互联网亿级日志实时分析平台，一个码农半小时就可以搞定，只因ELK

$ sudo add-apt-repository ppa:openjdk-r/ppa

$ sudo apt-get update 
$ sudo apt-get install openjdk-8-jdk

$ java -version
openjdk version "1.8.0_45-internal"
OpenJDK Runtime Environment (build 1.8.0_45-internal-b14)
OpenJDK 64-Bit Server VM (build 25.45-b02, mixed mode)

$ cd /etc/yum.repos.d
$ sudo vi centos.repo

[base]
name=CentOS-$releasever - Base
mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=os&infra=$infra
#baseurl=http://mirror.centos.org/centos/$releasever/os/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7
#released updates 
[updates]
name=CentOS-$releasever - Updates
mirrorlist=http://mirrorlist.centos.org/?release=$releasever&arch=$basearch&repo=updates&infra=$infra
#baseurl=http://mirror.centos.org/centos/$releasever/updates/$basearch/
gpgcheck=1
gpgkey=<a href="../../../../../etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7"><code>file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7</code></a>

$ sudo yum install java-1.8.0-openjdk

$ java -version
openjdk version "1.8.0_65"
OpenJDK Runtime Environment (build 1.8.0_65-b17)
OpenJDK 64-Bit Server VM (build 25.65-b01, mixed mode)

$ tar xzvf elasticsearch-2.1.0.tar.gz

$ pwd
/home/elk/elasticsearch-2.1.0
$ ls
bin config lib LICENSE.txt NOTICE.txt README.textile

$ cd config
$ vi elasticsearch.yml

network.host: localhost

$ cd ../bin
$ ./elasticsearch

$ curl 'localhost:9200/'
{
 "name" : "Surge",
 "cluster_name" : "elasticsearch",
 "version" : {
 "number" : "2.1.0",
 "build_hash" : "72cd1f1a3eee09505e036106146dc1949dc5dc87",
 "build_timestamp" : "2015-11-18T22:40:03Z",
 "build_snapshot" : false,
 "lucene_version" : "5.3.1"
 },
 "tagline" : "You Know, for Search"
}

$ tar xzvf kibana-4.3.0-linux-x64.tar.gz

$ pwd
/home/elk/kibana-4.3.0-linux-x64
$ ls
bin config installedPlugins LICENSE.txt node node_modules optimize 
                               package.json README.txt src webpackShims

$ cd config
$ vi kibana.yml

server.host:“localhost”

$ cd ../bin
$ ./kibana
[…]
 log [07:50:29.926] [info][listening] Server running at http://localhost:5601
[…]

$ curl localhost:5601
<script>var hashRoute = '/app/kibana';
var defaultRoute = '/app/kibana';
 
var hash = window.location.hash;
if (hash.length) {
 window.location = hashRoute + hash;
} else {
 window.location = defaultRoute;
}</script>

$ sudo apt-get install nginx apache2-utils

$ sudo vi /etc/nginx/sites-available/default

server {
 listen 80;
 server_name example.com;
 location / {
 proxy_pass http://localhost:5601;
 proxy_http_version 1.1;
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection 'upgrade';
 proxy_set_header Host $host;
 proxy_cache_bypass $http_upgrade; 
 ｝
 }

$ sudo service nginx restart

$ sudo vi /etc/yum.repos.d/nginx.repo
[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/7/$basearch/
gpgcheck=0
enabled=1

$ sudo yum install nginx httpd-tools

$ sudo vi /etc/nginx/nginx.conf

include /etc/nginx/conf.d/*conf

$ sudo vi /etc/nginx/conf.d/kibana.conf

server {
 listen 80;
 
 server_name example.com;
 
 location / {
 proxy_pass http://localhost:5601;
 proxy_http_version 1.1;
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection 'upgrade';
 proxy_set_header Host $host;
 proxy_cache_bypass $http_upgrade; 
 }
｝

$ sudo systemctl enable nginx
$ sudo systemctl start nginx

$ wget https://download.elastic.co/logstash/logstash/logstash-2.1.1.tar.gz

$ tar xzvf logstash-2.1.1.tar.gz

$ pwd
/home/elk/logstash-2.1.1
 
$ ls
bin CHANGELOG.md CONTRIBUTORS Gemfile Gemfile.jruby-1.9.lock lib LICENSE NOTICE.TXT vendor

$ cd bin
$ ./logstash -e 'input { stdin { } } output { stdout {} }'
Settings: Default filter workers: 1
Logstash startup completed

hello elk stack
2015-12-14T01:17:24.104Z 0.0.0.0 hello elk stack

# The # character at the beginning of a line indicates a comment. Use
# comments to describe your configuration.
input {
}
# The filter part of this file is commented out to indicate that it is
# optional.
#filter {
#}
output {
}

$ sudo mkdir -p /etc/pki/tls/certs etc/pki/tls/private
$ sudo vi /etc/ssl/openssl.cnf

subjectAltName = IP: logstash_server_ip

$ cd /etc/pki/tls
$ sudo openssl req -config /etc/ssl/openssl.cnf -x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout 
         private/logstash-forwarder.key -out certs/logstash-forwarder.crt

$ cd /home/elk/logstash-2.1.1
$ mkdir conf
$ vi simple.conf

input {
 lumberjack {
 port => 5043
 type => "logs"
 ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
 ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
 }
}
filter {
 grok {
 match => { "message" => "%{COMBINEDAPACHELOG}" }
 }
 date {
 match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
 }
}
output {
 elasticsearch { hosts => ["localhost:9200"] }
 stdout { codec => rubydebug }
}

$ cd /home/elk/logstash-2.1.1/bin
$ ./logstash -f ../conf/simple.conf

$ sudo vi /etc/pki/tls/openssl.cnf

subjectAltName = IP: logstash_server_ip
 
$ cd /etc/pki/tls
$ sudo openssl req -config /etc/pki/tls/openssl.cnf -x509 -days 3650 -batch -nodes -newkey 
         rsa:2048 -keyout private/logstash-forwarder.key -out certs/logstash-forwarder.crt

$ echo 'deb http://packages.elastic.co/logstashforwarder/debian 
                  stable main' | sudo tee /etc/apt/sources.list.d/logstashforwarder.list

$ sudo apt-get update
$ sudo apt-get install Logstash-forwarder

$ sudo mkdir -p /etc/pki/tls/certs

$ sudo scp user@logstash_server:/etc/pki/tls/certs/logstash_forwarder.crt /etc/pki/tls/certs/

$ sudo vi /etc/logstash-forwarder.conf

"servers": [ "logstash_server_private_address:5043" ],
"ssl ca": "/etc/pki/tls/certs/logstash-forwarder.crt",
"timeout": 15

{
"paths": [
 "/var/log/syslog",
 "/var/log/auth.log"
 ],
 "fields": { "type": "syslog" }
}

$ sudo service logstash-forwarder start

$ sudo service logstash-forwarder status
logstash-forwarder is running

$ sudo rpm --import http://packages.elastic.co/GPG-KEY-elasticsearch
 
$ sudo vi /etc/yum.repos.d/logstash-forwarder.repo

[logstash-forwarder]
name=logstash-forwarder repository
baseurl=http://packages.elastic.co/logstashforwarder/centos
gpgcheck=1
gpgkey=http://packages.elasticsearch.org/GPG-KEY-elasticsearch
enabled=1

$ sudo yum -y install logstash-forwarder