1.角色规划

2.安装elasticsearch

• 安装jdk
sudo apt-get install openjdk-8-jre
• 导入Elasticsearch PGP key
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
• 设置apt源
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-6.x.list
• 安装Elasticsearch
sudo apt-get update && sudo apt-get install elasticsearch

3.配置启动elasticsearch

• sudo egrep -v "^$|^#" /etc/elasticsearch/elasticsearch.yml
cluster.name: myelk
node.name: node01
node.attr.rack: r1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
http.port: 9200
• 启动
sudo /bin/systemctl daemon-reload
sudo /bin/systemctl enable elasticsearch.service
sudo systemctl start elasticsearch.service
sudo systemctl stop elasticsearch.service

4.安装Kibana

安装kibana
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-6.x.list
sudo apt-get update && sudo apt-get install kibana
•  配置kibana
upsmart@node02:~sudo egrep -v "^|^#"  /etc/kibana/kibana.yml 
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://192.168.123.39:9200"]
•  启动kibana
sudo /bin/systemctl daemon-reload
sudo /bin/systemctl enable kibana.service
sudo systemctl start kibana.service

5.安装filebeat

安装elastach插件
sudo bin/elasticsearch-plugin install ingest-geoip
sudo bin/elasticsearch-plugin install ingest-user-agent
sudo service  elasticsearch restart
• 安装fielbeat
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.6.1-amd64.deb
sudo dpkg -i filebeat-6.6.1-amd64.deb
• 安装nginx
sudo apt-get install  nginx 
sudo filebeat modules enable nginx
service nginx start
sudo service nginx start 

6.配置filebeat

egrep -v  "#|^" /etc/filebeat/filebeat.yml 
filebeat.inputs:
- type: log
  enabled: false
  paths:
    - /var/log/*.log
filebeat.config.modules:
  path:{path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
setup.kibana:
  host: "192.168.123.39:5601"
output.elasticsearch:
  hosts: ["192.168.123.39:9200"]

7.配置filebeat收集nginx日志

 • egrep -v  "#|^$" /etc/filebeat/modules.d/nginx.yml 
- module: nginx
  access:
    enabled: true
    var.paths: ["/var/log/nginx/access.log*"]
  error:
    enabled: true
    var.paths: ["/var/log/nginx/error.log*"]

8.启动filebeat

 sudo filebeat setup
 sudo service filebeat start

9.配置kibana展示nginx日志分析结果

展示nginx日志最终效果图如下：