前言
本人新手，本文记录简单的ELKB单机部署，ELKB分别指elasticsearch、logstash、kibana、filebeat，用的当前官网最新版本7.2.0，日志用的Java-log4j产生的日志。
一、准备工作
需要下载的安装包，下载完后解压备用：
- elasticsearch-7.2.0-windows-x86_64
- kibana-7.2.0-windows-x86_64
- filebeat-7.2.0-windows-x86_64
- logstash-7.2.0
二、启动elasticsearch
- 修改config/elasticsearch.yml，改数据和日志的位置
path.data: E:/upload/elk/data
path.logs: E:/upload/elk/logs
- cmd中执行
.\bin\elasticsearch
- 浏览器输入http://localhost:9200验证，返回如下结果则为正确
{
"name" : "DESKTOP-RLMLLD1",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "Rv7GIwE5QDSkJJuCj_rHiw",
"version" : {
"number" : "7.2.0",
"build_flavor" : "default",
"build_type" : "zip",
"build_hash" : "508c38a",
"build_date" : "2019-06-20T15:54:18.811730Z",
"build_snapshot" : false,
"lucene_version" : "8.0.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
三、启动logstash
- cmd中执行
.\bin\logstash -f .\config\logstash-sample.conf
看打印的log中，success则为成功
四、启动kibana
- 修改config/kibana.yml，改本地IP和超时的时长
server.host: "0.0.0.0" (改为自己的IP，下同)
elasticsearch.requestTimeout: 90000
- cmd中执行
.\bin\kibana
浏览器中，输入http://0.0.0.0:5601，能访问则启动成功
五、启动filebeat
- 修改filebeat.yml配置
1、开启input
filebeat.inputs:
- type: log
paths:
- e:\upload\logs\*
2、关闭output.logstash（注释掉）
#output.elasticsearch:
#hosts: ["localhost:9200"]
3、开启output.logstash
output.logstash:
hosts: ["localhost:5044"]
- cmd中执行
.\filebeat -e -c filebeat.yml
六、log4j打印日志程序
- 配置引用最新的log4j包
<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<version>1.2.17</version>
</dependency>
- resources中配置log4j.properties
### 设置###
log4j.rootLogger = debug,stdout,D,E
### 输出信息到控制抬 ###
log4j.appender.stdout = org.apache.log4j.ConsoleAppender
log4j.appender.stdout.Target = System.out
log4j.appender.stdout.layout = org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern = [%-5p] %d{yyyy-MM-dd HH:mm:ss,SSS} method:%l%n%m%n
### 输出DEBUG 级别以上的日志到=/Users/bee/Documents/elk/log4j/debug.log###
log4j.appender.D = org.apache.log4j.DailyRollingFileAppender
log4j.appender.D.File = E:/upload/logs/debug.log
log4j.appender.D.Append = true
log4j.appender.D.Threshold = DEBUG
log4j.appender.D.layout = org.apache.log4j.PatternLayout
log4j.appender.D.layout.ConversionPattern = %-d{yyyy-MM-dd HH:mm:ss} [ %t:%r ] - [ %p ] %m%n
### 输出ERROR 级别以上的日志到=/Users/bee/Documents/elk/log4j/error.log ###
log4j.appender.E = org.apache.log4j.DailyRollingFileAppender
log4j.appender.E.File =E:/upload/logs/error.log
log4j.appender.E.Append = true
log4j.appender.E.Threshold = ERROR
log4j.appender.E.layout = org.apache.log4j.PatternLayout
log4j.appender.E.layout.ConversionPattern = %-d{yyyy-MM-dd HH:mm:ss} [ %t:%r ] - [ %p ] %m%n
- 编写并执行Java main函数
public class Main {
private static final Logger logger = Logger.getLogger(Main.class);
public static void main(String[] args) {
// 记录debug级别的信息
logger.debug("This is debug message.");
// 记录info级别的信息
logger.info("This is info message.");
// 记录error级别的信息
logger.error("This is error message.");
}
}
七、执行后看结果
