2025年4月3日 | 版本 8.12
Elastic Stack (原 ELK Stack) 是一套开源的数据分析工具集合，包括 Elasticsearch、Kibana、Logstash 和 Beats。本指南将详细介绍如何安装和配置这些组件。
分布式搜索和分析引擎，用于存储、搜索和分析大量数据。
数据可视化平台，用于探索和可视化 Elasticsearch 中的数据。
服务器端数据处理管道，用于从多个来源采集数据并转换后发送到 Elasticsearch。
轻量级数据采集器，用于将各种类型的数据发送到 Elasticsearch 或 Logstash。
注意: 生产环境建议使用专用服务器或云实例，不要与其他资源密集型应用共享资源。
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list
sudo apt update sudo apt install elasticsearch
sudo systemctl start elasticsearch sudo systemctl enable elasticsearch
brew tap elastic/tap brew install elastic/tap/elasticsearch-full
brew services start elastic/tap/elasticsearch-full
.\bin\elasticsearch.bat
打开浏览器访问 http://localhost:9200，应该能看到类似以下响应:
{
"name" : "your-hostname",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "xxxxxx",
"version" : {
"number" : "8.12.0",
"build_flavor" : "default",
"build_type" : "tar",
"build_hash" : "xxxxxx",
"build_date" : "2025-03-15T10:00:00.000Z",
"build_snapshot" : false,
"lucene_version" : "9.8.0",
"minimum_wire_compatibility_version" : "7.17.0",
"minimum_index_compatibility_version" : "7.0.0"
},
"tagline" : "You Know, for Search"
}
Elasticsearch 的主要配置文件位于:
/etc/elasticsearch/elasticsearch.yml/usr/local/etc/elasticsearch/elasticsearch.ymlconfig\elasticsearch.ymlcluster.name: my-elasticsearch-cluster
node.name: node-1
network.host: 0.0.0.0
警告: 生产环境中不要使用 0.0.0.0，应该配置具体的 IP 地址并设置防火墙规则。
http.port: 9200
discovery.seed_hosts: ["host1", "host2"] cluster.initial_master_nodes: ["node-1", "node-2"]
修改 jvm.options 文件:
-Xms4g -Xmx4g
Elasticsearch 8.x 默认启用安全功能，首次启动时会自动生成以下安全配置:
/etc/elasticsearch (Linux) 或安装目录的 config 文件夹中elastic, kibana_system, logstash_system 等)重置 elastic 用户密码:
bin/elasticsearch-reset-password -u elastic
生成新的 SSL 证书:
bin/elasticsearch-certutil cert -out config/elastic-certificates.p12 -pass ""
sudo apt install kibana
sudo systemctl start kibana sudo systemctl enable kibana
brew install elastic/tap/kibana-full
brew services start elastic/tap/kibana-full
.\bin\kibana.bat
打开浏览器访问 http://localhost:5601，应该能看到 Kibana 登录页面。
主要配置文件位于:
/etc/kibana/kibana.yml/usr/local/etc/kibana/kibana.ymlconfig\kibana.yml重要配置项:
server.port: 5601 server.host: "0.0.0.0" elasticsearch.hosts: ["http://localhost:9200"] elasticsearch.username: "kibana_system" elasticsearch.password: "your-kibana-system-password"
sudo apt install logstash
sudo systemctl start logstash sudo systemctl enable logstash
brew install elastic/tap/logstash-full
brew services start elastic/tap/logstash-full
.\bin\logstash.bat
创建一个简单的 Logstash 配置文件 logstash-simple.conf:
input {
stdin { }
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "logstash-%{+YYYY.MM.dd}"
user => "elastic"
password => "your-elastic-password"
}
stdout { codec => rubydebug }
}
使用配置文件运行 Logstash:
bin/logstash -f logstash-simple.conf
Beats 是轻量级数据采集器，有多种类型:
采集日志文件
采集系统和服务指标
网络流量分析
sudo apt install filebeat
编辑 /etc/filebeat/filebeat.yml:
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/*.log
output.elasticsearch:
hosts: ["localhost:9200"]
username: "elastic"
password: "your-elastic-password"
sudo systemctl start filebeat sudo systemctl enable filebeat
sudo apt install metricbeat
编辑 /etc/metricbeat/metricbeat.yml:
metricbeat.modules:
- module: system
metricsets:
- cpu
- memory
- network
- process
enabled: true
period: 10s
output.elasticsearch:
hosts: ["localhost:9200"]
username: "elastic"
password: "your-elastic-password"
sudo systemctl start metricbeat sudo systemctl enable metricbeat
journalctl -u elasticsearch --no-pager -n 50
java -version
sudo netstat -tulnp | grep 9200
curl -X GET "localhost:9200"
journalctl -u kibana --no-pager -n 50
bin/logstash -f your-config.conf --config.test_and_exit
bin/logstash -f your-config.conf --log.level debug