ELK升级后，安装稍微发生了点变化，在Elasticsearch中增加了很多资源上的限制，其他的倒是没什么变化。不过所有的安装都是基于JDK已经安装完的情况，且为1.8版本。
安装Elasticsearch
在官网下载elsaticsearch安装包：
下载地址
下载对应版本拷贝到服务器，然后执行下面命令解压缩:
tar -zxvf elasticsearch-5.2.2.tar.gz
解压后进入对应的目录,修改配置文件：
cluster.name: page-cluster
node.name: node-104
bootstrap.memory_lock: false
bootstrap.system_call_filter: false
network.host: 0.0.0.0
http.port: 9200
discovery.zen.ping.unicast.hosts: ["other ip"]
其中bootstrap相关是为了解决一个报错：
ERROR: bootstrap checks failed
system call filters failed to install; check the logs and fix your configuration or disable system call filters at your own risk
修改参数vi /etc/sysctl.conf
fs.file-max=65536
vm.max_map_count=262144
然后执行命令sysctl -p
修改系统参数vi /etc/security/limits.conf:
* soft nofile 65536
* hard nofile 65536
* soft nproc 65536
* hard nproc 65536
修改参数vi /etc/security/limits.d/90-nproc.conf
* soft nproc 1024
#修改为
* soft nproc 2048
然后进入bin目录，切换新账户执行ulimit -u 2048，执行./elasticsearch
看到下面输出信息：
[2017-03-20T11:25:00,031][INFO ][o.e.n.Node ] [node-104] initializing ...
[2017-03-20T11:25:00,172][INFO ][o.e.e.NodeEnvironment ] [node-104] using [1] data paths, mounts [[/ (/dev/sda3)]], net usable_space [1.4tb], net total_space [1.7tb], spins? [possibly], types [ext4]
[2017-03-20T11:25:00,173][INFO ][o.e.e.NodeEnvironment ] [node-104] heap size [1.9gb], compressed ordinary object pointers [true]
[2017-03-20T11:25:00,174][INFO ][o.e.n.Node ] [node-104] node name [node-104], node ID [T8UBB8IMT96Gh4bJx9u7ww]
[2017-03-20T11:25:00,176][INFO ][o.e.n.Node ] [node-104] version[5.2.2], pid[30823], build[f9d9b74/2017-02-24T17:26:45.835Z], OS[Linux/2.6.32-642.11.1.el6.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0_65/25.65-b01]
[2017-03-20T11:25:00,974][INFO ][o.e.p.PluginsService ] [node-104] loaded module [aggs-matrix-stats]
[2017-03-20T11:25:00,975][INFO ][o.e.p.PluginsService ] [node-104] loaded module [ingest-common]
[2017-03-20T11:25:00,975][INFO ][o.e.p.PluginsService ] [node-104] loaded module [lang-expression]
[2017-03-20T11:25:00,975][INFO ][o.e.p.PluginsService ] [node-104] loaded module [lang-groovy]
[2017-03-20T11:25:00,975][INFO ][o.e.p.PluginsService ] [node-104] loaded module [lang-mustache]
[2017-03-20T11:25:00,975][INFO ][o.e.p.PluginsService ] [node-104] loaded module [lang-painless]
[2017-03-20T11:25:00,975][INFO ][o.e.p.PluginsService ] [node-104] loaded module [percolator]
[2017-03-20T11:25:00,975][INFO ][o.e.p.PluginsService ] [node-104] loaded module [reindex]
[2017-03-20T11:25:00,976][INFO ][o.e.p.PluginsService ] [node-104] loaded module [transport-netty3]
[2017-03-20T11:25:00,976][INFO ][o.e.p.PluginsService ] [node-104] loaded module [transport-netty4]
[2017-03-20T11:25:00,976][INFO ][o.e.p.PluginsService ] [node-104] no plugins loaded
[2017-03-20T11:25:02,888][INFO ][o.e.n.Node ] [node-104] initialized
[2017-03-20T11:25:02,888][INFO ][o.e.n.Node ] [node-104] starting ...
[2017-03-20T11:25:03,084][INFO ][o.e.t.TransportService ] [node-104] publish_address {10.10.5.104:9300}, bound_addresses {[::]:9300}
[2017-03-20T11:25:03,090][INFO ][o.e.b.BootstrapChecks ] [node-104] bound or publishing to a non-loopback or non-link-local address, enforcing bootstrap checks
[2017-03-20T11:25:06,136][INFO ][o.e.c.s.ClusterService ] [node-104] new_master {node-104}{T8UBB8IMT96Gh4bJx9u7ww}{An_WWH5xTYWUAZ-mXid5JQ}{10.10.5.104}{10.10.5.104:9300}, reason: zen-disco-elected-as-master ([0] nodes joined)
[2017-03-20T11:25:06,154][INFO ][o.e.h.HttpServer ] [node-104] publish_address {1.1.1.1:9200}, bound_addresses {[::]:9200}
[2017-03-20T11:25:06,154][INFO ][o.e.n.Node ] [node-104] started
[2017-03-20T11:25:06,229][INFO ][o.e.g.GatewayService ] [node-104] recovered [0] indices into cluster_state
^C[2017-03-20T11:28:30,939][INFO ][o.e.n.Node ] [node-104] stopping ...
[2017-03-20T11:28:30,977][INFO ][o.e.n.Node ] [node-104] stopped
[2017-03-20T11:28:30,977][INFO ][o.e.n.Node ] [node-104] closing ...
[2017-03-20T11:28:30,987][INFO ][o.e.n.Node ] [node-104] closed
访问对应的地址:http://1.2.3.4:9200/
看到下面的信息，就正常了：
{
"name": "node-104",
"cluster_name": "page-cluster",
"cluster_uuid": "jZsQmqpUSbS_Hwv-NcGWsg",
"version": {
"number": "5.2.2",
"build_hash": "f9d9b74",
"build_date": "2017-02-24T17:26:45.835Z",
"build_snapshot": false,
"lucene_version": "6.4.1"
},
"tagline": "You Know, for Search"
}
安装Kibana
去官网下载Kibana安装包，下载地址
解压缩后，修改配置文件vi kibana.yml：
server.host: 0.0.0.0
运行./bin/kibana,看到输出:
[hdfs@localnode4 bin]$ ./kibana
log [05:22:04.137] [info][status][plugin:kibana@5.2.2] Status changed from uninitialized to green - Ready
log [05:22:04.224] [info][status][plugin:elasticsearch@5.2.2] Status changed from uninitialized to yellow - Waiting for Elasticsearch
log [05:22:04.254] [info][status][plugin:console@5.2.2] Status changed from uninitialized to green - Ready
log [05:22:04.476] [info][status][plugin:timelion@5.2.2] Status changed from uninitialized to green - Ready
log [05:22:04.480] [info][listening] Server running at http://0.0.0.0:5601
log [05:22:04.482] [info][status][ui settings] Status changed from uninitialized to yellow - Elasticsearch plugin is yellow
log [05:22:09.490] [info][status][plugin:elasticsearch@5.2.2] Status changed from yellow to yellow - No existing Kibana index found
log [05:22:10.331] [info][status][plugin:elasticsearch@5.2.2] Status changed from yellow to green - Kibana index ready
log [05:22:10.331] [info][status][ui settings] Status changed from yellow to green - Ready
然后访问对应的页面即可：1.1.1.1:5601
安装logstash
Logstash我用的wondows版本，下载后解压就可以用。下载地址
在logstash_home/bin目录下创建logstash.conf文件，内容如下：
input {
stdin{}
}
output {
stdout{codec=>rubydebug}
}
然后执行下面的命令logstash.bat -f logstash.conf:
C:UsersxxDocumentsworkspaceelklogstash-5.2.2in>logstash.bat -f logstash.conf
Could not find log4j2 configuration at path /Users/xinghailong/Documents/workspace/elk/logstash-5.2.2/config/log4j2.properties. Using default config which logs to console
09:10:25.692 [[main]-pipeline-manager] INFO logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>500}
09:10:25.758 [[main]-pipeline-manager] INFO logstash.pipeline - Pipeline main started
The stdin plugin is now waiting for input:
09:10:26.229 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9600}
test
{
"@timestamp" => 2017-03-20T06:31:49.209Z,
"@version" => "1",
"host" => "DESKTOP-JB5HET6",
"message" => "test
"
}
success
{
"@timestamp" => 2017-03-20T06:31:54.481Z,
"@version" => "1",
"host" => "DESKTOP-JB5HET6",
"message" => "success
"
}