elk-6.1.2学习笔记

朴灿烈づ我的快乐病毒、 2022-05-31 04:15 162阅读 0赞

# elk-6.1.2学习笔记 #

## 一、环境centos7, elasticsearch-6.1.2 ##

*  安装openjdk-1.8：

yum install java-1.8.0-openjdk.x86_64 java-1.8.0-openjdk-devel.x86_64

*  配置JAVA\_HOME(~/.bash\_profile)：

# 添加
    JAVA_HOME=/usr/lib/jvm/java
    PATH=$PATH:$JAVA_HOME/bin

*  修改文件：/etc/sysctl.conf

# 执行sysctl -p生效
    vm.max_map_count = 262144

*  修改文件：/etc/security/limits.conf

# 重新登录生效
    esearch soft nofile 65536
    esearch hard nofile 131072
    esearch soft nproc 2048
    esearch hard nproc 4096

*  修改文件/etc/security/limits.d/90-nproc.conf

esearch soft nproc 4096

*  添加用户组和用户，es不能以root用户运行

# 添加用户组
    groupadd es
    # 查看用户组
    cat /etc/group
    # 添加用户，并指定组
    useradd esearch -g es
    # 设置用户密码
    passwd esearch

*  elk文件，分别解压出来  
    
    
    1.  elasticsearch-6.1.2.zip
    2.  logstash-6.1.2.tar.gz
    3.  kibana-6.1.2-linux-x86\_64.tar.gz

## 二、解压elasticsearch，进入主目录 ##

1.修改文件config/elasticsearch.yml

# 修改
    bootstrap.memory_lock: false
    # 添加
    bootstrap.system_call_filter: false

2.启动

bin/elasticsearch
    # 以后台方式启动
    bin/elasticsearch -d

3.验证:[http://localhost:9200][http_localhost_9200]

## 三、解压kibana，进入主目录 ##

1.启动kibana

bin/kibana
    # 以后台方式启动
    nohup bin/kibana > /dev/null 2>&1 &

3.验证:[http://localhost:5601][http_localhost_5601]

## 四、解压logstash，进入主目录 ##

1.创建配置文件my\_date.conf，从oracle中导入数据到elasticsearch

input {
      jdbc {
        jdbc_driver_library => "path/to/ojdbc6.jar"
        jdbc_driver_class => "Java::oracle.jdbc.driver.OracleDriver"
        jdbc_connection_string => "jdbc:oracle:thin:@ip:1521:orasid"
        jdbc_user => "orauser"
        jdbc_password => "orapwd"
    
        parameters => { "max_num" => 100 }
        statement => "select level my_rowno, sysdate + level my_date from dual connect by level < :max_num"
      }
    }
    
    output {
      elasticsearch {
        hosts => "localhost:9200"
        index => "my_date"
        document_id => "%{my_rowno}"
      }
    }

2.启动

/bin/logstash -f my_date.conf

## tips ##

1.elasticsearch-6.1.2/config/elasticsearch.yml

# 配置集群
    cluster.name: mst-application
    node.name: node-2
    discovery.zen.ping.unicast.hosts: ["ip1", "ip2"]
    # 指定访问IP
    network.host: 0.0.0.0

2.kibana-6.1.2-linux-x86\_64/config/kibana.yml

# 指定访问IP
    server.host: "0.0.0.0"

3.elasticsearch结构为: index->type->document, 版本6中一个index只允许一个type

4.index相当于database table, document相当于database row

[http_localhost_9200]: http://localhost:9200
[http_localhost_5601]: http://localhost:5601