一、Elasticserach安装

1、Installation(elastic 6.3.2 版本 依赖 java JDK8)

下载合适的版本：

curl -L -O tar -xvf elasticsearch-6.4.0.tar.gzcd elasticsearch-6.4.0/bin./elasticsearch

2、集群健康检查

curl -XGET 集群健康查看curl -XGET 节点状态查看curl -XGET 查看索引curl -XPUT 添加customer索引curl -XDELETE 删除索引

3、Config

cluster.name: 集群名node.name: 节点名path.data: 数据存储路径path.logs: 日志存储路径network.host: 监听地址http.port: 监听端口JVM 配置、logging配置 参考官方文档重要参数：

Path settings

Cluster nameNode nameNetwork hostDiscovery settingsHeap sizeHeap dump pathGC loggingTemp directory重要的系统参数：

Disable swapping

Increase file descriptorsEnsure sufficient virtual memoryEnsure sufficient threadsJVM DNS cache settings

4、Running as daemon

./bin/elasticsearch -d -p pid 启动kill cat pid 停止

5、Set up X-Pack

参考x-pack破解方法

二、kibana安装及配置

wget https://artifacts.elastic.co/downloads/kibana/kibana-6.4.0-linux-x86_64.tar.gz

tar -xzf kibana-6.4.0-linux-x86_64.tar.gz

cd kibana-6.4.0-linux-x86_64/

1、启动  ./bin/kibana           2、config：

server.port: 5601

server.host: "192.168.12.81"kibana.index: ".kibana"elasticsearch.username: "elastic"elasticsearch.password: "dinpay"

三、logstash安装及配置

wget

配置 filebeat 收集Nginx日志： （Nginx.conf）

input {

beats { port => 5044 codec => "json" } }

output {

elasticsearch { hosts => ["127.0.0.1:9200"] index => "test1-nginx-access-%{+YYYY.MM.dd}" template_overwrite => true user => elasticpassword => dinpay } }

配置logstash.yml elastic安装在本机（没有配置https）

xpack.monitoring.enabled: true

xpack.monitoring.elasticsearch.username: elastic xpack.monitoring.elasticsearch.password: dinpay xpack.monitoring.elasticsearch.url: [""]

四、filebeat安装及配置

wget

tar -xf filebeat-6.4.0-linux-x86_64.tar.gz

cd filebeat-6.4.0-linux-x86_64

配置 filebeat.yml

• type: log

  paths:
  • /var/log/nginx/access.log

output.logstash:

hosts: ["192.168.12.81:5044"]

xpack.monitoring:

enabled: trueelasticsearch: hosts: ["", ""]username: elasticpassword: dinpay

五、Nginx 日志格式配置：

log_format json '{"@timestamp":"$time_iso8601",'

'"host":"$server_addr",''"clientip":"$clientRealIp",''"remote_user":"$remote_user",''"request":"$request",' '"http_user_agent":"$http_user_agent",''"size":$body_bytes_sent,' '"responsetime":$request_time,''"upstreamtime":"$upstream_response_time",' '"upstreamhost":"$upstream_addr",''"http_host":"$host",''"url":"$uri",''"domain":"$host",''"xff":"$http_x_forwarded_for",''"referer":"$http_referer",' '"status":"$status",''"ss":"$upstream_status"}';

access_log  /var/log/nginx/access.log  json;map $http_x_forwarded_for $clientRealIp {""  $remote_addr;~^(?P
    
     [0-9\.]+),?.*$    $firstAddr;}