用的是5.6.9版本，因为一个没有32位的

elk最低要求jdk为1.8
elasticsearch默认要求内存为2g,修改配置

vi ./elasticsearch-5.1.1/config/jvm.options
-Xms2g
-Xmx2g

elasticsearch不能以root用户执行，所以要创建用户，然后切换用户后再执行。
https://blog.csdn.net/weini1111/article/details/60468068
https://blog.csdn.net/liangzhao_jay/article/details/56840941


vi /etc/sysconfig/iptables

-A INPUT -m state --state NEW -m tcp -p tcp --dport 9200 -j ACCEPT
service iptables restart

调整elk配置

vi ./elasticsearch-5.1.1/config/elasticsearch.yml
network.host: 0.0.0.0

3、max file descriptor

ERROR: bootstrap checks failed
max file descriptors [4096] for elasticsearch process is too low, increase to at least [65536]

vi /etc/security/limits.conf 
* hard nofile 65536
* soft nofile 65536


4、max number of threads

max number of threads [1024] for user [user] is too low, increase to at least [2048]
vi /etc/security/limits.d/90-nproc.conf
*          soft    nproc     2048


5、max virtual memory areas

max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
1 sysctl -w vm.max_map_count=262144
2 vi /etc/sysctl.conf 
vm.max_map_count=262144



6、设置/etc/security/limits.d/90-nproc.conf后，仍报错

ERROR: bootstrap checks failed
max number of threads [1876] for user [work] is too low, increase to at least [2048]

查询虚拟机内存，如果内存较低，就会影响实际的最大线程数


在/etc/security/limits.conf文件末尾加入 
* soft nofile 65536 
* hard nofile 131072 
* soft nproc 2048 
* hard nproc 4096 
修改/etc/security/limits.d/20-nproc.conf 
* soft nproc 4096 
改成 
* soft nproc 8192 
在/etc/systml.conf中添加 
vm.max_map_count=655360 

最后执行命令 
‘sysctl -p’




在elasticsearch.yml中配置bootstrap.system_call_filter为false，注意要在Memory下面:
bootstrap.memory_lock: false
bootstrap.system_call_filter: false

head安装

1.地址：https://github.com/mobz/elasticsearch-head 
2.安装git :yum install git 
3.安装node 
wget https://nodejs.org/dist/v8.11.1/node-v8.11.1-linux-x86.tar.xz
tar xvJf  ***.tar.xz来解压
添加环境变量
export NODE_HOME=/usr/local/devtools/node-v8.11.1-linux-x86
export PATH=$ZOOKEEPER_HOME/bin:$PATH

git clone git://github.com/mobz/elasticsearch-head.git
cd elasticsearch-head



npm install
npm run start
open http://localhost:9100/

logstash安装配置

https://my.oschina.net/itblog/blog/547250

log4j主动去连接ELK中的logstash，然后把日志发送到logstash上
 https://blog.csdn.net/ketonfly/article/details/15812499

logstash日志分析的配置和使用
 https://blog.csdn.net/clevercode/article/details/78632887?locationnum=9&fps=1

Logstash 讲解与实战应用
 https://www.cnblogs.com/python-way/p/6110736.html

vi config/log4j_to_es.conf
# For detail structure of this file
# Set: https://www.elastic.co/guide/en/logstash/current/configuration-file-structure.html
input {
  # For detail config for log4j as input,
  # See: https://www.elastic.co/guide/en/logstash/current/plugins-inputs-log4j.html
  log4j {
    mode => "server"
    host => "192.168.112.128"
    port => 4567
  }
  stdin { }
}
filter {
  #Only matched data are send to output.
}
output {
  # For detail config for elasticsearch as output,
  # See: https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html
  elasticsearch {
    action => "index"          #The operation on ES
    hosts  => "192.168.112.128:9200"   #ElasticSearch host, can be array.
    index  => "applog"         #The index to write data to.
  }
  stdout {
    codec => rubydebug
  }
}



./bin/logstash -f config/log4j_to_es.conf

Kibana配置

https://my.oschina.net/itblog/blog/547250

tar -zxvf kibana-4.3.0-linux-x86.tar.gz
cd kibana-4.3.0-linux-x86
vi config/kibana.yml

server.port: 5601
server.host: “Kibanaip”
elasticsearch.url: http://elasticsearchip:9200
kibana.index: “.kibana”


启动kibana：
./bin/kibana


http://localhost:5601/
需要配置至少一个Index名字或者Pattern，它用于在分析时确定ES中的Index。这里我输入之前elasticsearch配置的Index名字applog

配置前先写几个log 到 elasticsearch 

然后就可以成功添加index了

elk安装配置

elk安装配置

用的是5.6.9版本，因为一个没有32位的

head安装

logstash安装配置

Kibana配置