ELK企业级日志分析平台elasticsearch集群部署主机ip角色k8s1192.168.10.20cerebroserver1192.168.10.21elasticsearchserver2192.168.10.22elasticsearchserver3192.168.10.23elasticsearchserver4192.168.10.24logstashserver5192.168.10.25kibana配置解析[rootserver1 elasticsearch]# vim /etc/hosts127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4::1 localhost localhost.localdomain localhost6 localhost6.localdomain6192.168.10.21 server1192.168.10.22 server2192.168.10.23 server3192.168.10.24 server4192.168.10.25 server5192.168.10.26 server6软件安装[rootserver1 ~]# rpm -ivh elasticsearch-7.6.1-x86_64.rpm修改配置[rootserver1 ~]# cd /etc/elasticsearch/[rootserver1 elasticsearch]# vim elasticsearch.ymlcluster.name: my-espath.data: /var/lib/elasticsearchpath.logs: /var/log/elasticsearchbootstrap.memory_lock: truenetwork.host: 0.0.0.0http.port: 9200discovery.seed_hosts: [server1, server2, server3]cluster.initial_master_nodes: [server1, server2, server3]系统设置[rootserver1 ~]# vim /etc/security/limits.confelasticsearch soft memlock unlimitedelasticsearch hard memlock unlimitedelasticsearch - nofile 65535elasticsearch - nproc 4096[rootserver1 ~]# vim /usr/lib/systemd/system/elasticsearch.service[service]...LimitMEMLOCKinfinity[rootserver1 ~]# systemctl daemon-reload[rootserver1 ~]# swapoff -a[rootserver1 ~]# vim /etc/fstab#/dev/mapper/rhel-swap swap swap defaults 0 0[rootserver1 ~]# systemctl daemon-reload[rootserver1 ~]# systemctl enable --now elasticsearchserver1配置好后直接把配置复制到server2和server3配置ssh免密[rootserver1 elasticsearch]# ssh-keygen[rootserver1 elasticsearch]# ssh-copy-id server2[rootserver1 elasticsearch]# ssh-copy-id server3复制软件[rootserver1 ~]# scp elasticsearch-7.6.1-x86_64.rpm server2:[rootserver1 ~]# scp elasticsearch-7.6.1-x86_64.rpm server3:server2和server3软件安装[rootserver2 ~]# rpm -ivh elasticsearch-7.6.1-x86_64.rpm[rootserver3 ~]# rpm -ivh elasticsearch-7.6.1-x86_64.rpm从server1复制配置[rootserver1 ~]# cd /etc/elasticsearch/[rootserver1 elasticsearch]# scp elasticsearch.yml server2:/etc/elasticsearch/[rootserver1 elasticsearch]# scp elasticsearch.yml server3:/etc/elasticsearch/[rootserver1 elasticsearch]# scp /etc/security/limits.conf server2:/etc/security/[rootserver1 elasticsearch]# scp /etc/security/limits.conf server3:/etc/security/[rootserver1 elasticsearch]# scp /usr/lib/systemd/system/elasticsearch.service server2:/usr/lib/systemd/system/[rootserver1 elasticsearch]# scp /usr/lib/systemd/system/elasticsearch.service server3:/usr/lib/systemd/system/server2上启动服务[rootserver2 ~]# swapoff -a[rootserver2 ~]# vim /etc/fstab#/dev/mapper/rhel-swap swap swap defaults 0 0[rootserver2 ~]# systemctl daemon-reload[rootserver2 ~]# systemctl enable --now elasticsearchserver3上启动服务[rootserver3 ~]# swapoff -a[rootserver3 ~]# vim /etc/fstab#/dev/mapper/rhel-swap swap swap defaults 0 0[rootserver3 ~]# systemctl daemon-reload[rootserver3 ~]# systemctl enable --now elasticsearchcerebro部署cerebro官方https://github.com/lmenezes/cerebro/使用docker启动服务[rootk8s1 ~]# docker pull lmenezes/cerebro[rootk8s1 ~]# docker run -d --name cerebro -p 9000:9000 lmenezes/cerebro访问网页http://192.168.56.171:9000/节点地址可以填写任意ES集群节点ipelasticsearch集群角色分类[rootserver1 ~]# vim /etc/elasticsearch/elasticsearch.ymlnode.master: truenode.data: falsenode.ingest: truenode.ml: false[rootserver1 elasticsearch]# systemctl restart elasticsearch.service[rootserver2 ~]# vim /etc/elasticsearch/elasticsearch.ymlnode.master: truenode.data: truenode.ingest: falsenode.ml: false[rootserver2 ~]# systemctl restart elasticsearch.service[rootserver3 ~]# vim /etc/elasticsearch/elasticsearch.ymlnode.master: truenode.data: truenode.ingest: falsenode.ml: false[rootserver3 ~]# systemctl restart elasticsearch.service