自动配置ELK日志系统的脚本

wen 实用脚本 2026-07-10 1

本文目录导读：

自动配置ELK日志系统的脚本

使用说明
注意事项
扩展：发送测试日志

下面是一个自动配置ELK（Elasticsearch + Logstash + Kibana） 日志系统的 Shell 脚本示例，适用于 CentOS / Ubuntu 系统。
它会安装 Java、Elasticsearch、Logstash、Kibana,并做最基本的配置让它们能连通使用。

`deploy_elk.sh`

#!/bin/bash
# ELK 自动部署脚本（适用于 CentOS 7/8、Ubuntu 18/20）
# 使用前请确认系统版本，按提示执行
set -e
# ========== 配置变量（可按需修改） ==========
ELK_VERSION="7.17.9"                # ELK 版本号
ES_PORT="9200"
KIBANA_PORT="5601"
LS_PORT="5044"
ES_USER="elastic"
ES_PASS="changeme123"
# 颜色输出
GREEN='\033[0;32m'
NC='\033[0m'
# ========== 功能函数 ==========
info() {
    echo -e "${GREEN}[INFO] $1${NC}"
}
get_distro() {
    if [ -f /etc/redhat-release ]; then
        echo "centos"
    elif [ -f /etc/lsb-release ]; then
        echo "ubuntu"
    else
        echo "unknown"
    fi
}
# ========== 1. 安装 Java（ELK 依赖） ==========
install_java() {
    info "安装 Java (OpenJDK 11) ..."
    DISTRO=$(get_distro)
    if [ "$DISTRO" == "centos" ]; then
        yum install -y java-11-openjdk-devel
    elif [ "$DISTRO" == "ubuntu" ]; then
        apt update
        apt install -y openjdk-11-jdk
    fi
    java -version
}
# ========== 2. 安装 Elasticsearch ==========
install_elasticsearch() {
    info "安装 Elasticsearch $ELK_VERSION ..."
    DISTRO=$(get_distro)
    if [ "$DISTRO" == "centos" ]; then
        rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
        cat > /etc/yum.repos.d/elastic.repo <<EOF
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF
        yum install -y elasticsearch-$ELK_VERSION
    elif [ "$DISTRO" == "ubuntu" ]; then
        wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | apt-key add -
        apt install -y apt-transport-https
        echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" > /etc/apt/sources.list.d/elastic-7.x.list
        apt update
        apt install -y elasticsearch=$ELK_VERSION
    fi
    # 修改配置
    sed -i "s/#cluster.name: my-application/cluster.name: elk-cluster/" /etc/elasticsearch/elasticsearch.yml
    sed -i "s/#node.name: node-1/node.name: node-1/" /etc/elasticsearch/elasticsearch.yml
    sed -i "s/#network.host: 192.168.0.1/network.host: 127.0.0.1/" /etc/elasticsearch/elasticsearch.yml
    sed -i "s/#http.port: 9200/http.port: $ES_PORT/" /etc/elasticsearch/elasticsearch.yml
    # 安全配置（选填，关闭 xpack 以避免额外配置）
    echo "xpack.security.enabled: false" >> /etc/elasticsearch/elasticsearch.yml
    systemctl daemon-reload
    systemctl enable elasticsearch
    systemctl start elasticsearch
    # 等待启动
    sleep 15
    curl -X GET "localhost:$ES_PORT/"
    info "Elasticsearch 安装完成"
}
# ========== 3. 安装 Kibana ==========
install_kibana() {
    info "安装 Kibana $ELK_VERSION ..."
    DISTRO=$(get_distro)
    if [ "$DISTRO" == "centos" ]; then
        yum install -y kibana-$ELK_VERSION
    elif [ "$DISTRO" == "ubuntu" ]; then
        apt install -y kibana=$ELK_VERSION
    fi
    # 修改配置
    sed -i "s/#server.port: 5601/server.port: $KIBANA_PORT/" /etc/kibana/kibana.yml
    sed -i "s/#server.host: \"localhost\"/server.host: \"0.0.0.0\"/" /etc/kibana/kibana.yml
    sed -i "s/#elasticsearch.hosts: \[\"http:\/\/localhost:9200\"\]/elasticsearch.hosts: [\"http:\/\/localhost:$ES_PORT\"]/" /etc/kibana/kibana.yml
    systemctl daemon-reload
    systemctl enable kibana
    systemctl start kibana
    info "Kibana 安装完成，访问地址：http://$(hostname -I | awk '{print $1}'):$KIBANA_PORT"
}
# ========== 4. 安装 Logstash ==========
install_logstash() {
    info "安装 Logstash $ELK_VERSION ..."
    DISTRO=$(get_distro)
    if [ "$DISTRO" == "centos" ]; then
        yum install -y logstash-$ELK_VERSION
    elif [ "$DISTRO" == "ubuntu" ]; then
        apt install -y logstash=$ELK_VERSION
    fi
    # 创建示例配置文件（从 stdin 输入日志到 elasticsearch）
    cat > /etc/logstash/conf.d/beats_input.conf <<EOF
input {
  beats {
    port => $LS_PORT
    ssl => false
  }
}
output {
  elasticsearch {
    hosts => ["http://localhost:$ES_PORT"]
    index => "logstash-%{+YYYY.MM.dd}"
  }
  stdout {
    codec => rubydebug
  }
}
EOF
    systemctl daemon-reload
    systemctl enable logstash
    systemctl start logstash
    info "Logstash 安装完成，监听端口：$LS_PORT（Beats 输入）"
}
# ========== 主函数 ==========
main() {
    echo "========================================"
    echo "  ELK Stack 自动部署脚本 (v7.x)"
    echo "========================================"
    echo "版本: $ELK_VERSION"
    echo ""
    echo "即将安装:"
    echo "  - Java (OpenJDK 11)"
    echo "  - Elasticsearch (端口 $ES_PORT)"
    echo "  - Kibana (端口 $KIBANA_PORT)"
    echo "  - Logstash (Beats 输入端口 $LS_PORT)"
    echo ""
    read -p "是否继续? (y/N): " confirm
    if [[ "$confirm" != "y" && "$confirm" != "Y" ]]; then
        echo "安装已取消"
        exit 0
    fi
    # 检查是否为 root
    if [ "$EUID" -ne 0 ]; then
        echo "请以 root 身份运行此脚本"
        exit 1
    fi
    # 安装
    install_java
    install_elasticsearch
    install_kibana
    install_logstash
    info "所有组件安装完成！"
    info "Kibana 地址: http://$(hostname -I | awk '{print $1}'):$KIBANA_PORT"
    info "Elasticsearch API: http://localhost:$ES_PORT"
    info "Logstash 监听端口: $LS_PORT (Beats/Filebeat 输入)"
    info "提示：如要使用 Filebeat 发送日志，请配置 Filebeat 输出到 localhost:$LS_PORT"
}
# 执行主函数
main

使用说明

保存脚本

vim deploy_elk.sh
# 粘贴上面的内容后保存
chmod +x deploy_elk.sh

运行脚本

sudo ./deploy_elk.sh

等待安装完成

脚本会自动安装 Java、ES、Kibana、Logstash
启动后会自动配置基本的连通性

验证

组件	验证方式	默认端口
Elasticsearch	`curl http://localhost:9200`	9200
Kibana	浏览器访问 `http://<IP>:5601`	5601
Logstash	`ss -tlnp \\| grep 5044`	5044

注意事项

此脚本为单机测试/演示使用，生产环境请修改：
- Elasticsearch 绑定非 0.0.1
- 启用 X-Pack 安全认证
- 调整 JVM 内存（/etc/elasticsearch/jvm.options）
如果你使用 Ubuntu,请提前确保系统已更新。

如需卸载：

systemctl stop elasticsearch kibana logstash
yum remove elasticsearch kibana logstash   # CentOS
apt remove elasticsearch kibana logstash   # Ubuntu

扩展：发送测试日志

安装完成后，可以用 Filebeat 发送系统日志：

# 安装 Filebeat
# 配置 filebeat.yml:
# output.logstash:
#   hosts: ["localhost:5044"]
# 启动后，Kibana 中创建索引模式（logstash-*）即可查看日志