ELK 三部曲

更多关注：http://www.mknight.cn/

安装部署

YUM

---

rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

Installing from the RPM repository

Create a file called kibana.repo in the /etc/yum.repos.d/
directory for RedHat based distributions

[kibana-5.x]name=Kibana repository for 5.x 
packagesbaseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1  
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch  
enabled=1
autorefresh=1
type=rpm-md

And your repository is ready for use. You can now install Kibana with one of the following commands:

sudo yum install kibana 

RPM

---

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.0.2.rpm
wget https://artifacts.elastic.co/downloads/kibana/kibana-5.0.2-x86_64.rpm
wget https://artifacts.elastic.co/downloads/logstash/logstash-5.0.2.rpm

tar.gz

---

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.0.2.tar.gz
wget https://artifacts.elastic.co/downloads/kibana/kibana-5.0.2-linux-x86_64.tar.gz
wget https://artifacts.elastic.co/downloads/logstash/logstash-5.0.2.tar.gz

测试logstash

输入一段文字，然后检查输出

cd logstash-5.1.0
bin/logstash -e 'input { stdin { } } output { stdout {} }'

hello world
2013-11-21T01:22:14.405+0000 0.0.0.0 hello world

easy_install supervisor
echo_supervisord_conf > /etc/supervisord.conf

[program:logstash]
environment=LS_HEAP_SIZE=5000m
directory=/opt/elk/logstash
command=/opt/elk/logstash/bin/logstash -f /opt/elk/logstash/conf.d -l /opt/elk/logstash/logs

配置文件

output {
    elasticsearch {
        hosts => ["127.0.0.1:9200"]
        index => "logstash-nginx-access-%{+YYYY.MM.dd}"
        flush_size => 5000
        idle_flush_time => 10
        sniffing => true
    }
    stdout {codec => rubydebug}
}

批量发送。过去的版本中，主要由本插件的flush_size 和idle_flush_time 两个参数来控制发送数据的行为。以上面为例来说：logstash会攒到5000条数据一次性发送出去，但是如果10秒内没有攒够5000条，logstash 还是会以当前攒到的数量发送一次。
默认情况下，flush_size 是500条，idle_flush_time 是1秒。
5.0开始，有了一个前提：flush_size 的大小不能超过logstash运行时的命令行参数设置的batch_size,否则将以batch_size 为批量发送的大小。

[devlog@test config]$   curl 127.0.0.1:9200/_cat/nodes?v
ip        heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name
127.0.0.1           46          98   0    0.26    0.75     0.53 mdi       *      HsGQJQI

更多关注：http://www.mknight.cn/
---end