推荐十个国外网站企业信息免费查询系统
案例描述
本案例共讲述了多个节点部署Elk集群日志分析系统，分别在三个节点使用ansible部署Kibana、Logstash以及Elasticsearch服务。
案例准备
1. 规划节点
| IP | 主机名 | 节点 |
| 192.168.100.25 | ansible | Ansible节点 |
| 192.168.100.35 | node1 | Elasticsearch/Kibana |
| 192.168.100.45 | node2 | Elasticsearch/Logstash |
| 192.168.100.55 | node1 | Elasticsearch |
2. 基准准备
登录物理OpenStack平台，使用CentOS7.9镜像创建四台云主机，云主机类型使用1VCPU/2GB内存/20GB硬盘。
案例实施
1. ELK部署
1.1 配置主机映射
1.1 .1 修改主机名
[root@ansible ~]# systemctl set-hostnamectl ansible
[root@ansible ~]# bash
1.1.2 修改ansible主机映射
[root@ansible ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.100.25 ansible
192.168.100.35 node1
192.168.100.45 node2
192.168.100.55 node3
1.1.3 配置免密访问
虚拟机root用户密码为000000
[root@ansible ~]# ssh-keygen
[root@ansible ~]# ssh-copy-id node1
[root@ansible ~]# ssh-copy-id node2
[root@ansible ~]# ssh-copy-id node3
vi /etc/ssh/sshd_config
PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys
sudo systemctl restart sshd
1.1.4 复制ansible域名解析文件
将ansible节点的域名解析文件复制给安装Elasticsearch集群服务的三个节点
[root@ansible ~]# scp /etc/hosts node1:/etc/
[root@ansible ~]# scp /etc/hosts node2:/etc/
[root@ansible ~]# scp /etc/hosts node3:/etc/
1.1.5 关闭防火墙
[root@redis ~]# systemctl stop firewalld
[root@redis ~]# setenforce 0
1.2 软件包上传及Yum源配置
1.2.1 上传软件包
将提供的Elasticsearch、Kibana以及Logstash软件包上传至ansible节点/root目录下，并将相应服务的软件包拷贝至不同节点
[root@ansible ~]# ls
elasticsearch-6.0.0.rpm kibana-6.0.0-x86_64.rpm logstash-6.0.0.rpm
1.2.2 将软件包拷贝到三个节点
将Elasticsearch软件包拷贝至三个节点，将Kibana软件包拷贝至node1节点，将Logstash软件包拷贝至node2节点
[root@ansible ~]# scp elasticsearch-6.0.0.rpm node1:/root/
[root@ansible ~]# scp elasticsearch-6.0.0.rpm node2:/root/
[root@ansible ~]# scp elasticsearch-6.0.0.rpm node3:/root/
[root@ansible ~]# scp kibana-6.0.0-x86_64.rpm node1:/root/
[root@ansible ~]# scp logstash-6.0.0.rpm node2:/root/
1.2.3 配置本地Yum源
将软件包ansible.tar.gz上传至ansible节点配置本地Yum源，并安装ansible
[root@ansible ~]# ls
ansible.tar.gz elasticsearch-6.0.0.rpm kibana-6.0.0-x86_64.rpm logstash-6.0.0.rpm
[root@ansible ~]# tar -zxvf ansible.tar.gz -C /opt/
[root@ansible ~]# mv /etc/yum.repos.d/* /media/
[root@ansible ~]# vi /etc/yum.repos.d/local.repo
[root@ansible ~]# yum -y install ansible
1.3 配置ansible主机映射
1.3.1 创建示例目录，并配置ansible主机映射
[root@ansible ~]# mkdir example
[root@ansible ~]# cd example
[root@ansible example]# vi /etc/ansible/hosts
1.3.2 安装java
使用CentOS-7-x86_64-DVD-2009.iso镜像文件作为安装库，将镜像挂载至/opt/centos，编写Yum源文件，安装vsftpd服务，用于给远程主机安装Java
[root@redis example]# mkdir /opt/centos
[root@ansible example]# mount /root/CentOS-7-x86_64-DVD-2009.iso /opt/centos/
[root@ansible example]# vi /etc/yum.repos.d/local.repo
[root@ansible example]# yum install -y vsftpd
[root@ansible example]# vi /etc/vsftpd/vsftpd.conf
1.3.3 安装Elasticsearch服务并编写node1节点配置文件
[root@ansible example]# rpm -ivh /root/elasticsearch-6.0.0.rpm
[root@ansible example]# cp -rf /etc/elasticsearch/elasticsearch.yml elk1.yml
[root@ansible example]# cat elk1.yml | grep -Ev "^$|^#"
1.3.4 编写node2节点配置文件
[root@ansible example]# cp elk1.yml elk2.yml
[root@ansible example]# cat elk2.yml | grep -Ev "^$|^#"
1.3.5 编写node3节点配置文件
[root@ansible example]# cp elk1.yml elk3.yml
[root@ansible example]# cat elk3.yml | grep -Ev "^$|^#"
1.3.6 安装kibana获取配置文件
安装kibana服务并编写配置文件
[root@ansible example]# rpm -ivh /root/kibana-6.0.0-x86_64.rpm
[root@ansible example]# cp -rf /etc/kibana/kibana.yml .
[root@ansible example]# cat kibana.yml |grep -v ^#
1.3.7 安装logstash获取配置文件
安装logstash服务并获取配置文件
yum install java-1.8.0-openjdk-devel
[root@ansible example]# rpm -ivh /root/logstash-6.0.0.rpm
[root@ansible example]# cp -rf /etc/logstash/logstash.yml .
[root@ansible example]# vi logstash.yml
http.host: "192.168.100.45"
新建日志输出文件
[root@ansible example]# vi syslog.conf
1.3.8 编写剧本文件
编写Playbook剧本文件
[root@ansible example]# vi cscc_install.yaml
- hosts: all
remote_user: root
tasks:
- name: rm repo
shell: rm -rf /etc/yum.repos.d/*
- name: copy repo
copy: src=ftp.repo dest=/etc/yum.repos.d/
- name: install java
shell: yum -y install java-1.8.0-*
- name: install elk
shell: rpm -ivh elasticsearch-6.0.0.rpm
- hosts: node1
remote_user: root
tasks:
- name: copy config
copy: src=elk1.yml dest=/etc/elasticsearch/elasticsearch.yml
- name: daemon-reload
shell: systemctl daemon-reload
- name: start elk
shell: systemctl start elasticsearch && systemctl enable elasticsearch
- name: install kibana
shell: rpm -ivh kibana-6.0.0-x86_64.rpm
- name: copy config
template: src=kibana.yml dest=/etc/kibana/kibana.yml
- name: start kibana
shell: systemctl start kibana && systemctl enable kibana
- hosts: node2
remote_user: root
tasks:
- name: copy config
copy: src=elk2.yml dest=/etc/elasticsearch/elasticsearch.yml
- name: daemon-reload
shell: systemctl daemon-reload
- name: start elk
shell: systemctl start elasticsearch && systemctl enable elasticsearch
- name: install logstash
shell: rpm -ivh logstash-6.0.0.rpm
- name: copy config
copy: src=logstash.yml dest=/etc/logstash/logstash.yml
- name: copy config
copy: src=syslog.conf dest=/etc/logstash/conf.d/syslog.conf
- hosts: node3
remote_user: root
tasks:
- name: copy config
copy: src=elk3.yml dest=/etc/elasticsearch/elasticsearch.yml
- name: daemon-reload
shell: systemctl daemon-reload
- name: start elk
shell: systemctl start elasticsearch && systemctl enable elasticsearch
执行PlayBook完成ELK集群的部署
[root@ansible example]# ansible-playbook cscc_install.yaml
执行结果如下图
2. 浏览器访问
浏览器访问node1节点5601端口，http://192.168.100.35:5601/
