logstash+elasticsearch+kibana快速搭建日志平台

centos6.5

elasticsearch-1.4.2

logstash-1.4.2

kibana-3.1.2

这三个版本是兼容较好

关闭http防火墙

1:  service iptables stop

2:  安装jdk

3:安装ElasticSearch

mkdir -p /opt/software && cd /opt/software

wget https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-1.4.2.tar.gz
tar -zxvf elasticsearch-1.4.2.tar.gz -C /usr/local/

ln -s /usr/local/elasticsearch-1.4.2 /usr/local/elasticsearch

修改配置文件

vi /usr/local/elasticsearch/config/elasticsearch.yml

在尾部添加代码

http.cors.enabled: true

4: 启动ElasticSearch

wget https://github.com/elasticsearch/elasticsearch-servicewrapper/archive/master.tar.gz
tar -zxvf master

mv /opt/software/elasticsearch-servicewrapper-master/service /usr/local/elasticsearch/bin/

/usr/local/elasticsearch/bin/service/elasticsearch start

5:安装Logstash

wget https://download.elasticsearch.org/logstash/logstash/logstash-1.4.2.tar.gz
tar -zxvf logstash-1.4.2.tar.gz -C /usr/local/

ln -s /usr/local/logstash-1.4.2 /usr/local/logstash

6:增加logstash配置文件

mkdir -p /usr/local/logstash/etc

vim /usr/local/logstash/etc/hello_search.conf

将下面代码复制到conf中（该配置log4j,logback同样适用）

input {

  log4j {

    mode => "server"

    host => "192.168.160.37"

    port => 4560

  }

}

output {

  elasticsearch {

    host => "192.168.160.37"

    port => 9300

  }

}

7:启动logstash（适用log4j或logback记录日志后边有记录）

/usr/local/logstash/bin/logstash -f /usr/local/logstash/etc/hello_search.conf

8:安装kibana（将kibana移动到apache服务的目录下）

wget https://download.elasticsearch.org/kibana/kibana/kibana-3.1.2.tar.gz
tar -zxvf kibana-3.1.2.tar.gz

mv kibana-3.1.2 /usr/local/web/apache/htdocs

9:修改kibana配置文件

vi /usr/local/web/apache/htdocs/kibana/kibana-3.1.2/config.js

找到elasticsearch，并将IP改为你elasticsearch的安装IP地址: "http://192.168.160.92:9200"

10:启动apache服务

service httpd start

11:打开kibana(apache服务端口不能为80)
http://192.168.160.92:8080/kibana/kibana-3.1.2/index.html
log4j配置

在log4j配置文件中加入下列代码

log4j.appender.logstash=org.apache.log4j.net.SocketAppender

log4j.appender.logstash.port=4560

log4j.appender.logstash.remoteHost=192
4000
.168.160.37 #(这里是你logstash设置的服务ip和端口)

在rootLogger尾部追加logstash

log4j.rootLogger=debug,stdout,file,logstash

logback配置

加入maven依赖如果没有则下载jar包

 <dependency>

            <groupId>net.logstash.logback</groupId>

            <artifactId>logstash-logback-encoder</artifactId>

            <version>4.7</version>

</dependency>

在logback.xml加入appender

<appender name="stash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">

        <remoteHost>192.168.160.92</remoteHost>

        <port>4560</port>

        <encoder class="net.logstash.logback.encoder.LogstashEncoder"/>

</appender>

并在root节点加入

<appender-ref ref="stash"/>