ELK环境的搭建

#service iptbales stop

#vim /etc/sysconfig/iptables

1. -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT 2. -A INPUT -m state --state NEW -m tcp -p tcp --dport 9200 -j ACCEPT 3. -A INPUT -m state --state NEW -m tcp -p tcp --dport 9292 -j ACCEPT

安装JDK

1. # yum -y install java-1.7.0-openjdk* 2. # java -version

安装Elastic Ssarch

下载Elastic Ssarch

#mkdir /data

#wget https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-1.4.2.tar.gz

#tar -zxvf elasticsearch-1.4.2.tar.gz -C /usr/local/

# ln -s /usr/local/elasticsearch-1.4.2 /usr/local/elasticsearch

安装elasticsearch-servicewrapper，并启动ElasticSearch服务：

#wget

https://github.com/elasticsearch/elasticsearch-servicewrapper/archive/master.tar.gz #tar -xzf master.tar.gz

#mv elasticsearch-servicewrapper-master/service/ /usr/local/elasticsearch/bin/

# /usr/local/elasticsearch/bin/service/elasticsearch start

# curl -X GET http://localhost:9200（测试ElasticSearch服务是否正常，预期返回200的状态码）

安装Logstash

# wget https://download.elasticsearch.org/logstash/logstash/logstash-1.4.2.tar.gz

# tar -zxvf logstash-1.4.2.tar.gz -C /usr/local/ # ln -s /usr/local/logstash-1.4.2 /usr/local/logstash

# /usr/local/logstash/bin/logstash -e 'input { stdin { } } output { stdout {} }' （简单测试Logstash服务是否正常，预期可以将输入内容以简单的日志形式打印在界面上）

创建配置文件目录： mkdir -p /usr/local/logstash/etc vim /usr/local/logstash/etc/hello_search.conf 输入下面：

input { stdin {

type => \"human\" } }

output { stdout {

codec => rubydebug }

elasticsearch {

host => \"192.168.102.129\" port => 9300 } }

/usr/local/logstash/bin/logstash -f /usr/local/logstash/etc/hello_search.conf

安装Kibana

#wget https://download.elasticsearch.org/kibana/kibana/kibana-3.1.2.tar.gz # tar -zxvf kibana-3.1.2.tar.gz

# mv kibana-3.1.2 /var/www/html/kibana # vim /var/www/html/kibana/config.js elasticsearch: \"http://IP:9200\# service httpd start

修改ElasticSearch的配置文件，追加一行内容，并重启ElasticSearch服务# vim /usr/local/elasticsearch/config/elasticsearch.yml

http.cors.enabled: true

http.cors.allow-origin: http://192.168.102.129 cluster.name: elasticsearch

# /usr/local/elasticsearch/bin/service/elasticsearch restart http:// IP /kibana