wget --no-check-certificate --no-cookies --header "Cookie: oraclelicense=accept-securebackup-cookie"  http://download.oracle.com/otn-pub/java/jdk/8u92-b14/jdk-8u92-linux-x64.tar.gz
tar -zxvf jdk-8u92-linux-x64.tar.gz
mkdir /usr/local/java
mv jdk1.8.0_92 /usr/local/java/

export JAVA_HOME=/usr/local/java/jdk1.8.0_92
export JRE_HOME=${JAVA_HOME}/jre  
export CLASSPATH=.:${JAVA_HOME}/lib:${JRE_HOME}/lib  
export PATH=${JAVA_HOME}/bin:$PATH

root@ubuntu:~# java -version
java version "1.8.0_92"
Java(TM) SE Runtime Environment (build 1.8.0_92-b14)
Java HotSpot(TM) 64-Bit Server VM (build 25.92-b14, mixed mode)

dpkg -i elasticsearch-5.0.0-alpha4.deb

cd /usr/share/elasticsearch/
mkdir config
cd bin/
./elasticsearch

Exception in thread "main" java.lang.RuntimeException: can not run elasticsearch as root

Exception in thread "main" java.lang.IllegalStateException: Unable to access 'path.conf' (/usr/share/elasticsearch/config)

chown malu /usr/share/elasticsearch -R

dpkg -i kibana-5.0.0-alpha4-amd64.deb

cd /usr/share/kibana/bin
./kibana

dpkg -i logstash-5.0.0-alpha4.deb

input {
    file {
        path => "/var/log/nginx/access.log"
        start_position => beginning
        ignore_older => 0
    }
}
filter {
    grok {
        match => { "message" => "%{COMBINEDAPACHELOG}"}
    }
    geoip {
        source => "clientip"
    }
}
output {
    elasticsearch {
        hosts => [ "localhost:9200","server-2.malu.me:9200" ]
        user => "username"
        password => "pass"
        index => "%{module}-%{+YYYY.MM.dd}"
        document_type => "%{msgtype}"
    }
}

bin/logstash -f first-pipeline.conf --config.test_and_exit

/usr/share/logstash/bin/logstash

wget https://download.elastic.co/logstash/logstash/packages/debian/logstash_2.3.4-1_all.deb
dpkg -i logstash_2.3.4-1_all.deb
apt-get update && apt-get install -y openjdk-7-jre-headless

input {
    file {
        path => "/var/log/apache/access.log"
        start_position => beginning
        ignore_older => 0
    }
}
filter {
    grok {
        match => { "message" => "%{COMBINEDAPACHELOG}"}
    }
    geoip {
        source => "clientip"
    }
}
output {
    elasticsearch {
         hosts => "es.malu.me:6585"
         user => "malu"
         password => "elk"
    }
}

/opt/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf

root@ubuntu:/etc/logstash/conf.d# cat redis_index.conf
input {
        redis {
                host => "localhost"
                port => 6379
                password => "redispassword"
                data_type => "list"
                key => "logstash:redis"
                type => "redis-input"
        }
}
filter {
    grok {
        match => { "message" => "%{COMBINEDAPACHELOG}"}
    }
    geoip {
        source => "clientip"
    }
}
output {
    elasticsearch {
        hosts => [ "localhost:9200" ]
    }
}

root@ubuntu:/etc/logstash/conf.d# cat redis_cli.conf 
input {
    file {
        path => "/var/log/nginx/access.log"
        start_position => beginning
        ignore_older => 0
    }
}
output {
        redis {
                host => "localhost:6379"
                password => "redispassword"
                data_type => "list"
                key => "logstash:redis"
        }
}

./logstash -f /etc/logstash/conf.d/redis_index.conf
./logstash -f /etc/logstash/conf.d/redis_cli.conf --http.port 9601   #启动第二个进程会提示9600端口占用，指定其他端口就可以了

cp /etc/elasticsearch/elasticsearch.yml /usr/share/elasticsearch/config/elasticsearch.yml

network.host: 192.168.1.222
http.port: 9200
discovery.zen.minimum_master_nodes: 1    #这里设为1, 设3的话会导致Kibana报错

initial heap size [33554432] not equal to maximum heap size [522190848]; this can cause resize pauses and prevents mlockall from locking the entire heap
max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]
please set [discovery.zen.minimum_master_nodes] to a majority of the number of master eligible nodes in your cluster
max virtual memory areas vm.max_map_count [65530] likely too low, increase to at least [262144]

initial heap size [33554432] not equal to maximum heap size [522190848]; this can cause resize pauses and prevents mlockall from locking the entire heap

cp /etc/elasticsearch/jvm.options /usr/share/elasticsearch/config/jvm.options

max file descriptors [4096] for elasticsearch process likely too low, increase to at least [65536]

cp /etc/security/limits.conf /etc/security/limits.conf.bak

malu hard nofile 65536
malu soft nofile 65536

please set [discovery.zen.minimum_master_nodes] to a majority of the number of master eligible nodes in your cluster

discovery.zen.minimum_master_nodes: 1 

max virtual memory areas vm.max_map_count [65530] likely too low, increase to at least [262144]

sysctl -w vm.max_map_count=262144

[root@localhost ~]# sysctl -a|grep vm.max_map_count
vm.max_map_count = 262144

vm.max_map_count=262144  #添加这一行

elasticsearch.url: "http://192.168.1.222:9200"  #添加这一行

output {
    elasticsearch {
        hosts => [ "192.168.1.222:9200" ]
    }
}