Logstash+ElasticSearch+Kibana3架构日志系统操作手册

Logstash+ElasticSearch+Kibana3架构日志系统一，分析系统简介日志监控和分析在保障业务稳定运行时，起到了很重要的作用，不过一般情况下日志都分散在各个生产服务器，且开发人员无法登陆生产服务器，这时候就需要一个集中式的日志收集装置，对日志中的关键字进行监控，触发异常时进行报警，并且开发人员能够查看相关日志。logstash+elasticsearch+kibana3就是实现这样功能的一套系统，并且功能更强大。logstash是一个管理日志和事件的工具，你可以收集它们，解析它们，并存储它们以供以后使用(例如日志搜索)，logstash有一个内置的web界面，用来搜索你的所有日志。logstash在部署时有两种运行模式：standalone和centralized：*standalone：standalone的意思是所有的事情都在一台服务器上运行，包括日志收集、日志索引、前端WEB界面都部署在一台机器上。*centralized：就是多服务器模式，从很多服务器运输(ship)日志到一台总的日志(collector)服务器上用来索引和查找。需要注意的是logstash本身并没有什么shipper和collector这种说法，因为不论是运输日志的进程还是汇集总的日志的进程运行的都是同一个程序，只是使用的配置文件不同而已。elasticsearch:基于lucene的开源搜索引擎，是一个分布式的搜索分析系统，主要特点有：realtimedata、realtimeanalytics、distributed、highavailability、multi-tenancy、fulltextsearch、documentoriented、conflictmanagement、schemafree、restfulapi等等。kibana3:可视化日志和数据系统，作为WEB前端可以很容易的和elasticsearch系统结合。kibana有版本2和版本3的区分，版本2采用ruby编写，部署起来很麻烦，需要安装很多ruby依赖包(目前网上多是这个版本的部署)，版本3采用纯html+css编写，因此部署起来很方便，解压即用。二，测试步骤测试架构两台机器试验，CentOS6.540：logstashagent，redis，jdk35：logstashindex，elasticsearch，kibana，jdk其中redis上安装agent端，agent和index的logstash安装是一样的，唯一不同点是conf文件不同。2，redis和logstashagent安装（40）1），安装java环境/en/download/manual.jsprpm-ivhjdk-7u67-linux-x64.rpmPreparing...###########################################[100%]1:jdk###########################################[100%]UnpackingJARfiles... rt.jar... jsse.jar... charsets.jar... localedata.jar... jfxrt.jar...#java-versionjavaversion"1.7.0_67"Java(TM)SERuntimeEnvironment(build1.7.0_67-b01)JavaHotSpot(TM)64-BitServerVM(build24.65-b04,mixedmode)2），安装rediswgethttp://download.redis.io/releases/redis-2.8.17.tar.gztar-zxvfredis-2.8.17.tar.gzcd/redis-2.8.17.tar.gz先安装tcl,否则下面会报错yuminstalltcl-ymakeMALLOC=libcmaketestmakeinstall#pwd/soft/redis-2.8.17/utils./install_server.shWelcometotheredisserviceinstallerThisscriptwillhelpyoueasilysetuparunningredisserverPleaseselecttheredisportforthisinstance:[6379]Selectingdefault:6379Pleaseselecttheredisconfigfilename[/etc/redis/6379.conf]Selecteddefault-/etc/redis/6379.confPleaseselecttheredislogfilename[/var/log/redis_6379.log]Selecteddefault-/var/log/redis_6379.logPleaseselectthedatadirectoryforthisinstance[/var/lib/redis/6379]Selecteddefault-/var/lib/redis/6379Pleaseselecttheredisexecutablepath[/usr/local/bin/redis-server]Selectedconfig:Port:6379Configfile:/etc/redis/6379.confLogfile:/var/log/redis_6379.logDatadir:/var/lib/redis/6379Executable:/usr/local/bin/redis-serverCliExecutable:/usr/local/bin/redis-cliIsthisok?ThenpressENTERtogoonorCtrl-Ctoabort.Copied/tmp/6379.conf=>/etc/init.d/redis_6379Installingservice...Successfullyaddedtochkconfig!Successfullyaddedtorunlevels345!StartingRedisserver...Installationsuccessful!#pwd/soft/redis-2.8.17/src[root@logserversrc]#./redis-cli-h-p6379:6379>pingPONG:6379>setnamefooOK:6379>getname"foo":6379>bye(error)ERRunknowncommand'bye':6379>quit3），安装logstashagent#rpm-ivhlogstash-1.4.2-1_2c0f5a1.noarch.rpmPreparing...###########################################[100%]1:logstash###########################################[100%][root@logserversoft]#rpm-ivhlogstash-contrib-1.4.2-1_efd53ef.noarch.rpmPreparing...###########################################[100%]1:logstash-contrib###########################################[100%]修改配置文件cat/etc/logstash/conf.d/logstash.agent.confinput{file{path=>"/var/log/messages" type=>"syslog"}file{path=>"/var/log/httpd/access_log" type=>"apache"}}output{redis{host=>"40"data_type=>"list"key=>"logstash"}}启动logstashagentservicelogstashstartroot142030.732.61397132119108pts/0SNl14:231:02/usr/java/jdk1.7.0_67/bin/java-Djava.io.tmpdir=/var/lib/logstash-Xmx500m-XX:+UseParNewGC-XX:+UseConcMarkSweepGC-Djava.awt.headless=true-XX:CMSInitiatingOccupancyFraction=75-XX:+UseCMSInitiatingOccupancyOnly-jar/opt/logstash/vendor/jar/jruby-complete-1.7.11.jar-I/opt/logstash/lib/opt/logstash/lib/logstash/runner.rbagent-f/etc/logstash/conf.d-l/var/log/logstash/logstash.loglogstashindex安装（35）1），安装java环境/en/download/manual.jsprpm-ivhjdk-7u67-linux-x64.rpmPreparing...###########################################[100%]1:jdk###########################################[100%]UnpackingJARfiles... rt.jar... jsse.jar... charsets.jar... localedata.jar... jfxrt.jar...#java-versionjavaversion"1.7.0_67"Java(TM)SERuntimeEnvironment(build1.7.0_67-b01)JavaHotSpot(TM)64-BitServerVM(build24.65-b04,mixedmode)2），安装logstash#rpm-ivhlogstash-1.4.2-1_2c0f5a1.noarch.rpmPreparing...###########################################[100%]1:logstash###########################################[100%][root@logserversoft]#rpm-ivhlogstash-contrib-1.4.2-1_efd53ef.noarch.rpmPreparing...###########################################[100%]1:logstash-contrib###########################################[100%]修改配置文件cat/etc/logstash/conf.d/logstash.index.confinput{redis{host=>"40"data_type=>"list"port=>"6379"key=>"logstash"type=>"redis-input"}}output{elasticsearch{host=>"35"port=>"9300"}}启动logstashindexservicelogstashstartpsaux|greplogstashroot63651.138.51319172140912?SNl14:221:27/usr/bin/java-Djava.io.tmpdir=/var/lib/logstash-Xmx500m-XX:+UseParNewGC-XX:+UseConcMarkSweepGC-Djava.awt.headless=true-XX:CMSInitiatingOccupancyFraction=75-XX:+UseCMSInitiatingOccupancyOnly-jar/opt/logstash/vendor/jar/jruby-complete-1.7.11.jar-I/opt/logstash/lib/opt/logstash/lib/logstash/runner.rbagent-f/etc/logstash/conf.d-l/var/log/logstash/logstash.log3)，安装elasicsearchwget/elasticsearch/elasticsearch/elasticsearch-1.3.4.noarch.rpmrpm-ivhelasticsearch-1.3.4.noarch.rpmPreparing...###########################################[100%]1:elasticsearch#########################################