.安装Java运行环境
root@debian:~# apt-get install openjdk-8-jdk
2. 安装配置ElasticSearch
root@debian:~# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.3.2.deb root@debian:~# dpkg -i elasticsearch-6.3.2.deb ... root@debian:~# vim /etc/elasticsearch/elasticsearch.yml ... #network.host:192.168.0.1 network.host:172.17.1.100 ... :wq root@debian:~# systemctl start elasticsearch root@debian:~# ss -ant|grep 9200 LISTEN 0 128 ::ffff:172.17.1.100:9200 :::* root@debian:~# curl http://172.17.1.100:9200/_search?pretty { "took" : 14, "timed_out" : false, "_shards" : { "total" : 0, "successful" : 0, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : 0, "max_score" : 0.0, "hits" : [ ] } }
3. 安装Logstash
root@debian:~# wget https://artifacts.elastic.co/downloads/logstash/logstash-6.3.2.deb root@debian:~# dpkg -i logstash-6.3.2.deb root@debian:~# systemctl start logstash
4. 安装配置Kibana
root@debian:~# wget https://artifacts.elastic.co/downloads/kibana/kibana-6.3.2-amd64.deb root@debian:~# dpkg -i kibana-6.3.2-amd64.deb root@debian:~# vim /etc/kibana/kibana.yml ... #server.host: "localhost" server.host: "172.17.1.100" ... #elasticsearch.url: "http://localhost:9200" elasticsearch.url: "http://172.17.1.100:9200" ... :wq root@debian:~# systemctl start kibana root@debian:~# ss -ant|grep 5601 root@debian:~# ss -ant|grep 5601 root@debian:~# ss -ant|grep 5601 LISTEN 0 128 172.17.1.100:5601 *:*
注:启动kibana的时间有点长,请耐心等待。
5. Logstash收集Nginx的access日志
root@debian:~# apt-get intall nginx root@debian:~# vim /etc/logrotate.d/nginx ... create 0644 www-data adm ... :wq root@debian:~# curl http://localhost/ root@debian:~# chmod 644 /var/log/nginx/* root@debian:~# vim /etc/logstash/conf.d/nginx_access.conf input { file { path => ["/var/log/nginx/access.log"] start_position => "beginning" } } filter { grok { match => { "message" => "%{HTTPD_COMBINEDLOG}" } } urldecode { all_fields => true } } output { elasticsearch { hosts => ["172.17.1.100:9200"] index => "logstash-nginx-access-%{+YYYY.MM.dd}" } stdout { codec => rubydebug } } :wq root@debian:~# systemctl restart logstash
注:/var/log/nginx/access.log默认权限为600,logstash无法访问,需要修改为644。
6. Kibana查看nginx日志
6.1. 配置kibana
1、浏览器打开http://172.17.1.100:5601/
2、点击Managment菜单,显示Create Index Patterns页面
3、Step 1 of 2: Define index pattern页面,填写”logstash-nginx-access-*”(引号不填) -> 点击”Next Step”
4、Step 2 of 2: Configure settings页面,下拉选择”@timestamp”,点击”Create index pattern”
制造Nginx日志
root@debian:~# curl http://172.17.1.100/ root@debian:~# curl http://172.17.1.100/ root@debian:~# curl http://172.17.1.100/
6.2. 搜索日志
1、浏览器打开http://172.17.1.100:5601/
2、点击Discover菜单,点击放大镜按钮。
7. 补充
如需开机启动,请执行如下脚本。
root@debian:~# systemctl enable elasticsearch root@debian:~# systemctl enable logstash root@debian:~# systemctl enable kibana