filebeat+elasticsearch+kibana搭建:

elastic官网:
https://www.elastic.co/downloads

filebeat:

Filebeat是一个日志文件托运工具,在你的服务器上安装客户端后,filebeat会监控日志目录或者指定的日志文件,追踪读取这些文件,并且转发这些信息到elasticsearch或者logstarsh中存放。

下载地址(注意和elasticsearch版本保持一致):

https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.6.7-x86_64.rpm

https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.6.7-amd64.deb

rpm -i filebeat-5.6.7-x86_64.rpm

vi /etc/filebeat/filebeat.yml (Elasticsearch output)

username: "elastic"
password: "changeme"
:wq

service filebeat restart

elasticsearch:

Elasticsearch是一个分布式搜索服务

下载网址:
https://www.elastic.co/downloads/past-releases/elasticsearch-5-6-7

yum install java-1.8.0-openjdk

rpm -i elasticsearch-5.6.7-x86_64.rpm

/usr/share/elasticsearch/bin/elasticsearch-plugin install x-pack

service elasticsearch start

chkconfig --level 35 elasticsearch on

curl http://localhost:9200

elastic账号的默认密码为changeme

导入filebeat模板:

curl -u elastic -XPUT 'http://localhost:9200/_template/filebeat?pretty' -d@/etc/filebeat/filebeat.template.json

查看所有index:

curl http://localhost:9200/_cat/indices?v

创建icinga2索引:

curl -XPUT http://localhost:9200/icinga2

删除icinga2索引:

curl -XDELETE http://localhost:9200/icinga2

kibana(kibana需和elasticsearch版本保持一致):

Kibana是一套分析与可视化平台,构建于Elasticsearch之上,旨在帮助用户更好地实现数据理解。

下载网址:
https://artifacts.elastic.co/downloads/kibana/kibana-5.6.7-x86_64.rpm

rpm -i kibana-5.6.7-x86_64.rpm

/usr/share/kibana/bin/kibana-plugin install x-pack

vi /etc/kibana/kibana.yml

server.port: 5601 (默认为注释掉的)

server.host: "10.0.0.2" (默认为注释掉的,并改为ip)

elasticsearch.url: "http://localhost:9200" (默认为注释掉的)

kibana.index: ".kibana" (默认为注释掉的)

:wq

service kibana restart

页面访问:http://10.0.0.2:5601 (用户名:elastic 密码:changeme)