{"id":7505,"date":"2022-04-22T14:37:27","date_gmt":"2022-04-22T21:37:27","guid":{"rendered":"https:\/\/www.xh86.me\/?p=7505"},"modified":"2022-04-22T14:37:27","modified_gmt":"2022-04-22T21:37:27","slug":"centos7-%e9%83%a8%e7%bd%b2elastiflow%e7%bd%91%e7%bb%9c%e6%b5%81%e9%87%8f%e5%88%86%e6%9e%90%e5%b9%b3%e5%8f%b0","status":"publish","type":"post","link":"https:\/\/www.xh86.me\/?p=7505","title":{"rendered":"CentOS7 \u90e8\u7f72ElastiFlow\u7f51\u7edc\u6d41\u91cf\u5206\u6790\u5e73\u53f0"},"content":{"rendered":"
\n

\n

<\/section>\n
\n

CentOS7 \u90e8\u7f72ElastiFlow\u7f51\u7edc\u6d41\u91cf\u5206\u6790\u5e73\u53f0<\/span><\/h1>\n

<\/div><\/p>\n

(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n

<\/div><\/p>\n

(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n

<\/div><\/p>\n

(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n

\u672c\u6587\u53c2\u8003\u5982\u4e0b\u94fe\u63a5\u5b8c\u6210<\/p>\n

https:\/\/docs.elastiflow.com\/docs\/install_linux\r\nhttps:\/\/cloud.tencent.com\/developer\/article\/1648854\r\nhttps:\/\/blog.csdn.net\/weixin_43838503\/article\/details\/122432963\r\nhttps:\/\/blog.51cto.com\/coolsky\/3190806\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u6761\u4ef6\u51c6\u5907<\/span><\/h2>\n
    \n
  • \n
    1\u3001host-sflow agent<\/section>\n<\/li>\n<\/ul>\n
    https:\/\/github.com\/sflow\/host-sflow\/releases\/download\/v2.0.25-3\/hsflowd-centos7-2.0.25-3.x86_64.rpm\r\n<\/code><\/pre>\n
      \n
    • \n
      2\u3001ELK\u7684\u5b89\u88c5\u5305<\/section>\n<\/li>\n<\/ul>\n
      elasticsearch-7.17.2-x86_64.rpm\r\nkibana-7.17.2-x86_64.rpm\r\nlogstash-7.17.2-x86_64.rpm\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      <\/div><\/p>\n
      <\/div><\/p>\n
      \u5177\u4f53\u5b89\u88c5\u90e8\u7f72\u6b65\u9aa4\u5982\u4e0b<\/span><\/h1>\n
      \u4e00\u3001\u8c03\u6574\u76f8\u5173\u7684\u5185\u6838\u53c2\u6570\u5e76\u5173\u95ed\u9632\u706b\u5899<\/span><\/h2>\n
      sed\u00a0-i\u00a0's\/enable\/disabled\/g'<\/span>\u00a0\/etc\/selinux\/config\r\nsetenforce\u00a00\r\nhostnamectl\u00a0set<\/span>-hostname\u00a0elastiflow\r\necho<\/span>\u00a0\"vm.max_map_count=262144\"<\/span>\u00a0|\u00a0sudo\u00a0tee\u00a0\/etc\/sysctl.d\/70-elasticsearch.conf\u00a0>\u00a0\/dev\/null\r\necho<\/span>\u00a0-e\u00a0\"net.core.netdev_max_backlog=4096nnet.core.rmem_default=262144nnet.core.rmem_max=67108864nnet.ipv4.udp_rmem_min=131072nnet.ipv4.udp_mem=2097152\u00a04194304\u00a08388608\"<\/span>\u00a0|\u00a0\u00a0tee\u00a0\/etc\/sysctl.d\/60-net.conf\u00a0>\u00a0\/dev\/null\r\n\u00a0sysctl\u00a0-w\u00a0vm.max_map_count=262144\u00a0&&\u00a0\u00a0\u00a0sysctl\u00a0-w\u00a0net.core.netdev_max_backlog=4096\u00a0&&\u00a0\u00a0\u00a0sysctl\u00a0-w\u00a0net.core.rmem_default=262144\u00a0&&\u00a0\u00a0\u00a0\u00a0sysctl\u00a0-w\u00a0net.core.rmem_max=67108864\u00a0&&\u00a0\u00a0\u00a0\u00a0sysctl\u00a0-w\u00a0net.ipv4.udp_rmem_min=131072\u00a0&&\u00a0\u00a0\u00a0sysctl\u00a0-w\u00a0net.ipv4.udp_mem='2097152\u00a04194304\u00a08388608'<\/span>\r\n\u00a0systemctl\u00a0stop\u00a0firewalld.service\u00a0&&\u00a0\u00a0systemctl\u00a0disable<\/span>\u00a0firewalld.service\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u4e8c\u3001\u5b89\u88c5JDK\u73af\u5883\u5e76\u5b89\u88c5ELK<\/span><\/h2>\n
      \u00a0yum\u00a0install\u00a0java-openjdk-devel\u00a0java-openjdk\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u00a0rpm\u00a0-ivh\u00a0logstash-7.17.2-x86_64.rpm\u00a0\r\n\u00a0rpm\u00a0-ivh\u00a0elasticsearch-7.17.2-x86_64.rpm\u00a0\r\n\u00a0rpm\u00a0-ivh\u00a0kibana-7.17.2-x86_64.rpm\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u00a0systemctl\u00a0daemon-reload\r\n\u00a0systemctl\u00a0enable<\/span>\u00a0elasticsearch.service\r\n\u00a0systemctl\u00a0enable<\/span>\u00a0kibana.service\r\n\u00a0systemctl\u00a0enable<\/span>\u00a0logstash.service\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u4e09\u3001Elasticsearch\u548cKibana\u914d\u7f6e\u6587\u4ef6\u4fee\u6539<\/span><\/h2>\n
      \u00a0vim\u00a0\/etc\/elasticsearch\/elasticsearch.yml\u00a0\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u00a0vim\u00a0\/etc\/elasticsearch\/jvm.options\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u00a0vim\u00a0\/etc\/kibana\/kibana.yml\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u56db\u3001elastiflow\u5b89\u88c5\u5305\u89e3\u538b<\/span><\/h2>\n
      https:\/\/codeload.github.com\/robcowart\/elastiflow\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      mv\u00a0elastiflow-master\u00a0elastiflow\r\ncp\u00a0-a\u00a0elastiflow\/logstash\/elastiflow\/.\u00a0\/etc\/logstash\/elastiflow\/\r\ncp\u00a0-a\u00a0elastiflow\/logstash.service.d\/.\u00a0\/etc\/systemd\/system\/logstash.service.d\/\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      vim\u00a0\/etc\/logstash\/pipelines.yml\u00a0\r\n\u00a0\u4fee\u6539\u6dfb\u52a0\u6210\u5982\u4e0b\r\n#-\u00a0pipeline.id:\u00a0main<\/span>\r\n#\u00a0\u00a0path.config:\u00a0\"\/etc\/logstash\/conf.d\/*.conf\"<\/span>\r\n-\u00a0pipeline.id:\u00a0elastiflow\r\n\u00a0\u00a0path.config:\u00a0\"\/etc\/logstash\/elastiflow\/conf.d\/*.conf\"<\/span>\r\n\u00a0\u00a0pipeline.workers:\u00a04\r\n\u00a0\u00a0\r\n\u00a0\u00a0\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u00a0chown\u00a0-R\u00a0logstash:logstash\u00a0\/etc\/logstash\/elastiflow\r\n\u00a0chown\u00a0-R\u00a0logstash:logstash\u00a0\/etc\/logstash\/pipelines.yml<\/code><\/pre>\n
      \u00a0vi\u00a0\/etc\/logstash\/jvm.options\u00a0\r\n\u00a0vim\u00a0\/etc\/logstash\/startup.options\r\n\u00a0\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \/usr\/share\/logstash\/bin\/logstash-plugin\u00a0install\u00a0logstash-codec-sflow\u00a0\r\n\/usr\/share\/logstash\/bin\/logstash-plugin\u00a0install\u00a0logstash-codec-netflow\u00a0\r\n\/usr\/share\/logstash\/bin\/logstash-plugin\u00a0install\u00a0logstash-input-udp\u00a0\r\n\/usr\/share\/logstash\/bin\/logstash-plugin\u00a0install\u00a0logstash-input-tcp\u00a0\r\n\/usr\/share\/logstash\/bin\/logstash-plugin\u00a0install\u00a0logstash-filter-dns\u00a0\r\n\/usr\/share\/logstash\/bin\/logstash-plugin\u00a0install\u00a0logstash-filter-geoip\u00a0\r\n\/usr\/share\/logstash\/bin\/logstash-plugin\u00a0install\u00a0logstash-filter-translate\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \/usr\/share\/logstash\/bin\/system-install\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u4e94\u3001\u542f\u52a8\u670d\u52a1<\/span><\/h2>\n
      systemctl\u00a0restart\u00a0elasticsearch.service\u00a0\r\nsystemctl\u00a0restart\u00a0kibana.service\r\nsystemctl\u00a0restart\u00a0logstash.service\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u516d\u3001Kibana\u914d\u7f6e<\/span><\/h2>\n
      \u5bfc\u5165elastiflow.kibana.7.8.x.ndjson\u5230kibana<\/p>\n
      <\/div><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u4fee\u6539\u5982\u4e0bkibana\u4e2d\u7684\u914d\u7f6e<\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u4e03\u3001Linux\u670d\u52a1\u5668\u5b89\u88c5\u53ca\u914d\u7f6ehsflow<\/span><\/h2>\n
      rpm\u00a0-ivh\u00a0hsflowd-centos7-2.0.25-3.x86_64.rpm\u00a0<\/code><\/pre>\n
      vim\u00a0\/etc\/hsflowd.conf
      \n\u6dfb\u52a0\u5982\u4e0b\u914d\u7f6e
      \nsampling\u00a0=\u00a01
      \n#\u622a\u53d6\u5305\u5927\u5c0f\u4e3a256<\/span>
      \nheaderBytes\u00a0=\u00a0256
      \n#\u8bbe\u7f6e\u6536\u96c6\u5668\u5730\u5740\u548c\u7aef\u53e3<\/span>
      \ncollector\u00a0{\u00a0ip=192.168.31.189\u00a0udpport=6343\u00a0}
      \n#\u8bbe\u7f6e\u91c7\u6837\u7684\u7f51\u5361<\/span>
      \npcap\u00a0{\u00a0dev\u00a0=\u00a0ens33\u00a0}<\/p>\n
      <\/code><\/pre>\n
      systemctl\u00a0enable<\/span>\u00a0hsflowd
      \nsystemctl\u00a0start\u00a0hsflowd
      \nsystemctl\u00a0status\u00a0hsflowd<\/p>\n
      <\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \n
      \u516b\u3001\u6548\u679c\u6d4b\u8bd5\u622a\u56fe<\/span><\/h2>\n<\/section>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \u4e5d\u3001Tips<\/span><\/h2>\n
      1\u3001\u4ea4\u6362\u673a\u914d\u7f6esflow\u6682\u672a\u8fdb\u884c\u6d4b\u8bd5<\/p>\n
      \u540e\u7eed\u6709\u73af\u5883\u4f1a\u53ef\u4ee5\u8fdb\u884c\u6d4b\u8bd5<\/p>\n
      2\u3001\u82e5logstash\u542f\u52a8\u5931\u8d25<\/p>\n
      \u9700\u8981\/var\/log\/logstash\/logstash-plain.log \u548cjournalctl -xe -u logstash\u8fdb\u884c\u6392\u9519<\/p>\n
      3\u3001\u4e0a\u9762\u7684kibana\u4e0eES\u672a\u914d\u7f6e\u5b89\u5168\u8ba4\u8bc1 \u540e\u7eed\u6709\u65f6\u95f4\u518d\u505a\u8c03\u6574<\/p>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
      CentOS7 \u90e8\u7f72ElastiFlow\u7f51\u7edc\u6d41\u91cf\u5206\u6790\u5e73\u53f0 (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b) (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b) (\u56fe […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,3],"tags":[],"class_list":["post-7505","post","type-post","status-publish","format-standard","hentry","category-linux","category-system"],"_links":{"self":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7505"}],"version-history":[{"count":1,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7505\/revisions"}],"predecessor-version":[{"id":7816,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7505\/revisions\/7816"}],"wp:attachment":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}