ELK
- E elasticsearch 負責對日志進行索引
- L logstash 負責收集日志,輸出到els
- K Kibaba 負責展示es索引的頁面
Kibaba5.5.0 只支持Es5.5.0及以上版本
安裝 elasticsearch
- 注意問題
Likely root cause: expected '<document start>', but found BlockMappingStart
in 'reader', line 54, column 1:
network.bind_host: 0.0.0.0
^
- 解決辦法
參數key 前面要加空格
- 最小配置
path.data: /Users/liuxin/elasticsearch-5.5.2/data
path.logs: /Users/liuxin/elasticsearch-5.5.2/logs
network.bind_host: 0.0.0.0
network.publish_host: 127.0.0.1
network.host: m000
安裝Logstash
解壓配置環境變量
liuxin@MacBook-Pro ~/logstash-2.4.0 cat pro.conf
input {
file {
type => "rabbitmq-test"
path => "/Users/liuxin/rabbitmql_pro.log"
}
}
output {
elasticsearch {
hosts => "127.0.0.1:9200"
index => "logstash-%{type}-%{+YYYY.MM.dd}"
template_overwrite => true
}
}
liuxin@MacBook-Pro ~/logstash-2.4.0
啟動命令 : logstash -f pro.conf
安裝Kibaba
最小配置
server.port: 5601
server.host: "localhost"
elasticsearch.url: "http://localhost:9200"
啟動
bash kibana
