[Centos] ELK 설치

# JDK 설치

# sudo yum install java-11-openjdk.x86_64 -y
/usr/lib/jvm/java-11-openjdk-11.0.14.1.1-1.el7_9.x86_64

# which java
/usr/bin/java

# readlink -f /usr/bin/java
/usr/lib/jvm/java-11-openjdk-11.0.14.1.1-1.el7_9.x86_64/bin/java

# sudo vi /etc/profile
export JAVA_HOME=/usr/lib/jvm/java-11-openjdk-11.0.14.1.1-1.el7_9.x86_64
export PATH=$PATH:JAVA_HOME/bin

# export JAVA_HOME 
$ export PATH 
$ . /etc/profile

# Elasticsearch 설치

# sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

# sudo vi /etc/yum.repos.d/elasticsearch.repo
[elasticsearch]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
autorefresh=1
type=rpm-md


# sudo yum install --enablerepo=elasticsearch elasticsearch -y

# sudo systemctl daemon-reload
# sudo systemctl enable elasticsearch
# sudo systemctl start elasticsearch

 

# Logstash 설치

# sudo vi /etc/yum.repos.d/logstash.repo

[logstash-7.x]
name=Elastic repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md



# sudo /usr/share/logstash/bin/system-install /etc/logstash/startup.options systemd

[에러발생시]
OpenJDK 64-Bit Server VM warning: INFO: os::commit_memory(0x00000000eaaa0000, 178978816, 0) failed; error='Not enough space' (errno=12)
$ sudo dd if=/dev/zero of=/swapfile bs=64M count=16 
$ sudo chmod 600 /swapfile
$ sudo mkswap /swapfile
$ sudo swapon /swapfile
$ sudo vi /etc/fstab
/swapfile swap swap defaults 0 0



# sudo yum install logstash -y
# sudo systemctl enable logstash
# sudo systemctl start logstash

 

# Kibana 설치

# sudo vi /etc/yum.repos.d/kibana.repo

[kibana-7.x]
name=Kibana repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md


# sudo yum install kibana -y
# sudo systemctl enable kibana
# sudo systemctl start kibana

# Filebeat 설치

# sudo curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.12.0-x86_64.rpm
# sudo rpm -vi filebeat-7.12.0-x86_64.rpm
# sudo systemctl enable filebeat
# sudo systemctl start filebeat

 

- 9200,9300 : elasticsearch 기본 포트
- 5601 : kibana 기본 포트