标签:sign java_home scp NPU oge node primary max 节点集群
ELK简介
1.ElasticSearch简称ES,它是一个实时的分布式搜索和分析引擎,它可以用于全文搜索,结构化搜索以及分析。它是一个建立在全文搜索引擎 Apache Lucene 基础上的搜索引擎,使用 Java 语言编写。
2.Logstash是一个具有实时传输能力的数据收集引擎,用来进行数据收集(如:读取文本文件)、解析、过滤,并将数据发送给ES。
3.Kibana为 Elasticsearch 提供了分析和可视化的 Web 平台。它可以在 Elasticsearch 的索引中查找,交互数据,并生成各种维度表格、图形。
环境准备
cat /etc/redhat-release
CentOS Linux release 7.7.1908 (Core)
角色划分
NODE IP(自己设置) 节点类型
elk-node1 192.168.1.123 数据、主节点(安装elasticsearch、logstash、kabana、filebeat)
elk-node2 192.168.1.124 数据节点(安装elasticsearch、filebeat)
elk-node3 192.168.1.125 数据节点(安装elasticsearch、filebeat)
安装jdk11 (两种安装方式)
------------------------------二进制安装------------------------------
下载安装包
cd /home/tools
wget https://download.java.net/java/GA/jdk11/13/GPL/openjdk-11.0.1_linux-x64_bin.tar.gz
解压到指定目录
tar -xvf openjdk-11.0.1_linux-x64_bin.tar.gz -C /usr/local/jdk
配置环境变量(set java environment)
JAVA_HOME=/usr/local/jdk/jdk-11.0.1
CLASSPATH=$JAVA_HOME/lib/
PATH=$PATH:$JAVA_HOME/bin
export PATH JAVA_HOME CLASSPATH
使环境变量生效
source /etc/profile
---------------------------------yun安装------------------------------
yum -y install java
查看版本
java -version
修改系统内核参数,调整最大虚拟内存映射空间
sysctl -w vm.max_map_count=262144
echo >> /etc/sysctl.conf <<EOF vm.max_map_count=262144 EOF
sudo vi /etc/security/limits.conf
* soft nofile 1000000
* hard nofile 1000000
* soft nproc 1000000
* hard nproc 1000000
* soft memlock unlimited
* hard memlock unlimited
sysctl -p
下载依赖包,安装repo源
yum install -y yum-utils device-mapper-persistent-data lvm2 net-tools vim lrzsz tree screen lsof tcpdump wget ntpdate
vi /etc/yum.repos.d/elastic.repo
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
[kibana-7.x]
name=Kibana repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
yum repolist
修改hosts文件
vi /etc/hosts
elk-node1 192.168.1.123
elk-node2 192.168.1.124
elk-node3 192.168.1.125
部署elasticsearch集群,在所有节点上操作
yum -y install elasticsearch
mv /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/elasticsearch.bak
vi /etc/elasticsearch/elasticsearch.yml
cluster.name: my-elk
node.name: elk-node1 #(对应主机名)
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
transport.tcp.compress: true
network.host: 0.0.0.0
http.port: 9200
transport.tcp.port: 9300
discovery.seed_hosts: ["192.168.1.123","192.168.1.124","192.168.1.125"]
cluster.initial_master_nodes: ["192.168.1.123","192.168.1.124","192.168.1.125"]
network.publish_host: 192.168.1.123 ##本机IP (重点)
node.master: true
node.data: true
xpack.security.enabled: true
http.cors.enabled: true
http.cors.allow-origin: "*" ##跨域访问,支持head插件可以访问es
-------------------------------可忽略内容-----------------------------
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/elastic-certificates.p12
elasticesearch在实际生产中非常消耗内存,需要将初始申请的JVM内存调高,默认是1G
vi /etc/elasticsearch/jvm.options
修改这两行
-Xms4g #设置最小堆的值为4g
-Xmx4g #设置组大堆的值为4g
ElasticSearch默认情况下会每天rolling一个文件,当到达2G的时候,才开始清除超出的部分,
当一个文件只有几十K的时候,文件会一直累计下来。
vi /etc/elasticsearch/log4j2.properties ##
appender.rolling.strategy.action.condition.nested_condition.type = IfLastModified
appender.rolling.strategy.action.condition.nested_condition.age = 30D
限制集群日志增长,这里只保存30天的日志
参考文档:https://blog.51cto.com/huanghai/2430038 ElasticSearch集群日志限制问题
配置TLS和身份验证
在Elasticsearch主节点上配置TLS.
cd /usr/share/elasticsearch/
./bin/elasticsearch-certutil ca ##一直用enter键
./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
ll
total 540
drwxr-xr-x 2 root root 4096 Jun 28 10:42 bin
-rw------- 1 root root 3443 Jun 28 16:46 elastic-certificates.p12
-rw------- 1 root root 2527 Jun 28 16:43 elastic-stack-ca.p12
drwxr-xr-x 8 root root 96 Jun 28 10:42 jdk
drwxr-xr-x 3 root root 4096 Jun 28 10:42 lib
-rw-r--r-- 1 root root 13675 Jun 20 23:50 LICENSE.txt
drwxr-xr-x 30 root root 4096 Jun 28 10:42 modules
-rw-rw-r-- 1 root root 502598 Jun 20 23:56 NOTICE.txt
drwxr-xr-x 2 root root 6 Jun 21 00:04 plugins
-rw-r--r-- 1 root root 8478 Jun 20 23:50 README.textile
给生产的文件添加elasticsearch组权限
chgrp elasticsearch /usr/share/elasticsearch/elastic-certificates.p12 /usr/share/elasticsearch/elastic-stack-ca.p12
给这两个文件赋640权限
chmod 640 /usr/share/elasticsearch/elastic-certificates.p12 /usr/share/elasticsearch/elastic-stack-ca.p12
把这两个文件移动到elasticsearch配置文件夹中
mv /usr/share/elasticsearch/elastic-* /etc/elasticsearch/
将tls身份验证文件拷贝到节点配置文件夹中
scp /etc/elasticsearch/elastic-certificates.p12 root@192.168.1.123:/etc/elasticsearch/
scp /etc/elasticsearch/elastic-stack-ca.p12 root@192.168.1.123:/etc/elasticsearch/
>----------------------------------------------------------------------
**启动服务,验证集群(注意,云服务器安全组配置,依次启动,先主节点集群,在随后启动其他节点**
systemctl start elasticsearch
**设置密码**
/usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive
> ##统一设置密码为123456
**验证集群**
http://192.168.243.163:9200/_cluster/health?pretty ##浏览器访问
{
"cluster_name" : "my-elk",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 3,##节点数
"number_of_data_nodes" : 3, ##数据节点数
"active_primary_shards" : 4,
"active_shards" : 8,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
>----------------------------问题总结----------------------------------
> 问题:集群节点意外挂掉,重启后无法加入集群
> 解答:
> 因为初始状态的时候我们启动es服务,很容易会默认启动一个集群,这个
> 集群中只有一个当前结点作为master,会生成一个cluster_uuid,这个参数不
> 会因为cluster_name的变化而变更。为了让结点能加入到集群中去,我们需要
> 删除掉之前的node信息,重新让node加入到集群中去。
> 对于每个结点做以下操作:
> systemctl stop elasticsearch
> cd /var/lib/elasticsearch/nodes
> rm -fr 0
> systemctl start elasticsearch
> 问题就能解决
**部署kibana**,**yum源安装 #在任意节点上安装**
yum -y install kibana
**修改kibana配置文件**
vi /etc/kibana/kibana.yml
server.port: 5601
server.host: "0.0.0.0"
server.name: "elk-node2"
elasticsearch.hosts: ["http://192.168.1.123:9200","http://192.168.1.124:9200","http://192.168.1.125:9200"]
elasticsearch.username: "elastic"
elasticsearch.password: "123456"
i18n.locale: "en"
**启动服务**
systemctl start kibana
**浏览器访问**
**安装logstash**,**在主节点上进行部署**
>--------------------------------YUM安装------------------------------
yum -y install logstash
>-------------------------------二进制安装----------------------------
wget https://artifacts.elastic.co/downloads/logstash/logstash-7.4.1.tar.gz
tar -zvxf logstash-7.4.1.tar.gz -C /home/elk
mkdir -p /data/logstash/{logs,data}
**修改配置文件**
vi /etc/logstash/logstash.conf
input {
beats {
port => 5044
}
}
filter {
grok {
match => {
"message" => "(?<temMsg>(?<=logBegin ).?(?=logEnd))"
}
overwrite => ["temMsg"]
}
grok {
match => {
"temMsg" => "(?<reqId>(?<=reqId:).?(?=,operatName))"
}
overwrite => ["reqId"]
}
grok {
match => {
"temMsg" => "(?<operatName>(?<=operatName:).?(?=,operatUser))"
}
overwrite => ["operatName"]
}
grok {
match => {
"temMsg" => "(?<operatUser>(?<=operatUser:).?(?=,userType))"
}
overwrite => ["operatUser"]
}
grok {
match => {
"temMsg" => "(?<userType>(?<=userType:).?(?=,requestTime))"
}
overwrite => ["userType"]
}
grok {
match => {
"temMsg" => "(?<requestTime>(?<=requestTime:).?(?=,method))"
}
overwrite => ["requestTime"]
}
grok {
match => {
"temMsg" => "(?<method>(?<=method:).?(?=,params))"
}
overwrite => ["method"]
}
grok {
match => {
"temMsg" => "(?<params>(?<=params:).?(?=,operatIp))"
}
overwrite => ["params"]
}
grok {
match => {
"temMsg" => "(?<operatIp>(?<=operatIp:).?(?=,executionTime))"
}
overwrite => ["operatIp"]
}
grok {
match => {
"temMsg" => "(?<executionTime>(?<=executionTime:).?(?=,operatDesc))"
}
overwrite => ["executionTime"]
}
grok {
match => {
"temMsg" => "(?<operatDesc>(?<=operatDesc:).?(?=result))"
}
overwrite => ["operatDesc"]
}
grok {
match => {
"temMsg" => "(?<result>(?<=result:).?(?=,siteCode))"
}
overwrite => ["result"]
}
grok {
match => {
"temMsg" => "(?<siteCode>(?<=siteCode:).?(?=,module))"
}
overwrite => ["siteCode"]
}
grok {
match => {
"temMsg" => "(?<module>(?<=module:).?(?= ))"
}
overwrite => ["module"]
}
grok {
match => [
"message", "%{NOTSPACE:temMsg}"
]
}
json {
source => "temMsg"
}
urldecode {
all_fields => true
}
mutate {
rename => {"temMsg" => "message"}
remove_field => [ "message" ]
}
}
output {
elasticsearch {
hosts => ["192.168.1.123:9200","192.168.1.124:9200","192.168.1.125:9200"]
user => "elastic"
password => "123456"
#默认情况下,flush_size 是 500 条,idle_flush_time 是 1 秒。
index => "logstash-%{+YYYY.MM.dd}"
}
}
**查看内容**
egrep "#|^$" /etc/logstash/conf.d/logstash_debug.conf
vi /etc/logstash/logstash.yml
http.host: "elk-master"
path.data: /home/elk/data/logstash/data
path.logs: /data/logstash/logstash/logs
xpack.monitoring.enabled: true #kibana监控插件中启动监控logstash
xpack.monitoring.elasticsearch.hosts: ["192.168.1.123:9200","192.168.1.124:9200","192.168.1.125:9200"]
**优化操作##Logstash会一直增长gc文件和不停增多的rolling日志文件,并且不会删除**
vi /etc/logstash/log4j2.properties
appender.rolling.strategy.type = DefaultRolloverStrategy
appender.rolling.strategy.action.type = Delete
appender.rolling.strategy.action.basepath = ${sys:ls.logs}
appender.rolling.strategy.action.condition.type = IfFileName
appender.rolling.strategy.action.condition.glob = ${sys:ls.logs}/logstash-${sys:ls.log.format}
appender.rolling.strategy.action.condition.nested_condition.type = IfLastModified
appender.rolling.strategy.action.condition.nested_condition.age = 15D
**启动logstash服务**
systemctl start logstash
**二进制启动方式**
/usr/share/logstash/bin/logstash -f /etc/logstash/logstash.conf
**启动成功后方可在最后加&放到后台执行**
/usr/share/logstash/bin/logstash -f /etc/logstash/logstash.conf &
**自动重新加载配置**
./bin/lagstash -f configfile.conf --config.reload.automatic > /dev/null 2>&1 &
**部署filebeat**
**下载filebeat**
yum -y install filebeat
**编辑配置文件**
vi /etc/filebaet/filebaet.conf
filebeat.inputs:
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 1
setup.kibana:
hosts: ["192.168.1.123:5601"] #推到es主服务器-ip
output.logstash:
hosts: ["192.168.1.123:5044"] #推到es主服务器-ip
processors:
> ----------------------------另一份配置---------------------------
filebeat.inputs:
**启动filebeat**
systemctl start filebeat
标签:sign java_home scp NPU oge node primary max 节点集群
原文地址:https://blog.51cto.com/13555423/2508776