ELK 日志查询分析nginx日志

 1 # ======================== Elasticsearch Configuration =========================
 2 #
 3 # NOTE: Elasticsearch comes with reasonable defaults for most settings.
 4 #       Before you set out to tweak and tune the configuration, make sure you
 5 #       understand what are you trying to accomplish and the consequences.
 6 #
 7 # The primary way of configuring a node is via this file. This template lists
 8 # the most important settings you may want to configure for a production cluster.
 9 #
10 # Please consult the documentation for further information on configuration options:
11 # https://www.elastic.co/guide/en/elasticsearch/reference/index.html
12 #
13 # ---------------------------------- Cluster -----------------------------------
14 #
15 # Use a descriptive name for your cluster:
16 #
17 cluster.name: hna-es 
18 #
19 # ------------------------------------ Node ------------------------------------
20 #
21 # Use a descriptive name for the node:
22 #
23 node.name: hna-es-1 
24 #
25 # Add custom attributes to the node:
26 #
27 #node.attr.rack: r1
28 #
29 # ----------------------------------- Paths ------------------------------------
30 #
31 # Path to directory where to store the data (separate multiple locations by comma):
32 #
33 #path.data: /var/lib/elasticsearch
34 path.data: /data/components/elasticsearch 
35 #
36 # Path to log files:
37 #
38 path.logs: /data/logs/elasticsearch
39 #path.logs: /var/log/elasticsearch
40 #
41 # ----------------------------------- Memory -----------------------------------
42 #
43 # Lock the memory on startup:
44 #
45 #bootstrap.memory_lock: true
46 #
47 # Make sure that the heap size is set to about half the memory available
48 # on the system and that the owner of the process is allowed to use this
49 # limit.
50 #
51 # Elasticsearch performs poorly when the system is swapping the memory.
52 #
53 # ---------------------------------- Network -----------------------------------
54 #
55 # Set the bind address to a specific IP (IPv4 or IPv6):
56 #
57 network.host: 0.0.0.0 
58 #
59 # Set a custom port for HTTP:
60 #
61 http.port: 9200
62 #
63 # For more information, consult the network module documentation.
64 #
65 # --------------------------------- Discovery ----------------------------------
66 #
67 # Pass an initial list of hosts to perform discovery when new node is started:
68 # The default list of hosts is ["127.0.0.1", "[::1]"]
69 #
70 discovery.zen.ping.unicast.hosts: ["192.168.100.130"]
71 #
72 # Prevent the "split brain" by configuring the majority of nodes (total number of master-eligible nodes / 2 + 1):
73 #
74 #discovery.zen.minimum_master_nodes: 3
75 #
76 # For more information, consult the zen discovery module documentation.
77 #
78 # ---------------------------------- Gateway -----------------------------------
79 #
80 # Block initial recovery after a full cluster restart until N nodes are started:
81 #
82 #gateway.recover_after_nodes: 3
83 #
84 # For more information, consult the gateway module documentation.
85 #
86 # ---------------------------------- Various -----------------------------------
87 #
88 # Require explicit names when deleting indices:
89 #
90 #action.destructive_requires_name: true
91 # ---------------------------------- X-pack-----------------------------------
92 xpack.ssl.key: /etc/elasticsearch/config/hna-es-1/hna-es-1.key
93 xpack.ssl.certificate: /etc/elasticsearch/config/hna-es-1/hna-es-1.crt
94 xpack.ssl.certificate_authorities: /etc/elasticsearch/config/ca/ca.crt
95 xpack.security.transport.ssl.enabled: true
96 xpack.ssl.verification_mode: certificate 
elasticsearch1.yml
# ======================== Elasticsearch Configuration =========================
#
# NOTE: Elasticsearch comes with reasonable defaults for most settings.
#       Before you set out to tweak and tune the configuration, make sure you
#       understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.elastic.co/guide/en/elasticsearch/reference/index.html
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: hna-es 
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: hna-es-2 
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
#path.data: /var/lib/elasticsearch
path.data: /data/components/elasticsearch 
#
# Path to log files:
#
path.logs: /data/logs/elasticsearch 
#path.logs: /var/log/elasticsearch
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# Elasticsearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 0.0.0.0 
#
# Set a custom port for HTTP:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when new node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.zen.ping.unicast.hosts: ["192.168.100.129"]
#
# Prevent the "split brain" by configuring the majority of nodes (total number of master-eligible nodes / 2 + 1):
#
#discovery.zen.minimum_master_nodes: 3
#
# For more information, consult the zen discovery module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true

# ---------------------------------- X-pack-----------------------------------
xpack.ssl.key: /etc/elasticsearch/config/hna-es-2/hna-es-2.key 
xpack.ssl.certificate: /etc/elasticsearch/config/hna-es-2/hna-es-2.crt 
xpack.ssl.certificate_authorities: /etc/elasticsearch/config/ca/ca.crt 
xpack.security.transport.ssl.enabled: true
xpack.ssl.verification_mode: certificate
elasticsearch2.yml
  1 # Kibana is served by a back end server. This setting specifies the port to use.
  2 server.port: 8080 
  3 
  4 # Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
  5 # The default is 'localhost', which usually means remote machines will not be able to connect.
  6 # To allow connections from remote users, set this parameter to a non-loopback address.
  7 server.host: "0.0.0.0"
  8 
  9 # Enables you to specify a path to mount Kibana at if you are running behind a proxy. This only affects
 10 # the URLs generated by Kibana, your proxy is expected to remove the basePath value before forwarding requests
 11 # to Kibana. This setting cannot end in a slash.
 12 #server.basePath: ""
 13 
 14 # The maximum payload size in bytes for incoming server requests.
 15 #server.maxPayloadBytes: 1048576
 16 
 17 # The Kibana server's name.  This is used for display purposes.
 18 #server.name: "your-hostname"
 19 
 20 # The URL of the Elasticsearch instance to use for all your queries.
 21 elasticsearch.url: "http://192.168.100.129:9200"
 22 
 23 # When this setting's value is true Kibana uses the hostname specified in the server.host
 24 # setting. When the value of this setting is false, Kibana uses the hostname of the host
 25 # that connects to this Kibana instance.
 26 #elasticsearch.preserveHost: true
 27 
 28 # Kibana uses an index in Elasticsearch to store saved searches, visualizations and
 29 # dashboards. Kibana creates a new index if the index doesn't already exist.
 30 #kibana.index: ".kibana"
 31 
 32 # The default application to load.
 33 #kibana.defaultAppId: "discover"
 34 
 35 # If your Elasticsearch is protected with basic authentication, these settings provide
 36 # the username and password that the Kibana server uses to perform maintenance on the Kibana
 37 # index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
 38 # is proxied through the Kibana server.
 39 elasticsearch.username: "kibana"
 40 elasticsearch.password: "123456"
 41 
 42 # Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.
 43 # These settings enable SSL for outgoing requests from the Kibana server to the browser.
 44 #server.ssl.enabled: false
 45 #server.ssl.certificate: /path/to/your/server.crt
 46 #server.ssl.key: /path/to/your/server.key
 47 
 48 # Optional settings that provide the paths to the PEM-format SSL certificate and key files.
 49 # These files validate that your Elasticsearch backend uses the same key files.
 50 #elasticsearch.ssl.certificate: /path/to/your/client.crt
 51 #elasticsearch.ssl.key: /path/to/your/client.key
 52 
 53 # Optional setting that enables you to specify a path to the PEM file for the certificate
 54 # authority for your Elasticsearch instance.
 55 #elasticsearch.ssl.certificateAuthorities: [ "/path/to/your/CA.pem" ]
 56 
 57 # To disregard the validity of SSL certificates, change this setting's value to 'none'.
 58 #elasticsearch.ssl.verificationMode: full
 59 
 60 # Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of
 61 # the elasticsearch.requestTimeout setting.
 62 #elasticsearch.pingTimeout: 1500
 63 
 64 # Time in milliseconds to wait for responses from the back end or Elasticsearch. This value
 65 # must be a positive integer.
 66 #elasticsearch.requestTimeout: 30000
 67 
 68 # List of Kibana client-side headers to send to Elasticsearch. To send *no* client-side
 69 # headers, set this value to [] (an empty list).
 70 #elasticsearch.requestHeadersWhitelist: [ authorization ]
 71 
 72 # Header names and values that are sent to Elasticsearch. Any custom headers cannot be overwritten
 73 # by client-side headers, regardless of the elasticsearch.requestHeadersWhitelist configuration.
 74 #elasticsearch.customHeaders: {}
 75 
 76 # Time in milliseconds for Elasticsearch to wait for responses from shards. Set to 0 to disable.
 77 #elasticsearch.shardTimeout: 0
 78 
 79 # Time in milliseconds to wait for Elasticsearch at Kibana startup before retrying.
 80 #elasticsearch.startupTimeout: 5000
 81 
 82 # Specifies the path where Kibana creates the process ID file.
 83 #pid.file: /var/run/kibana.pid
 84 
 85 # Enables you specify a file where Kibana stores log output.
 86 #logging.dest: stdout
 87 
 88 # Set the value of this setting to true to suppress all logging output.
 89 #logging.silent: false
 90 
 91 # Set the value of this setting to true to suppress all logging output other than error messages.
 92 #logging.quiet: false
 93 
 94 # Set the value of this setting to true to log all events, including system usage information
 95 # and all requests.
 96 #logging.verbose: false
 97 
 98 # Set the interval in milliseconds to sample system and process performance
 99 # metrics. Minimum is 100ms. Defaults to 5000.
100 #ops.interval: 5000
101 
102 # The default locale. This locale can be used in certain circumstances to substitute any missing
103 # translations.
104 #i18n.defaultLocale: "en"
kibana.yml

elasticserch 由java编写运行时需要安装JDK

kibana 由nodejs编写

安装时应注意elasticsearch版本要高于kibana版本安装完成后修改配置文件即可使用

安全组件x-pack安装 https://www.elastic.co/guide/en/x-pack/current/installing-xpack.html#xpack-installing-offline

 重点详细说一下logstash的安装及配置

相关推荐