【Elastic Stack】 搭建最新 ELK 日志分析系统 8.2.2版

cat >> /etc/security/limits.conf << EOF
hard nofile 65535
soft nofile 65535
EOF

cat >> /etc/sysctl.conf << EOF
vm.max_map_count=262144
EOF
sysctl -p

$ yum install --enablerepo=elasticsearch elasticsearch -y
...
...
--------------------------- Security autoconfiguration information ------------------------------

Authentication and authorization are enabled.
TLS for the transport and HTTP layers is enabled and configured.

#弹性内置超级用户生成的密码为：se_pNHcZwLawBfF7pxUs
The generated password for the elastic built-in superuser is : se_pNHcZwLawBfF7pxUs

#如果此节点应加入现有群集，则可以使用下列命令
If this node should join an existing cluster, you can reconfigure this with
'/usr/share/elasticsearch/bin/elasticsearch-reconfigure-node --enrollment-token <token-here>'
after creating an enrollment token on your existing cluster.

You can complete the following actions at any time:

#重置弹性内置超级用户的密码
Reset the password of the elastic built-in superuser with
'/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic'.

#使用为Kibana实例生成注册令牌
Generate an enrollment token for Kibana instances with
 '/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana'.

#使用为Elasticsearch节点生成注册令牌
Generate an enrollment token for Elasticsearch nodes with
'/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node'.

-------------------------------------------------------------------------------------------------
### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using systemd
#自启动命令
 sudo systemctl daemon-reload
 sudo systemctl enable elasticsearch.service
### You can start elasticsearch service by executing
#启动命令
 sudo systemctl start elasticsearch.service

sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
sudo systemctl start elasticsearch.service

$ curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200
Enter host password for user 'elastic':
{
  "name" : "node1",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "xuxHYu-0SN-PFcghs8V0ow",
  "version" : {
    "number" : "8.2.2",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "9876968ef3c745186b94fdabd4483e01499224ef",
    "build_date" : "2022-05-25T15:47:06.259735307Z",
    "build_snapshot" : false,
    "lucene_version" : "9.1.0",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}

$ /usr/share/kibana/bin/kibana-verification-code
Your verification code is:  409 686

[root@node1 ~]# /usr/share/logstash/bin/logstash -e 'input { stdin { } } output { stdout {} }'
Using bundled JDK: /usr/share/logstash/jdk
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[INFO ] 2022-05-30 10:19:11.092 [main] runner - Starting Logstash {"logstash.version"=>"8.2.2", "jruby.version"=>"jruby 9.2.20.1 (2.5.8) 2021-11-30 2a2962fbd1 OpenJDK 64-Bit Server VM 11.0.14.1+1 on 11.0.14.1+1 +indy +jit [linux-x86_64]"}
[INFO ] 2022-05-30 10:19:11.110 [main] runner - JVM bootstrap flags: [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -Djruby.jit.threshold=0, -XX:+HeapDumpOnOutOfMemoryError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAMED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED]
[WARN ] 2022-05-30 10:19:12.090 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2022-05-30 10:19:15.968 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[INFO ] 2022-05-30 10:19:17.783 [Converge PipelineAction::Create<main>] Reflections - Reflections took 272 ms to scan 1 urls, producing 120 keys and 395 values
[INFO ] 2022-05-30 10:19:19.375 [Converge PipelineAction::Create<main>] javapipeline - Pipeline `main` is configured with `pipeline.ecs_compatibility: v8` setting. All plugins in this pipeline will default to `ecs_compatibility => v8` unless explicitly configured otherwise.
[INFO ] 2022-05-30 10:19:19.723 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["config string"], :thread=>"#<Thread:0x7c068ea7 run>"}
[INFO ] 2022-05-30 10:19:21.346 [[main]-pipeline-manager] javapipeline - Pipeline Java execution initialization time {"seconds"=>1.61}
[INFO ] 2022-05-30 10:19:21.520 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}

# stdin 插件出现等待输入提示，请输入hello world
The stdin plugin is now waiting for input:

hello world
{
      "@version" => "1",
         "event" => {
        "original" => "hello world"
    },
       "message" => "hello world",
    "@timestamp" => 2022-05-30T02:27:01.888886Z,
          "host" => {
        "hostname" => "node1"
    }
}