ELK (elasticsearch + logstach + kibana) 설치

1. Java8 설치

java 설치 파일 다운로드

cd /opt

sudo wget --no-cookies --no-check-certificate --header "Cookie: gpw_e24=http%3A%2F%2Fwww.oracle.com%2F; oraclelicense=accept-securebackup-cookie" "http://download.oracle.com/otn-pub/java/jdk/8u121-b13/e9e7ea248e2c4826b92b3f075a80e441/jdk-8u121-linux-x64.tar.gz"

압축해제 및 심볼릭 링크

sudo tar -xvf jdk-8u121-linux-x64.tar.gz

압축푼 폴더의 권한 변경

sudo chown -R root: jdk1.8.0_121

/opt로부터 symbolic link 생성 (/usr/bin/java)

sudo alternatives --install /usr/bin/java java /opt/jdk1.8.0_121/bin/java 1

java version 선택

sudo update-alternatives --config java

$JAVA_HOME 추가file

sudo vi /etc/profile

export JAVA_HOME="/opt/jdk1.8.0_121"

source /etc/profile 

2. elasticsearch 설치

download and install the public signing key

sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

yum repo 등록

/etc/yum.repos.d/elasticsearch.repo

[elasticsearch-5.x]

name=Elasticsearch repository for 5.x packages

baseurl=https://artifacts.elastic.co/packages/5.x/yum

gpgcheck=1

gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch

enabled=1

autorefresh=1

type=rpm-md

elasticsearch install

sudo yum install elasticsearch

elasticsearch.yml 수정

sudo vim /etc/elasticsearch/elasticsearch.yml

cluster.name, node.name 수정

heap size 조정

/etc/elasticsearch/jvm.options

-Xmx512m

-Xms512m

참고 url : http://stackoverflow.com/a/40657077

서비스 등록, 시작

sudo chkconfig --add elasticsearch     # 서비스로 등록

sudo service elasticsearch start       # 서비스 시작

3. kibana 설치

download and install the public signing key

rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

yum repo 등록

[kibana-5.x]

name=Kibana repository for 5.x packages

baseurl=https://artifacts.elastic.co/packages/5.x/yum

gpgcheck=1

gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch

enabled=1

autorefresh=1

type=rpm-md

kibana install

sudo yum install kibana

kibana 설정 수정

/etc/kibana/kibana.yml 수정

host: “localhost"

elasticsearch.url “http://localhost:9200”

시작 & 서비스 등록

service kibana start

chkconfig kibana on 

4. nginx 설치

EPEL repository to yum:

yum -y install epel-release

Nginx and httpd-toos install:

yum -y install nginx httpd-tools

htpasswd to create admin user:

sudo htpasswd -c /etc/nginx/htpasswd.users kibanaadmin

vi /etc/nginx/nginx.conf 수정 (아래것만 남기고 모두 삭제)

include /etc/nginx/conf.d/*.conf;vim 

}

vi /etc/nginx/conf.d/kibana.conf (신규파일 생성)

server {

    listen *80;

    server_name localhost;

    auth_basic "Restricted Access";

    auth_basic_user_file /etc/nginx/htpasswd.users;

    location / {

        proxy_pass http://localhost:5601;

        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection 'upgrade';

        proxy_set_header Host $host;

        proxy_cache_bypass $http_upgrade;        

    }

}

시작 & 서비스 등록

service nginx start

chkconfig nginx on

5. logstash 설치

sudo vi /etc/yum.repos.d/logstash.repo 수정

[logstash-5.x]

name=Elastic repository for 5.x packages

baseurl=https://artifacts.elastic.co/packages/5.x/yum

gpgcheck=1

gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch

enabled=1

autorefresh=1

type=rpm-md

ssl key 생성

sudo vi /etc/pki/tls/openssl.cnf

subjectAltName = IP: ELK_server_private_ip

cd /etc/pki/tls

openssl req -config ./openssl.cnf -x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout test-ssl.key -out test-ssl.crt 

6. filebeat 설치

sudo rpm --import http://packages.elastic.co/GPG-KEY-elasticsearch

sudo vi /etc/yum.repos.d/elastic-beats.repo 수정

[elastic-5.x]

name=Elastic repository for 5.x packages

baseurl=https://artifacts.elastic.co/packages/5.x/yum

gpgcheck=1

gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch

enabled=1

autorefresh=1

type=rpm-md

sudo yum -y install filebeat

[참고문서]

https://www.elastic.co/guide/en/elasticsearch/reference/5.0/rpm.html#rpm-repo

https://www.elastic.co/guide/en/elasticsearch/reference/master/heap-size.html