简介
ELK为Elasticsearch、Logstash、Kibana简称,Filebeat为日志传输工具
安装
从https://www.elastic.co/products官网上下载最新的安装包
cluster.name: lios-boot-rest
node.name: lios-boot
path.data: /Users/wenchao.wang/dev/elk/logs
path.logs: /Users/wenchao.wang/dev/elk/logs
network.host: 127.0.0.1
http.port: 9200
启动服务:
./elasticsearch-6.3.2/bin/elasticsearch
input {
beats{
type => "lios-boot-rest"
host => "127.0.0.1"
port => 5044
}
}
output {
elasticsearch{
hosts => ["127.0.0.1:9200"]
index => "lios-boot-rest-%{+YYYY.MM.dd}"
}
}
启动服务:
./logstash-6.3.2/bin/logstash-f./filebeat-to-es.conf
server.port: 5601
server.host: "127.0.0.1"
elasticsearch.url: "http://127.0.0.1:9200"
kibana.index: ".kibana"
启动服务:
./kibana-6.3.2-darwin-x86_64/bin kibana
filebeat.inputs:
- type: log
# Change to true to enable this input configuration.
enabled: true
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /data/lios/logs/apps/lios-boot-rest/*.log
tags: ["lios-boor-rest-log"]
document_type: lios-boot-rest
spool_size: 1024
idle_timeout: "3s"
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
# Period on which files under path should be checked for changes
#reload.period: 10s
setup.template.settings:
index.number_of_shards: 3
#----------------------------- Logstash output --------------------------------
output.logstash:
# The Logstash hosts
hosts: ["127.0.0.1:5044"]
启动filebeat服务
mac上启动方式
sudo chown root filebeat.yml
sudo ./filebeat -e -c filebeat.yml -d "publish"
发现filebeat已经向logstash发送数据了:
可视化
网址中输入 http://localhost:5601/
创建索引:
创建索引成功后,发现已经可以看到数据了: