在M1芯片 MacBook pro 安装ELK

摘要：安装适合 M1 芯片的 elasticsearch、kibana、logstash，优化内存占用并设定访问密码。

安装 elasticsearch

使用 brew 安装适用 M1 芯片的 elasticsearch

Copy
# brew tap elastic/tap

brew install elastic/tap/elasticsearch-full

安装成功后显示使用帮助：

Copy
# 安装日志
==> Installing elasticsearch-full from elastic/tap
Warning: Tried to install empty array to /opt/homebrew/etc/elasticsearch/jvm.options.d
==> codesign -f -s - /opt/homebrew/Cellar/elasticsearch-full/7.17.1/libexec/modules/x-pack
==> find /opt/homebrew/Cellar/elasticsearch-full/7.17.1/libexec/jdk.app/Contents/Home/bin
==> Caveats

# 相关安装文件位置
Data: /opt/homebrew/var/lib/elasticsearch/elasticsearch_zhangminglei/
Logs: /opt/homebrew/var/log/elasticsearch/elasticsearch_zhangminglei.log
Plugins: /opt/homebrew/var/elasticsearch/plugins/
Config: /opt/homebrew/etc/elasticsearch/

# 后台运行，并开机自动启动
brew services start elastic/tap/elasticsearch-full

# 在当前命令行运行，终端关闭后服务关闭
elasticsearch

启动后台服务：

Copy
brew services start elastic/tap/elasticsearch-full

运行后验证，使用浏览器访问：http://localhost:9200/ ，出现以下响应内容：

Copy
// 20220315232052
// http://localhost:9200/

{
"name": "LegalgesMacBook.lan",
"cluster_name": "elasticsearch_zhangminglei",
"cluster_uuid": "fB4xhSO1TrO0yh1I4h7qaw",
"version": {
"number": "7.17.1",
"build_flavor": "default",
"build_type": "tar",
"build_hash": "e5acb99f822233d62d6444ce45a4543dc1c8059a",
"build_date": "2022-02-23T22:20:54.153567231Z",
"build_snapshot": false,
"lucene_version": "8.11.1",
"minimum_wire_compatibility_version": "6.8.0",
"minimum_index_compatibility_version": "6.0.0-beta1"
},
"tagline": "You Know, for Search"
}

安装 kibana

使用 brew 安装适用 M1 芯片的 kibana

Copy
# brew tap elastic/tap

brew install elastic/tap/kibana-full

安装成功后提示：

Copy
# 安装过程日志
==> Installing kibana-full from elastic/tap
==> Caveats
Config: /opt/homebrew/etc/kibana/
If you wish to preserve your plugins upon upgrade, make a copy of
/opt/homebrew/opt/kibana-full/plugins before upgrading, and copy it into the
new keg location after upgrading.

# 后台运行，并开机自动启动
To start elastic/tap/kibana-full now and restart at login:
brew services start elastic/tap/kibana-full

# 在当前命令行运行，终端关闭后服务关闭
Or, if you don't want/need a background service you can just run:
kibana

# 安装结果摘要
==> Summary
🍺 /opt/homebrew/Cellar/kibana-full/7.17.1: 51,438 files, 720MB, built in 30 seconds
==> Running `brew cleanup kibana-full`...
Disable this behaviour by setting HOMEBREW_NO_INSTALL_CLEANUP.
Hide these hints with HOMEBREW_NO_ENV_HINTS (see `man brew`).

启动后台服务：

Copy
brew services start elastic/tap/kibana-full

浏览器访问 http://localhost:5601/ ，查看运行界面情况，将系统界面修改为中文：

Copy
# 切换到配置文件目录
cd /opt/homebrew/etc/kibana/

# 编辑配置文件
nano kibana.yml

# 将最后一行修改为：
i18n.locale: "zh-CN"

重启 brew 服务：

Copy
brew services restart elastic/tap/kibana-full

调整系统内存占用

ES 服务默认会占用系统一半以上的内存，可以通过修改配置文件，进行限制：

所需修改文件在服务配置路径当中：/opt/homebrew/etc/elasticsearch/

所需修改文件：jvm.options

修改前：

Copy
## jvm.options.d directory containing these lines:
##
## -Xms4g
## -Xmx4g
##

修改后：

Copy
## jvm.options.d directory containing these lines:
##
-Xms4g
-Xmx4g
##

重启 ES 服务，即可在系统的【活动监视器】看到 java 内存占用已经受限:

Copy
brew services restart elastic/tap/elasticsearch-full

设置密码保护

注：可参考官方文档：https://www.elastic.co/guide/en/elasticsearch/reference/7.17/security-minimal-setup.html

step1：关闭运行中的 elasticsearch、kibana 2 项服务

step2：修改 elasticsearch.yml 文件，启用密码保护，设置为单节点

Copy
# 进入配置文件夹
/opt/homebrew/etc/elasticsearch/

# 编辑配置文件
elasticsearch.yml

# 文件末尾追加以下2行内容：
xpack.security.enabled: true
discovery.type: single-node

step3: 利用 elasticsearch 内置工具自动生成账号、密码

Copy
#1 启动 elasticsearch 服务：
brew services start elastic/tap/elasticsearch-full

#2 进入es可执行文件目录：
/opt/homebrew/Cellar/elasticsearch-full/7.17.1/bin

#3 在以上目录打开终端，执行自动生成密码命令：
./elasticsearch-setup-passwords auto

#4 记录下控制台输出的账号密码内容，后面会用到
生成的账号密码示例：
Changed password for user kibana_system
PASSWORD kibana_system = n9zXw2UnJwvWdrJ4ZPcg

Changed password for user elastic
PASSWORD elastic = Lhder7yQVB8z3rzdFoKY

step4: 将以上自动生成的账号密码配置到 Kibana ，使其可以访问 es

Copy
#1 进入 Kibana 配置文件目录：
/opt/homebrew/etc/kibana/

#2 修改 Kibana 配置文件，追加内容:
elasticsearch.username: "kibana_system"

#3 进入 Kibana 可执行文件目录：
/opt/homebrew/Cellar/kibana-full/7.17.1/bin

#4 在以上目录打开终端，依次执行：
./kibana-keystore create
./kibana-keystore add elasticsearch.password
输入以上生成的 kibana_system 密码

#5 重启 Kibana 服务：
brew services start elastic/tap/kibana-full

step5: 使用以上自动生成的 elastic 账号密码登录 kibana

Copy
地址： http://localhost:5601/
账号： elastic
密码： Lhder8yQVB8z3rzdFoKY

*可在 kibana 当中修改密码

安装 logstash

使用 brew 安装适用 M1 芯片的 logstash:

Copy
# brew tap elastic/tap

brew install elastic/tap/logstash-full

安装成功日志：

Copy
Please read the getting started guide located at:
https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html

To start elastic/tap/logstash-full now and restart at login:
brew services start elastic/tap/logstash-full
Or, if you don't want/need a background service you can just run:
logstash
==> Summary
🍺 /opt/homebrew/Cellar/logstash-full/7.17.1: 14,003 files, 604.8MB, built in 13 seconds
==> Running `brew cleanup logstash-full`...
Disable this behaviour by setting HOMEBREW_NO_INSTALL_CLEANUP.

在 logstash.yml 中配置用户名和密码:

路径：/opt/homebrew/etc/logstash

Copy
xpack.monitoring.enabled: true

xpack.monitoring.elasticsearch.username: logstash_system

xpack.monitoring.elasticsearch.password: *****

xpack.monitoring.elasticsearch.hosts: ["http://127.0.0.1:9200"]

启动服务：

Copy
brew services start elastic/tap/logstash-full

验证安装成功：

Copy
# 进入logstash目录
cd /opt/homebrew/Cellar/logstash-full/7.17.1/bin

# 执行如下命令,等待输入光标出现
bin/logstash -e 'input { stdin { } } output { stdout { } }'

# 输入hello后系统的反馈：
{
"@version" => "1",
"message" => "hello",
"@timestamp" => 2022-05-29T06:28:37.021Z,
"host" => "izwz9cte3psk7ixd8kospzz"
}

创建并使用管道配置文件：
一个 Logstash 管理通常有一个或多个 input, filter 和 output 插件，例如：

Copy
//hello.conf

input { stdin { } }
output {
elasticsearch {
hosts => "http://127.0.0.1:9200"
index => "logs"
user => "elastic"
password => "************"
}
stdout {}
}

使用管道：

Copy
# 执行
logstash -f hello.conf

# 输入：
hello world

# 反馈：
{
"host" => "Legalgeeks-MacBook.local",
"@timestamp" => 2022-03-20T05:50:48.988Z,
"@version" => "1",
"message" => "hello world"
}