Elastic Stack之kibana使用
作者：尹正杰
版权声明：原创作品，谢绝转载！否则将追究法律责任。
本篇博客数据流走向：FileBeat ===》Redis ===》logstash ===> elasticsearch ===>kibana。
一.下载kibanna
1>.进入kibanna下载界面
2>.选择kibanna过去发布的版本（https://www.elastic.co/downloads/kibana）
3>.选择kibanna的发行版本
4>.下载kibana
[root@node105 ~]# [root@node105 ~]# ll total 139728 -rw-r--r--. 1 root root 9224611 Sep 19 03:10 filebeat-5.6.12-x86_64.rpm -rw-r--r--. 1 root root 28513410 Mar 4 23:29 GeoLite2-City.tar.gz -rw-r--r--. 1 root root 105333923 Sep 19 03:12 logstash-5.6.12.rpm [root@node105 ~]# [root@node105 ~]# wget https://artifacts.elastic.co/downloads/kibana/kibana-5.6.12-linux-x86_64.tar.gz --2019-03-12 22:01:24-- https://artifacts.elastic.co/downloads/kibana/kibana-5.6.12-linux-x86_64.tar.gz Resolving artifacts.elastic.co (artifacts.elastic.co)... 151.101.230.222, 2a04:4e42:1a::734 Connecting to artifacts.elastic.co (artifacts.elastic.co)|151.101.230.222|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 52364941 (50M) [application/x-gzip] Saving to: ‘kibana-5.6.12-linux-x86_64.tar.gz’ 100%[================================================================================================================================================================================>] 52,364,941 152KB/s in 9m 45s 2019-03-12 22:11:13 (87.5 KB/s) - ‘kibana-5.6.12-linux-x86_64.tar.gz’ saved [52364941/52364941] [root@node105 ~]# [root@node105 ~]# [root@node105 ~]# ll total 190868 -rw-r--r--. 1 root root 9224611 Sep 19 03:10 filebeat-5.6.12-x86_64.rpm -rw-r--r--. 1 root root 28513410 Mar 4 23:29 GeoLite2-City.tar.gz -rw-r--r--. 1 root root 52364941 Sep 19 03:12 kibana-5.6.12-linux-x86_64.tar.gz -rw-r--r--. 1 root root 105333923 Sep 19 03:12 logstash-5.6.12.rpm [root@node105 ~]# [root@node105 ~]#
[root@node105 ~]# [root@node105 ~]# ll total 190868 -rw-r--r--. 1 root root 9224611 Sep 19 03:10 filebeat-5.6.12-x86_64.rpm -rw-r--r--. 1 root root 28513410 Mar 4 23:29 GeoLite2-City.tar.gz -rw-r--r--. 1 root root 52364941 Sep 19 03:12 kibana-5.6.12-linux-x86_64.tar.gz -rw-r--r--. 1 root root 105333923 Sep 19 03:12 logstash-5.6.12.rpm [root@node105 ~]# [root@node105 ~]# [root@node105 ~]# [root@node105 ~]# [root@node105 ~]# [root@node105 ~]# wget https://artifacts.elastic.co/downloads/kibana/kibana-5.6.12-x86_64.rpm --2019-03-12 22:13:23-- https://artifacts.elastic.co/downloads/kibana/kibana-5.6.12-x86_64.rpm Resolving artifacts.elastic.co (artifacts.elastic.co)... 151.101.230.222, 2a04:4e42:1a::734 Connecting to artifacts.elastic.co (artifacts.elastic.co)|151.101.230.222|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 53646640 (51M) [application/octet-stream] Saving to: ‘kibana-5.6.12-x86_64.rpm’ 100%[================================================================================================================================================================================>] 53,646,640 54.4KB/s in 11m 1s 2019-03-12 22:24:28 (79.2 KB/s) - ‘kibana-5.6.12-x86_64.rpm’ saved [53646640/53646640] [root@node105 ~]# [root@node105 ~]# [root@node105 ~]# ll total 243260 -rw-r--r--. 1 root root 9224611 Sep 19 03:10 filebeat-5.6.12-x86_64.rpm -rw-r--r--. 1 root root 28513410 Mar 4 23:29 GeoLite2-City.tar.gz -rw-r--r--. 1 root root 52364941 Sep 19 03:12 kibana-5.6.12-linux-x86_64.tar.gz -rw-r--r--. 1 root root 53646640 Sep 19 03:12 kibana-5.6.12-x86_64.rpm -rw-r--r--. 1 root root 105333923 Sep 19 03:12 logstash-5.6.12.rpm [root@node105 ~]#
二.安装与配置kibanna
1>.安装kibanna
[root@node105 ~]# [root@node105 ~]# ll total 243260 -rw-r--r--. 1 root root 9224611 Sep 19 03:10 filebeat-5.6.12-x86_64.rpm -rw-r--r--. 1 root root 28513410 Mar 4 23:29 GeoLite2-City.tar.gz -rw-r--r--. 1 root root 52364941 Sep 19 03:12 kibana-5.6.12-linux-x86_64.tar.gz -rw-r--r--. 1 root root 53646640 Sep 19 03:12 kibana-5.6.12-x86_64.rpm -rw-r--r--. 1 root root 105333923 Sep 19 03:12 logstash-5.6.12.rpm [root@node105 ~]# [root@node105 ~]# rpm -ivh kibana-5.6.12-x86_64.rpm warning: kibana-5.6.12-x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY Preparing... ################################# [100%] Updating / installing... 1:kibana-5.6.12-1 ################################# [100%] [root@node105 ~]# [root@node105 ~]# [root@node105 ~]# [root@node105 ~]# rpm -ql kibana | wc -l 34600 [root@node105 ~]# [root@node105 ~]#
2>.编辑kibanna的配置文件
[root@node105 ~]# [root@node105 ~]# cp /etc/kibana/kibana.yml /etc/kibana/kibana.yml-`date +%F` [root@node105 ~]# [root@node105 ~]# [root@node105 ~]# cat /etc/kibana/kibana.yml | egrep -v "^#|^$" server.port: 5601 server.host: "0.0.0.0" server.name: "node105.yinzhengjie.org.cn" elasticsearch.url: "http://node101.yinzhengjie.org.cn:9200" elasticsearch.preserveHost: true kibana.index: ".kibana" [root@node105 ~]# [root@node105 ~]#
3>.启动kibanna服务
[root@node105 ~]# [root@node105 ~]# [root@node105 ~]# systemctl start kibana [root@node105 ~]# [root@node105 ~]# systemctl enable kibana Created symlink from /etc/systemd/system/multi-user.target.wants/kibana.service to /etc/systemd/system/kibana.service. [root@node105 ~]# [root@node105 ~]# [root@node105 ~]# systemctl status kibana ● kibana.service - Kibana Loaded: loaded (/etc/systemd/system/kibana.service; enabled; vendor preset: disabled) Active: active (running) since Tue 2019-03-12 22:39:32 CST; 9s ago Main PID: 3403 (node) CGroup: /system.slice/kibana.service └─3403 /usr/share/kibana/bin/../node/bin/node --no-warnings /usr/share/kibana/bin/../src/cli -c /etc/kibana/kibana.yml Mar 12 22:39:35 node105.yinzhengjie.org.cn kibana[3403]: {"type":"log","@timestamp":"2019-03-12T14:39:35Z","tags":["status","plugin:kibana@5.6.12","info"],"pid":3403,"state":"green","message":"Status c...ninitialized"} Mar 12 22:39:35 node105.yinzhengjie.org.cn kibana[3403]: {"type":"log","@timestamp":"2019-03-12T14:39:35Z","tags":["status","plugin:elasticsearch@5.6.12","info"],"pid":3403,"state":"yellow","message":"...ninitialized"} Mar 12 22:39:35 node105.yinzhengjie.org.cn kibana[3403]: {"type":"log","@timestamp":"2019-03-12T14:39:35Z","tags":["status","plugin:console@5.6.12","info"],"pid":3403,"state":"green","message":"Status ...ninitialized"} Mar 12 22:39:35 node105.yinzhengjie.org.cn kibana[3403]: {"type":"log","@timestamp":"2019-03-12T14:39:35Z","tags":["status","plugin:metrics@5.6.12","info"],"pid":3403,"state":"green","message":"Status ...ninitialized"} Mar 12 22:39:35 node105.yinzhengjie.org.cn kibana[3403]: {"type":"log","@timestamp":"2019-03-12T14:39:35Z","tags":["status","plugin:timelion@5.6.12","info"],"pid":3403,"state":"green","message":"Status...ninitialized"} Mar 12 22:39:35 node105.yinzhengjie.org.cn kibana[3403]: {"type":"log","@timestamp":"2019-03-12T14:39:35Z","tags":["listening","info"],"pid":3403,"message":"Server running at http://0.0.0.0:5601"} Mar 12 22:39:35 node105.yinzhengjie.org.cn kibana[3403]: {"type":"log","@timestamp":"2019-03-12T14:39:35Z","tags":["status","ui settings","info"],"pid":3403,"state":"yellow","message":"Status changed f...ninitialized"} Mar 12 22:39:40 node105.yinzhengjie.org.cn kibana[3403]: {"type":"log","@timestamp":"2019-03-12T14:39:40Z","tags":["status","plugin:elasticsearch@5.6.12","info"],"pid":3403,"state":"yellow","message":"...lasticsearch"} Mar 12 22:39:41 node105.yinzhengjie.org.cn kibana[3403]: {"type":"log","@timestamp":"2019-03-12T14:39:41Z","tags":["status","plugin:elasticsearch@5.6.12","info"],"pid":3403,"state":"green","message":"S... index found"} Mar 12 22:39:41 node105.yinzhengjie.org.cn kibana[3403]: {"type":"log","@timestamp":"2019-03-12T14:39:41Z","tags":["status","ui settings","info"],"pid":3403,"state":"green","message":"Status changed fr...in is yellow"} Hint: Some lines were ellipsized, use -l to show in full. [root@node105 ~]# [root@node105 ~]# [root@node105 ~]# [root@node105 ~]# [root@node105 ~]# ss -ntl | grep 5601 LISTEN 0 128 *:5601 *:* [root@node105 ~]#
4>.访问kibanna的web端口
三.kibanna的web界面
1>.搜索响应码是400的日志信息（response: 404 ）
2>.搜索响应码是400或者是200的日志信息（response: 404 OR response: 200）
3>.搜索响应码在200~404之间的（response: [200 TO 404]）
4>.搜索关键字（比如：agent :curl）
四.kibana的图表之饼图（pie）创建案例
1>.点击“Create a visualization”
2>.点击Pie
3>.点击logstash索引
4>.生成饼图
5>.查看已经保存的图
五.kibana的图表之地图创建案例
1>.点击新建
2>.选择地理位置的图
3>.选择索引
4>.查看结果
5>.保存地图
6>.查看已经保存的图
六.创建面板
1>.创建新面板
2>.点击添加按钮
3>.选中你要合并的图
4>.保存自定义面板
5>.查看已经保存的视图
6>.查看视图的详细信息
