ELK-shell-install

#!/bin/bash
useradd elk
cd /home/elk
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.3.0.tar.gz
wget https://artifacts.elastic.co/downloads/logstash/logstash-6.3.0.tar.gz
wget https://artifacts.elastic.co/downloads/kibana/kibana-6.3.0-linux-x86_64.tar.gz
tar -zxf elasticsearch-6.3.0.tar.gz
tar -zxf logstash-6.3.0.tar.gz
tar -zxf kibana-6.3.0-linux-x86_64.tar.gz
#elastic
cat >> elasticsearch-6.3.0/config/elasticsearch.yml << EOF
cluster.name: my-application6.3
node.name: node-1
bootstrap.memory_lock: false
bootstrap.system_call_filter: false
network.host: 0.0.0.0
EOF
sed -i '1a\export JAVA_HOME=/usr/java/jdk1.8.0_151' elasticsearch-6.3.0/bin/elasticsearch
echo "vm.max_map_count = 655360" >> /etc/sysctl.conf
sysctl -p > /dev/null 2>&1
#logstash
sed -i '1a\export JAVA_HOME=/usr/java/jdk1.8.0_151' logstash-6.3.0/bin/logstash
cat >> logstash-6.3.0/config/logstash.yml <<EOF
pipeline.workers: 30
pipeline.output.workers: 30
pipeline.batch.size: 2000
pipeline.batch.delay: 50
EOF
cat > logstash-6.3.0/config/logstash.conf << EOF
input {
     file {
        type => "log"
        path => "/home/elk/logs/*.log"
        start_position => "beginning"
    }
}
output {
  elasticsearch {
    hosts => "127.0.0.1:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "log"
  }
}
EOF

#kibana
cat >> kibana-6.3.0-linux-x86_64/config/kibana.yml << EOF
elasticsearch.url: "http://127.0.0.1:9200"
server.host: "127.0.0.1"
EOF
chown -R elk.elk /home/elk

---

---
- hosts: {{ host }}
- tasks:
   - name: inital | useradd
      user: 
        name: elk
        group: elk
        home: /home/elk
        password: { echo -n 'elk' | sha1sum }
        shell: /bin/bash
   - name: install | unarchive logstash
      unarchive: 
         src: logstash-6.2.3.tar.gz
         dest: /home/elk
   - name: install | templtes config/logstash.conf
      template:
        src: ../templates/logstash_conf.j2
        dest: /home/elk/logstash-6.2.3/config/logstash.conf
   - name: install | templtes bin/logstash
      template:
        src: ../templates/logstash.j2
        dest: /home/elk/logstash-6.2.3/bin/logstash
#
#
#!/bin/bash
useradd elk -d /home/elk

---

---

---

#install elk--
#elasticsearch install filebeat_plugin
sed -i '1a\export JAVA_HOME=/usr/java/jdk1.8.0_151' elasticsearch-6.3.0/bin/elasticsearch-plugin
elasticsearch-6.3.0/bin/elasticsearch-plugin install ingest-geoip
cat >> elasticsearch-6.3.0/config/elasticsearch.yml << EOF
http.cors.enabled: true
http.cors.allow-origin: "*"
EOF
#install redis
wget -O /etc/yum.repos.d/epel-7.repo mirrors.aliyun.com/repo/epel-7.repo && yum clean all && yum makecache
yum -y install redis
#install filebeat
rpm -ivh https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.3.0-x86_64.rpm
#ansible 10.11.14.12 -m shell -a "rpm -ivh https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.3.0-x86_64.rpm" -s #批量安装


cat > /etc/filebeat/filebeat.yml <<EOF
filebeat.prospectors:
- input_type: log
   paths:
   - "/home/tomcat/portal/logs/catalina.out"
   fields:
     type: Portal
   fields_under_root: true
output.redis:
hosts: ["10.11.14.10"]
port: 6379
db: 1
key: "235"
name: portal_12
EOF

https://yq.aliyun.com/articles/583355
https://blog.csdn.net/u010871982/article/details/79815304
https://blog.csdn.net/buqutianya/article/details/72019264

---

---

节点	节点的作用
master	master 节点负责一些轻量级的集群操作，比如创建、删除数据索引、跟踪记录集群中节点的状态、决定数据分片（shards）在 data 节点之间的分布；
data	data 节点上保存了数据分片。它负责数据相关操作，比如分片的 CRUD，以及搜索和整合操作。这些操作都比较消耗 CPU、内存和 I/O 资源；
client	client 节点起到路由请求的作用，实际上可以看做负载均衡器。
配置参数
node.master	默认 true。True 表示该节点是 master 节点；
node.data	默认 true。True 表示该节点时 data 节点。如果两个值都为 false，表示是 client 节点。

#master node
node.master: true
node.data: true
discovery.zen.ping.unicast.hosts: ['192.168.9.74']

#data node
node.master: false
node.data: true
discovery.zen.ping.unicast.hosts: ['192.168.9.74']

#client node
node.master: false
node.data: false
discovery.zen.ping.unicast.hosts: ['192.168.9.74']

---

#install rabbitmq-server needed erlang
#centos 6
yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
#centos 7
yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
subscription-manager repos --enable“rhel  -  *  -  optional-rpms”--enable“rhel  -  *  -  extras-rpms”

---

＋ + ++

#install jdk8+
apt install openjdk-8-jre-headless
#install e,k,l,fb
nohup wget -N https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-6.5.0.tar.gz &
nohup wget -N https://artifacts.elastic.co/downloads/kibana/kibana-6.5.0-linux-x86_64.tar.gz &
nohup wget -N https://artifacts.elastic.co/downloads/logstash/logstash-6.5.0.tar.gz &
nohup wget -N https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.5.0-linux-x86_64.tar.gz &
#install fl
gem install fluentd
gem install fluent-plugin-secure-forward fluent-plugin-pushover fluent-plugin-grep fluent-plugin-parser