释放双眼，带上耳机，听听看~！
一、简介
ELK
由Elasticsearch、Logstash和Kibana三部分组件组成；
Elasticsearch是个开源分布式搜索引擎，它的特点有：分布式，零配置，自动发现，索引自动分片，索引副本机制，restful风格接口，多数据源，自动搜索负载等。
Logstash是一个完全开源的工具，它可以对你的日志进行收集、分析，并将其存储供以后使用
kibana 是一个开源和免费的工具，它可以为 Logstash 和 ElasticSearch 提供的日志分析友好的 Web 界面，可以帮助您汇总、分析和搜索重要数据日志。
二、核心组件
Logstash
: logstash server端用来搜集日志；
Elasticsearch
: 存储各类日志；
Kibana: web化接口用作查寻和可视化日志；
Filebeat是一个日志文件托运工具，在你的服务器上安装客户端后，filebeat会监控日志目录或者指定的日志文件，追踪读取这些文件（追踪文件的变化，不停的读），并且转发这些信息到elasticsearch或者logstarsh中存放。
三、安装脚本
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
2#mail:xuel@anchnet.com
3#data:2017/9/7
4#AutoInstall ELK scripts
5#Software:elasticsearch-5.4.1/logstash-5.4.1/filebeat-5.4.1/kibana-5.4.1
6clear
7echo "#############################################################################"
8echo "# Auto Install ELK. ##"
9echo "# Press Ctrl + C to cancel ##"
10echo "# Any key to continue ##"
11echo "# Softwae:elasticsearch-5.4.1/logstash-5.4.1/filebeat-5.4.1/kibana-5.4.1 ##"
12echo "#############################################################################"
13read -n 1
14software_dir="/usr/local/software"
15elasticsearch_url="https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.4.1.tar.gz"
16kibana_url="https://artifacts.elastic.co/downloads/kibana/kibana-5.4.1-linux-x86_64.tar.gz"
17logstash_url="https://artifacts.elastic.co/downloads/logstash/logstash-5.4.1.tar.gz"
18filebeat_url="https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.4.1-linux-x86_64.tar.gz"
19sys_version=`cat /etc/redhat-release |awk '{print $4}'|cut -d. -f1`
20IP=`ip addr|grep "inet "|grep -v 127.0.0.1|awk '{print $2}'|cut -d/ -f1`
21jvm_conf="/usr/local/elasticsearch/config/jvm.options"
22sys_mem=`free -m|grep Mem:|awk '{print $2}'|awk '{sum+=$1} END {print sum/1024}'|cut -d. -f1`
23#wget software
24wget_fun() {
25if [ ! -d ${software_dir} ];then
26 mkdir -p ${software_dir} && cd ${software_dir}
27else
28 cd ${software_dir}
29fi
30for software in $elasticsearch_url $kibana_url $logstash_url $filebeat_url
31do
32 wget -c $software
33done
34clear
35}
36#initial system:install java wget;set hostname;disable firewalld
37init_sys() {
38[ -f /etc/init.d/functions ] && . /etc/init.d/functions
39[ "${sys_version}" != "7" ] && echo "Error:This Scripts Support Centos7.xx" && exit 1
40[ $(id -u) != "0" ] && echo "Error: You must be root to run this script" && exit 1
41sed -i "s/SELINUX=enforcing/SELINUX=disabled/" /etc/selinux/config
42setenforce 0
43yum install -y java-1.8.0-openjdk wget
44hostnamectl set-hostname elk-server
45systemctl stop firewalld
46cat >>/etc/security/limits.conf<<EOF
47* soft nofile 65536
48* hard nofile 65536
49* soft nGproc 65536
50* hard nproc 65536
51EOF
52}
53#install elasticsearch
54install_elasticsearch() {
55cd $software_dir
56tar zxf elasticsearch-5.4.1.tar.gz
57mv elasticsearch-5.4.1 /usr/local/elasticsearch
58mkdir -p /usr/local/elasticsearch/data /usr/local/elasticsearch/logs
59useradd elasticsearch
60chown -R elasticsearch:elasticsearch /usr/local/elasticsearch
61echo "vm.max_map_count = 655360" >>/etc/sysctl.conf && sysctl -p
62if [ ${sys_mem} -eq 0 ];then
63 sed -i "s#`grep "^-Xmx" ${jvm_conf}`#"-Xmx512m"#g" ${jvm_conf}
64 sed -i "s#`grep "^-Xms" ${jvm_conf}`#"-Xms512m"#g" ${jvm_conf}
65else
66 sed -i "s#`grep "^-Xmx" ${jvm_conf}`#"-Xmx${sys_mem}g"#g" ${jvm_conf}
67 sed -i "s#`grep "^-Xms" ${jvm_conf}`#"-Xms${sys_mem}g"#g" ${jvm_conf}
68fi
69cat >>/usr/local/elasticsearch/config/elasticsearch.yml<<EOF
70cluster.name: my-application
71node.name: elk-server
72path.data: /usr/local/elasticsearch/data
73path.logs: /usr/local/elasticsearch/logs
74network.host: 127.0.0.1
75http.port: 9200
76discovery.zen.ping.unicast.hosts: ["elk-server"]
77EOF
78su - elasticsearch -c "nohup /usr/local/elasticsearch/bin/elasticsearch &"
79}
80#install logstash
81install_logstash() {
82cd $software_dir
83tar -zxf logstash-5.4.1.tar.gz
84mv logstash-5.4.1 /usr/local/logstash
85cat>/usr/local/logstash/config/01-syslog.conf<<EOF
86input {
87 beats {
88 port => "5044"
89 }
90 }
91output {
92 elasticsearch {
93 hosts => "127.0.0.1:9200"
94 }
95 stdout { codec => rubydebug }
96}
97EOF
98nohup /usr/local/logstash/bin/logstash -f /usr/local/logstash/config/01-syslog.conf & >/dev/null
99}
100#install filebeat
101install_filebeat() {
102cd $software_dir
103tar -zxf filebeat-5.4.1-linux-x86_64.tar.gz
104mv filebeat-5.4.1-linux-x86_64 /usr/local/filebeat
105cat >/usr/local/filebeat/filebeat.yml<<EOF
106filebeat.prospectors:
107- input_type: log
108 paths:
109 - /var/log/*.log
110output.logstash:
111 hosts: ["127.0.0.1:5044"]
112EOF
113cd /usr/local/filebeat/
114nohup /usr/local/filebeat/filebeat & >/dev/null
115}
116#install kibana
117install_kibana() {
118cd $software_dir
119tar -zxf kibana-5.4.1-linux-x86_64.tar.gz
120mv kibana-5.4.1-linux-x86_64 /usr/local/kibana
121cat >> /usr/local/kibana/config/kibana.yml <<EOF
122server.port: 5601
123server.host: "0.0.0.0"
124elasticsearch.url: "http://127.0.0.1:9200"
125EOF
126nohup /usr/local/kibana/bin/kibana & >/dev/null
127}
128check() {
129port=$1
130program=$2
131check_port=`netstat -lntup|grep ${port}|wc -l`
132check_program=`ps -ef|grep ${program}|grep -v grep|wc -l`
133if [ $check_port -gt 0 ] && [ $check_program -gt 0 ];then
134 action "${program} run is ok!" /bin/true
135else
136 action "${program} run is error!" /bin/false
137fi
138}
139main() {
140init_sys
141wget_fun
142install_elasticsearch
143install_filebeat
144install_logstash
145install_kibana
146echo -e "\033[32m Checking Elasticsearch...\033[0m"
147sleep 20
148check :9200 "elasticsearch"
149echo -e "\033[32m Checking Logstash...\033[0m"
150sleep 2
151check ":9600" "logstash"
152echo -e "\033[32m Checking Kibana...\033[0m"
153sleep 2
154check ":5601" "kibana"
155action "ELK install is success!" /bin/true
156echo "url:http://$IP:5601"
157}
158main
159
****四、脚本安装
安装完成访问：http://IP:5601即可访问
五、配置
通过web界面访问，创建index patterns
六、查看日志与dashboard
