cd /usr/local/src

yum -y install kibana-5.4.0-x86_64.rpm

grep "^[a-Z]" /etc/kibana/kibana.yml

server.port: 5601

server.host: "10.0.0.22"

elasticsearch.url: "http://10.0.0.22:9200"

systemctl enable kibana

systemctl start kibana

# 浏览器访问10.0.0.22:5601,通过http://10.0.0.22:5601/status来查看是否正常

vim /etc/logstash/conf.d/system.conf

input {

  file {

    path => "/var/log/messages"

    type => "systemlog"

    start_position => "beginning"

    stat_interval => "2"

  }

}

output {

  elasticsearch {

    hosts => ["10.0.0.22:9200"]

    index => "logstash-systemlog-%{+YYYY.MM.dd}"

  }

}

path => "/var/log/messages":要收集的文件路径

start_position => "beginning":从什么位置开始读取文件数据,默认是结束位置,会以类似 tail -F 的形式运行.

如果你是要导入原有数据,把这个设定改成"beginning",logstash 进程就从头开始读取,类似 less +F 的形式运行.

stat_interval => "2":每隔多久检查一次

/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/system.conf -t # 检测配置文件是否有语法错误

ll /var/log/messages  # logstash是普通用户,想要对系统日志有读权限,就得改文件权限

chmod 644 /var/log/messages

systemctl restart logstash

cat /etc/logstash/conf.d/colectTwo.conf

input {

  file {

        path => "/var/log/nginx/access.log"

        type => "nginx-access"

        start_position => "beginning"

        stat_interval => "2"

  }

  file {

        path => "/var/log/nginx/error.log"

        type => "nginx-error"

        start_position => "beginning"

        stat_interval => "2"

  }

  file {

        path => "/var/log/mysql.log"

        type => "mysql-log"

        start_position => "beginning"

        stat_interval => "2"

  }

}

output {

  if [type] == "nginx-access" {

  elasticsearch {

        hosts => ["10.0.0.22:9200"]

        index => "logstash-nginx-access-%{+YYYY.MM.dd}"

  }

}

  if [type] == "nginx-error" {

  elasticsearch {

        hosts => ["10.0.0.22:9200"]

        index => "logstash-nginx-error-%{+YYYY.MM.dd}"

  }

}

  if [type] == "mysql-log" {

  elasticsearch {

        hosts => ["10.0.0.22:9200"]

        index => "logstash-mysql-log-%{+YYYY.MM.dd}"

  }

}

}

配置文件检测语法是否正常:

/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/colectTwo.conf -t

systemctl restart logstash

echo qweqweqweasdqwedqwe > /var/log/mysql.log

chmod 666 /var/log/mysql.log

usermod -G adm logstash