mac安装elk日志三件套
2016-09-27 21:02
323 查看
1.下载logstash-2.0.0.tar.gz解压
https://download.elastic.co/logstash/logstash/logstash-2.0.0.tar.gz
解压到目录/Users/kangzz/software/elk/logstash-2.0.0
tar xzvf logstash-2.0.0.tar.gz
2.添加2个配置文件
1). 添加logstash.conf(采集日志输出到redis中)
在bin目录中添加logstash.conf
input{
file{ #path要采集日志路径
type => "crm_order"
path => ["/Users/kangzz/Pro/logs/crm_order/*"]
start_position => "beginning"
}
file{
type => "crm_page"
path => ["/Users/kangzz/Pro/logs/crm_page/*"]
start_position => "beginning"
}
}
filter {
grok { #配匹字段message中的内容被筛选。(以下是标准正规表达式)
match => { "message" => "" }
}
}
output{
redis{ #以下是redis安装地址
host => "10.30.56.91"
port => 6379
data_type => "list" #接收数据以列表形式
key => "logstash_redis" #队列的名称
}
}
2)添加logstashIndex.conf(从redis队列中取数据放入elasticsearch)
在bin目录中添加logstashIndex.conf
input {
redis{
host => "10.30.56.91"
port => 6379
data_type => "list"
key => "logstash_redis" #与logstash.conf中redis相同
type => "redis-input"
}
}
output {
elasticsearch {
hosts => "127.0.0.1" #该elasticsearch就部署在本机
}
}
3.运行logstash
cd /Users/kangzz/software/elk/logstash-2.0.0/bin/
1)启动第一个进程
./logstash agent -f logstash.conf -l /Users/kangzz/Pro/logs/logstash/stdou.log &
2)启动第二个进程
./logstash agent -f logstashIndex.conf -l /Users/kangzz/Pro/logs/logstash/stdouIndex.log &
三、 elasticsearch
elasticsearch是基于lucene的开源搜索引擎,近年来发展比较快,主要的特点有
• real time
• distributed
• high availability
• document oriented
• schema free
• restful api
1.下载logstash-2.0.0.tar.gz解压
https://download.elasticsearch.org/elasticsearch/release/org/elasticsearch/distribution/tar/elasticsearch/2.0.0/elasticsearch-2.0.0.tar.gz
解压到目录/Users/kangzz/software/elk/elasticsearch-2.0.0
tar xzvf elasticsearch -2.0.0.tar.gz
2.安装head插件
cd /Users/kangzz/software/elk/elasticsearch-2.0.0/bin
./plugin install mobz/elasticsearch-head
查看页面
http://localhost:9200/_plugin/head/
3.启动elasticsearch
cd /Users/kangzz/software/elk/elasticsearch-2.0.0/bin
./elasticsearch &
测试安装
curl -X GET http://localhost:9200/ [root@10.11.5.211 bin]# curl -X GET http://localhost:9200/ {
"name"
: "Piper",
"cluster_name"
: "elasticsearch",
"version"
: {
"number"
: "2.0.0",
"build_hash"
: "de54438d6af8f9340d50c5c786151783ce7d6be5",
"build_timestamp"
: "2016-09-22T08:09:48Z",
"build_snapshot"
: false,
"lucene_version"
: "5.2.1"
},
"tagline"
: "You Know, for Search"
}
测试成功
四、 kibana
Kibana是一个基于浏览器页面的Elasticsearch前端展示工具。Kibana全部使用HTML语言和JavaScript编写的
1.下载kibana-4.2.0-darwin-x64.tar.gz解压
https://www.elastic.co/downloads/past-releases/kibana-4-2.0
https://download.elastic.co/kibana/kibana/kibana-4.2.0-darwin-x64.tar.gz
解压到目录/Users/kangzz/software/elk/elasticsearch-2.0.0
tar xzvf kibana-4.2.0-darwin-x64.tar.gz
2.修改配置文件
修改config目录下kibana.yml文件内容
elasticsearch服务地址
elasticsearch.url: "http://localhost:9200"
3.启动kibana
./kibana &
查看页面 http://localhost:5601
https://download.elastic.co/logstash/logstash/logstash-2.0.0.tar.gz
解压到目录/Users/kangzz/software/elk/logstash-2.0.0
tar xzvf logstash-2.0.0.tar.gz
2.添加2个配置文件
1). 添加logstash.conf(采集日志输出到redis中)
在bin目录中添加logstash.conf
input{
file{ #path要采集日志路径
type => "crm_order"
path => ["/Users/kangzz/Pro/logs/crm_order/*"]
start_position => "beginning"
}
file{
type => "crm_page"
path => ["/Users/kangzz/Pro/logs/crm_page/*"]
start_position => "beginning"
}
}
filter {
grok { #配匹字段message中的内容被筛选。(以下是标准正规表达式)
match => { "message" => "" }
}
}
output{
redis{ #以下是redis安装地址
host => "10.30.56.91"
port => 6379
data_type => "list" #接收数据以列表形式
key => "logstash_redis" #队列的名称
}
}
2)添加logstashIndex.conf(从redis队列中取数据放入elasticsearch)
在bin目录中添加logstashIndex.conf
input {
redis{
host => "10.30.56.91"
port => 6379
data_type => "list"
key => "logstash_redis" #与logstash.conf中redis相同
type => "redis-input"
}
}
output {
elasticsearch {
hosts => "127.0.0.1" #该elasticsearch就部署在本机
}
}
3.运行logstash
cd /Users/kangzz/software/elk/logstash-2.0.0/bin/
1)启动第一个进程
./logstash agent -f logstash.conf -l /Users/kangzz/Pro/logs/logstash/stdou.log &
2)启动第二个进程
./logstash agent -f logstashIndex.conf -l /Users/kangzz/Pro/logs/logstash/stdouIndex.log &
三、 elasticsearch
elasticsearch是基于lucene的开源搜索引擎,近年来发展比较快,主要的特点有
• real time
• distributed
• high availability
• document oriented
• schema free
• restful api
1.下载logstash-2.0.0.tar.gz解压
https://download.elasticsearch.org/elasticsearch/release/org/elasticsearch/distribution/tar/elasticsearch/2.0.0/elasticsearch-2.0.0.tar.gz
解压到目录/Users/kangzz/software/elk/elasticsearch-2.0.0
tar xzvf elasticsearch -2.0.0.tar.gz
2.安装head插件
cd /Users/kangzz/software/elk/elasticsearch-2.0.0/bin
./plugin install mobz/elasticsearch-head
查看页面
http://localhost:9200/_plugin/head/
3.启动elasticsearch
cd /Users/kangzz/software/elk/elasticsearch-2.0.0/bin
./elasticsearch &
测试安装
curl -X GET http://localhost:9200/ [root@10.11.5.211 bin]# curl -X GET http://localhost:9200/ {
"name"
: "Piper",
"cluster_name"
: "elasticsearch",
"version"
: {
"number"
: "2.0.0",
"build_hash"
: "de54438d6af8f9340d50c5c786151783ce7d6be5",
"build_timestamp"
: "2016-09-22T08:09:48Z",
"build_snapshot"
: false,
"lucene_version"
: "5.2.1"
},
"tagline"
: "You Know, for Search"
}
测试成功
四、 kibana
Kibana是一个基于浏览器页面的Elasticsearch前端展示工具。Kibana全部使用HTML语言和JavaScript编写的
1.下载kibana-4.2.0-darwin-x64.tar.gz解压
https://www.elastic.co/downloads/past-releases/kibana-4-2.0
https://download.elastic.co/kibana/kibana/kibana-4.2.0-darwin-x64.tar.gz
解压到目录/Users/kangzz/software/elk/elasticsearch-2.0.0
tar xzvf kibana-4.2.0-darwin-x64.tar.gz
2.修改配置文件
修改config目录下kibana.yml文件内容
elasticsearch服务地址
elasticsearch.url: "http://localhost:9200"
3.启动kibana
./kibana &
查看页面 http://localhost:5601
相关文章推荐
- Mac OS X Redmine Backlogs安装日志
- elk是指logstash,elasticsearch,kibana三件套,这三件套可以组成日志分析和监控工具
- CentOS 7下安装Logstash ELK Stack 日志管理系统(上)
- ELK日志套件安装与使用
- ELK日志套件安装与使用
- 安装 Mac OS X 时不要使用大小写敏感的日志文件系统
- 日志系统ELK使用详解(三)--elasticsearch安装
- ELK日志分析系统实战(一)安装和部署
- CentOS 7下安装Logstash ELK Stack 日志管理系统(下)
- Elk实时日志分析平台5.0版本源码安装配置
- ELK日志解决方案安装配置与使用
- ELK 日志分析系统 安装
- ELK日志集中化管理系统安装
- 在Mac平台上安装配置ELK时的一些总结
- centos6.5下安装配置ELK及收集nginx日志
- CENTOS6.5安装日志分析ELK elasticsearch + logstash + redis + kibana
- Centos7 之安装Logstash ELK stack 日志管理系统
- ELK集中日志管理系统安装部署
- Centos7 之安装Logstash ELK stack 日志管理系统
- 日志系统ELK使用详解(二)--Logstash安装和使用