虚拟机两台：

192.168.1.42

192.168.1.46

系统环境保持一致：

cat /etc/redhat-release

uname -a

elk准备环境保持一致：

elasticsearch安装：

下载并安装GPG key

rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch

添加yum源：

安装elasticsearch

yum install -y elasticsearch

logstash安装

下载并安装GPG key

1. [root@linux-node2 ~]# rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch

添加yum仓库

1. [root@linux-node2 ~]# vim /etc/yum.repos.d/logstash.repo
2. [logstash-2.1]
3. name=Logstash repository for 2.1.x packages
4. baseurl=http://packages.elastic.co/logstash/2.1/centos
5. gpgcheck=1
6. gpgkey=http://packages.elastic.co/GPG-KEY-elasticsearch
7. enabled=1

安装logstash

1. [root@linux-node2 ~]# yum install -y logstash

安装kibana

1. [root@linux-node2 ~]#cd /usr/local/src
2. [root@linux-node2 ~]#wget https://download.elastic.co/kibana/kibana/kibana-4.3.1-linux-x64.tar.gz
3. tar zxf kibana-4.3.1-linux-x64.tar.gz
4. [root@linux-node1 src]# mv kibana-4.3.1-linux-x64 /usr/local/
5. [root@linux-node2 src]# ln -s /usr/local/kibana-4.3.1-linux-x64/ /usr/local/kibana

安装Redis，nginx和java

yum install -y redis nginx java

管理配置elasticsearch

管理linux-node1的elasticsearch

修改elasticsearch配置文件，并授权

1. [root@linux-node1 src]# grep -n ‘^[a-Z]‘ /etc/elasticsearch/elasticsearch.yml
2. 17:cluster.name: chuck-cluster 判别节点是否是统一集群
3. 23:node.name: linux-node1 节点的hostname
4. 33:path.data: /data/es-data 数据存放路径
5. 37:path.logs: /var/log/elasticsearch/ 日志路径
6. 43:bootstrap.mlockall: true 锁住内存，使内存不会再swap中使用
7. 54:network.host: 0.0.0.0 允许访问的ip
8. 58:http.port: 9200 端口
9. [root@linux-node1 ~]# mkdir -p /data/es-data
10. [root@linux-node1 src]# chown elasticsearch.elasticsearch /data/es-data/

启动elasticsearch

1. [root@linux-node1 src]# systemctl start elasticsearch
2. [root@linux-node1 src]# systemctl enable elasticsearch
3. ln -s ‘/usr/lib/systemd/system/elasticsearch.service‘ ‘/etc/systemd/system/multi-user.target.wants/elasticsearch.service‘
4. [root@linux-node1 src]# systemctl status elasticsearch
5. elasticsearch.service - Elasticsearch
6. Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled)
7. Active: active (running) since Thu 2016-01-14 09:30:25 CST; 14s ago
8. Docs: http://www.elastic.co
9. Main PID: 37954 (java)
10. CGroup: /system.slice/elasticsearch.service
11. └─37954 /bin/java -Xms256m -Xmx1g -Djava.awt.headless=true -XX:+UseParNewGC -XX:+UseConc...
12. Jan 14 09:30:25 linux-node1 systemd[1]: Starting Elasticsearch...
13. Jan 14 09:30:25 linux-node1 systemd[1]: Started Elasticsearch.
14. [root@linux-node1 src]# netstat -lntup|grep 9200
15. tcp6 0 0 :::9200 :::* LISTEN 37954/java

访问9200端口，会把信息显示出来 

elasticsearch进行交互

交互的两种方法

• Java API ： 
  node client 
  Transport client
• RESTful API 
  Javascript 
  .NET 
  php 
  Perl 
  Python 
  Ruby

 使用head插件显示索引和分片情况

/usr/share/elasticsearch/bin/plugin install mobz/elasticsearch-head

在插件中添加一个index-demo/test的索引，提交请求 

待更....

Elk 进阶部署