安裝EPEL

sudo yum -y install epel-release

安裝Redis

sudo yum -y install redis

設(shè)置開機自啟動然后啟動：

sudo systemctl daemon-reload
sudo systemctl enable redis.service
sudo systemctl start redis.service

安裝ELK

只安裝ELK：Elasticsearch、Logstash、Kibana，Elastic Stack的其他組件沒裝。

sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

新增文件/etc/yum.repos.d/elasticsearch.repo：

[elasticsearch-5.x]
name=Elasticsearch repository for 5.x packages
baseurl=https://mirrors.tuna.tsinghua.edu.cn/elasticstack/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

用的是清華的源。

安裝：

sudo yum -y install elasticsearch kibana logstash

Systemd開啟開機自啟動：

sudo systemctl daemon-reload
sudo systemctl enable elasticsearch.service
sudo systemctl enable kibana.service

啟動：

sudo systemctl start elasticsearch.service
sudo systemctl start kibana.service
sudo systemctl start logstash.service

驗證一下Elasticsearch：

curl http://localhost:9200
{
  "name" : "Nv3NQKr",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "Rx24DAWoS_ySLqeDCPNm0g",
  "version" : {
    "number" : "5.1.1",
    "build_hash" : "5395e21",
    "build_date" : "2016-12-06T12:36:15.409Z",
    "build_snapshot" : false,
    "lucene_version" : "6.3.0"
  },
  "tagline" : "You Know, for Search"
}

Elasticsearch和Kibana基本是開箱即用，默認配置就能跑起來。

配置LogStash

增加配置文件/etc/logstash/conf.d/logstash_indexer.conf:

input {
  redis {
    key => "logstash:phplogs"
    data_type => ["list"]
  }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]
  }
}

意思是從本機redis的logstash:phplogs里列表里讀數(shù)據(jù)，寫入本機的Elasticsearch。改完配置重新啟動LogStash

Laravel寫日志

寫日志方法多樣，我這里把日志寫到Redis，讓LogStash收集。

Laravel文檔說在bootstrap/app.php配置Monolog，但是這個時候各種Service都沒起來，難道要自己在這里連Redis？所以我用一個Service Provider配置Monolog：

<?php

namespace App\Providers;

use Illuminate\Support\ServiceProvider;
use Log;
use Monolog\Logger;
use Monolog\Handler\RedisHandler;
use Monolog\Formatter\LogstashFormatter;
use Redis;
use Config;

class LogServiceProvider extends ServiceProvider
{
    public function boot()
    {
        $monolog      = Log::getMonolog();
        $formatter    = new LogstashFormatter(Config::get('app.name'));
        $redisHandler = new RedisHandler(Redis::connection('log'), 'logstash:phplogs');
        $redisHandler->setFormatter($formatter);
        $monolog->pushHandler($redisHandler);
    }

    public function register()
    {
        //
    }
}

Kibana

有日志寫入后，就可在Kibana看到：

Kibana

參考

1. Elasticsearch、Logstash、Kibana搭建統(tǒng)一日志分析平臺
   內(nèi)容有點舊。用兩個服務(wù)器部署，其中一臺有完整的ELK，另一臺有LogStash收集日志，流程是LogStash收集日志文件 -> Redis -> LogStash -> ElasticSearch。
2. How to use Logstash with Monolog
   參考了Redis和Monolog配置。