ELK7.x日志系统搭建 1. elk基础搭建

cluster.name: elk-application  #ELK的集群名称，名称相同即属于是同一个集群
node.name: node-5 #本机在集群内的节点名称 要在集群中唯一
path.data: /elk/data #数据存放目录
path.logs: /elk/logs #日志保存目录
network.host: 192.168.179.123 #监听的IP地址
http.port: 9200 #服务监听的端口
discovery.seed_hosts: ["192.168.179.124", "192.168.179.123"] # 提供集群中符合主机要求的节点的列表 服务发现种子主机
cluster.initial_master_nodes: ["192.168.179.124", "192.168.179.123"] # 可以成为master节点的机器 初始主节点
#开启 xpack 功能，如果要禁止使用密码，请将以下内容注释，直接启动不需要设置密码
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12

useradd elastic
passwd elastic
mkdir -p /elk/{data,logs}
chown elasticsearch.elasticsearch /elk/ -R
chown elastic elasticsearch-7.6.0 -R

bin/elasticsearch-certutil cert -out config/elastic-certificates.p12 -pass ""

su - elastic -c "/elasticsearch-7.6.0/bin/elasticsearch -d"

bin/elasticsearch-setup-passwords interactive

Unexpected response code [503] from calling PUT http://192.168.179.124:19200/_security/user/apm_system/_password?pretty
Cause: Cluster state has not been recovered yet, cannot write to the [null] index
Possible next steps:
* Try running this tool again.
* Try running with the --verbose parameter for additional messages.
* Check the elasticsearch logs for additional error details.
* Use the change password API manually. 
ERROR: Failed to set password for user [apm_system].

server.port: 5601
server.host: "192.168.179.124"
elasticsearch.hosts: ["192.168.179.124:9200"]
elasticsearch.username: "elastic"
elasticsearch.password: "123456"

sudo nohup ./bin/kibana --allow-root

./bin/logstash-keystore create

./bin/logstash-keystore add ES_HOST   # http://192.168.179.124:9200/
./bin/logstash-keystore add ES_PWD    # 123456

xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: logstash_system
xpack.monitoring.elasticsearch.password: "${ES_PWD}"
xpack.monitoring.elasticsearch.hosts: ["${ES_HOST}"]

mkdir conf.d
vi system-log.conf
######  配置文件  ######
input {
    file {
        path => "/var/log/syslog.1"    #日志路径
        type => "systemlog"            #类型，自定义，在进行多个日志收集存储时可以通过该项进行判断输出
        start_position => "beginning"        #logstash 从什么位置开始读取文件数据，默认是结束位置，也就是说 logstash 进程会以类似 tail -F 的形式运行。如果你是要导入原有
数据，把这个设定改成 "beginning"，logstash 进程就从头开始读取，类似 less +F 的形式运行。
        stat_interval => "2"    #logstash 每隔多久检查一次被监听文件状态（是否有更新），默认是 1 秒
    }
}
output {
    elasticsearch {
        hosts => ["192.168.179.124:9200"]        #elasticsearch服务器地址
        user => "elastic"
        password => "${ES_PWD}"
        index => "logstash-%{type}-%{+YYYY.MM.dd}"    #索引名称
    }
}

./bin/logstash -f conf.d/system-log.conf