# 下载Elasticsearch
# wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.17.10-linux-x86_64.tar.gz

# 解压安装包
# tar -xzvf elasticsearch-7.17.10-linux-x86_64.tar.gz
# mv elasticsearch-7.17.10 /opt/elasticsearch

# 创建用户
# useradd elasticsearch
# chown -R elasticsearch:elasticsearch /opt/elasticsearch

# 创建数据和日志目录
# mkdir -p /var/lib/elasticsearch /var/log/elasticsearch
# chown -R elasticsearch:elasticsearch /var/lib/elasticsearch /var/log/elasticsearch

# 下载Logstash
# wget https://artifacts.elastic.co/downloads/logstash/logstash-7.17.10-linux-x86_64.tar.gz

# 解压安装包
# tar -xzvf logstash-7.17.10-linux-x86_64.tar.gz
# mv logstash-7.17.10 /opt/logstash

# 创建数据和日志目录
# mkdir -p /var/lib/logstash /var/log/logstash
# chown -R elasticsearch:elasticsearch /var/lib/logstash /var/log/logstash

# 下载Kibana
# wget https://artifacts.elastic.co/downloads/kibana/kibana-7.17.10-linux-x86_64.tar.gz

# 解压安装包
# tar -xzvf kibana-7.17.10-linux-x86_64.tar.gz
# mv kibana-7.17.10-linux-x86_64 /opt/kibana

# 设置权限
# chown -R elasticsearch:elasticsearch /opt/kibana

# 编辑elasticsearch.yml配置文件
# vi /opt/elasticsearch/config/elasticsearch.yml

cluster.name: elk-cluster
node.name: node-1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
http.port: 9200
discovery.type: single-node

# 配置JVM参数
# vi /opt/elasticsearch/config/jvm.options
-Xms16g
-Xmx16g

# 编辑logstash.yml配置文件
# vi /opt/logstash/config/logstash.yml

path.data: /var/lib/logstash
path.logs: /var/log/logstash

# 配置JVM参数
# vi /opt/logstash/config/jvm.options
-Xms4g
-Xmx4g

# 编辑kibana.yml配置文件
# vi /opt/kibana/config/kibana.yml

server.port: 5601
server.host: “0.0.0.0”
elasticsearch.hosts: [“http://localhost:9200”]

# 启动Elasticsearch服务
# su – elasticsearch -c “/opt/elasticsearch/bin/elasticsearch -d”

# 启动Logstash服务
# su – elasticsearch -c “/opt/logstash/bin/logstash -d”

# 启动Kibana服务
# su – elasticsearch -c “/opt/kibana/bin/kibana –daemon”

# 设置开机自启
# vi /etc/systemd/system/elasticsearch.service
[Unit]
Description=Elasticsearch
After=network.target

[Service]
Type=simple
User=elasticsearch
ExecStart=/opt/elasticsearch/bin/elasticsearch
Restart=on-failure

[Install]
WantedBy=multi-user.target

# vi /etc/systemd/system/logstash.service
[Unit]
Description=Logstash
After=elasticsearch.service

[Service]
Type=simple
User=elasticsearch
ExecStart=/opt/logstash/bin/logstash
Restart=on-failure

[Install]
WantedBy=multi-user.target

# vi /etc/systemd/system/kibana.service
[Unit]
Description=Kibana
After=elasticsearch.service

[Service]
Type=simple
User=elasticsearch
ExecStart=/opt/kibana/bin/kibana
Restart=on-failure

[Install]
WantedBy=multi-user.target

# 启用服务
# systemctl daemon-reload
# systemctl enable elasticsearch logstash kibana
# systemctl start elasticsearch logstash kibana

# 检查Elasticsearch状态
# curl http://localhost:9200
{
“name” : “node-1”,
“cluster_name” : “elk-cluster”,
“cluster_uuid” : “abcdef123456”,
“version” : {
“number” : “7.17.10”,
“build_flavor” : “default”,
“build_type” : “tar”,
“build_hash” : “1234567”,
“build_date” : “2023-02-08T15:21:16.449963995Z”,
“build_snapshot” : false,
“lucene_version” : “8.11.1”,
“minimum_wire_compatibility_version” : “6.8.0”,
“minimum_index_compatibility_version” : “6.0.0-beta1”
},
“tagline” : “You Know, for Search”
}

# 检查Kibana状态
# curl http://localhost:5601

# 检查Logstash状态
# ps aux | grep logstash

# 测试ELK集成
# 创建Logstash配置文件
# vi /opt/logstash/config/test.conf

input {
stdin {}
}
output {
elasticsearch {
hosts => [“localhost:9200”]
index => “test-%{+YYYY.MM.dd}”
}
stdout { codec => rubydebug }
}

# 运行Logstash测试
# /opt/logstash/bin/logstash -f /opt/logstash/config/test.conf
# 输入测试数据，然后按Ctrl+D

# 创建备份目录
# mkdir -p /backup/elk
# chown -R elasticsearch:elasticsearch /backup/elk

# 备份Elasticsearch数据
# curl -X PUT “localhost:9200/_snapshot/my_backup” -H “Content-Type: application/json” -d ‘{
“type”: “fs”,
“settings”: {
“location”: “/backup/elk”
}
}’

# 创建快照
# curl -X PUT “localhost:9200/_snapshot/my_backup/snapshot_1”

# 备份配置文件
# cp -r /opt/elasticsearch/config /backup/elk/
# cp -r /opt/logstash/config /backup/elk/
# cp -r /opt/kibana/config /backup/elk/

# 配置自动备份
# 创建备份脚本
# vi /root/backup_elk.sh

#!/bin/bash

DATE=$(date +%Y%m%d)

# 创建Elasticsearch快照
curl -X PUT “localhost:9200/_snapshot/my_backup/snapshot_$DATE”

# 备份配置文件
cp -r /opt/elasticsearch/config /backup/elk/config_$DATE/
cp -r /opt/logstash/config /backup/elk/config_$DATE/
cp -r /opt/kibana/config /backup/elk/config_$DATE/

# 清理30天前的备份
find /backup/elk -name “snapshot_*” -mtime +30 -delete
find /backup/elk -name “config_*” -mtime +30 -delete

# 给脚本添加执行权限
# chmod +x /root/backup_elk.sh

# 添加到crontab
# crontab -e

# 添加以下内容（每天凌晨2点执行备份）
0 2 * * * /root/backup_elk.sh