elasticsearch-5.3.0.rpm
jdk-8u121-linux-x64.tar.gz
kibana-5.3.0-x86_64.rpm
logstash-5.3.0.rpm

安装步骤略..
创建软连接：ln -s /usr/local/jdk1.8/bin/java /usr/bin/

yum install elasticsearch-5.3.0.rpm -y
systemctl enable elasticsearch
systemctl start elasticsearch
systemctl status elasticsearch

yum install kibana-5.3.0-x86_64.rpm -y
systemctl enable kibana
vim /etc/kibana/kibana.yml
#server.port: 5601
server.port: 9001
#kibanna访问端口，根据需求改

yum install logstash-5.3.0.rpm -y
systemctl start logstash
systemctl status logstash
systemctl enable logstash

input {
    beats {
      port => 5000
      type => "logs"
      codec => multiline {
        pattern => "^%{MONTHNUM}|%{IPV4}"
        negate => true
        what => previous
      }

    }
}
#

"^%{MONTHNUM}|%{IPV4}" --> 合并以月份或者IP开头的行

output { if [type] == "tomcat_log_api01"{ elasticsearch { hosts => ["127.0.0.1:9200"] index => "api01-tomcatlog-%{+YYYY.MM.dd}" } } if [type] == "tomcat_log_api02"{ elasticsearch { hosts => ["127.0.0.1:9200"] index => "api02-tomcatlog-%{+YYYY.MM.dd}" } } if [type] == "tomcat_log_provider01"{ elasticsearch { hosts => ["127.0.0.1:9200"] index => "provider01-tomcatlog-%{+YYYY.MM.dd}" } } if [type] == "tomcat_log_provider02"{ elasticsearch { hosts => ["127.0.0.1:9200"] index => "provider02-tomcatlog-%{+YYYY.MM.dd}" } } if [type] == "tomcat_log_provider03"{ elasticsearch { hosts => ["127.0.0.1:9200"] index => "provider03-tomcatlog-%{+YYYY.MM.dd}" } } if [type] == "tomcat_log_provider04"{ elasticsearch { hosts => ["127.0.0.1:9200"] index => "provider04-tomcatlog-%{+YYYY.MM.dd}" } } if [type] == "tomcat_log_provider05"{ elasticsearch { hosts => ["127.0.0.1:9200"] index => "provider05-tomcatlog-%{+YYYY.MM.dd}" } } if [type] == "tomcat_log_provider06"{ elasticsearch { hosts => ["127.0.0.1:9200"] index => "provider06-tomcatlog-%{+YYYY.MM.dd}" } } if [type] == "tomcat_log_fk01"{ elasticsearch { hosts => ["127.0.0.1:9200"] index => "fk01-tomcatlog-%{+YYYY.MM.dd}" } } if [type] == "tomcat_log_fk02"{ elasticsearch { hosts => ["127.0.0.1:9200"] index => "fk02-tomcatlog-%{+YYYY.MM.dd}" } } if [type] == "tomcat_log_admin01"{ elasticsearch { hosts => ["127.0.0.1:9200"] index => "admin01-tomcatlog-%{+YYYY.MM.dd}" } } if [type] == "tomcat_log_admin02"{ elasticsearch { hosts => ["127.0.0.1:9200"] index => "admin02-tomcatlog-%{+YYYY.MM.dd}" } } if [type] == "nginx_access_log01"{ elasticsearch { hosts => ["127.0.0.1:9200"] index => "ngx-accesslog01-%{+YYYY.MM.dd}" } } stdout { codec => rubydebug } }

#index =>"api01xxx-%{+YYYY.MM.dd}"  --> 建立索引，很重要，用于kibanna索引的建立

yum install filebeat-5.3.0-x86_64.rpm 
systemctl start filebeat
systemctl status filebeat
systemctl enable filebeat

#output.logstash:                                     -->注释
  # The Logstash hosts
  #hosts: ["localhost:5044"]                          -->注释 

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

#底部添加下列内容

filebeat:
spool_size: 1024
idle_timeout: 5s
registry_file: .filebeat
config_dir: /etc/filebeat/conf.d
output:
logstash:
hosts:
- 10.30.205.80:5000              -->elk服务器地址
enabled: true
shipper: {}
logging: {}
runoptions: {}

filebeat:
  prospectors:
    - paths:
      - /usr/local/tomcat8/logs/catalina-daemon.out     --> 要收集的日志
      encoding: plain
      fields_under_root: false
      input_type: log
      ignore_older: 24h
      document_type: tomcat_log_api01                   --> 指定日志的类型，用于日志分类
      scan_frequency: 10s
      harvester_buffer_size: 16384
      tail_files: false
      force_close_files: false
      backoff: 1s
      max_backoff: 1s
      backoff_factor: 2
      partial_line_waiting: 5s
      max_bytes: 10485760