groupadd  elk
useradd -g elk elk
passwd elk

yum install java-1.8.0-openjdk java-1.8.0-openjdk-devel -y

rpm -ivh elasticsearch-7.2.0-x86_64.rpm
rpm -ivh kibana-7.2.0-x86_64.rpm
rpm -ivh logstash-7.2.0.rpm

cluster.name: my-application
node.name: es1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: "0.0.0.0"
http.port: 9200
cluster.initial_master_nodes: ["es1"]

server.port: 5601
server.host: "0.0.0.0"
server.name: "es1"
elasticsearch.hosts: ["http://127.0.0.1:9200"]
kibana.index: ".kibana"

path.data: /var/lib/logstash
path.config: "/etc/logtash/conf.d"
path.logs: /var/log/logstash

input{file{path => ["/var/log/elasticsearch"]type => "elasticsearch-log"start_position => "beginning"}
}filter{}output{elasticsearch{hosts => ["127.0.0.1:9200"]index => "system-log-%{+YYYY.MM.dd}"}
}

filebeat.inputs:
- input_type: log
enabeld: true
paths:
- /var/log/elasticsearch/*.log

output.logstash:
hosts: ["127.0.0.1:5044"]

input{beats{port => "5044"    }
}filter{}output{elasticsearch{hosts => ["127.0.0.1:9200"]index => "system-log-%{+YYYY.MM.dd}"}
}

Kibana的登录验证插件是收费功能，这里我们使用nginx来反向代理并设置登录验证。
用来安装nginx的服务器IP是192.168.18.154
nginx安装过程不在赘述
需要安装httpd的密码文件工具
yum -y install httpd-tools
htpasswd -c -b /etc/nginx/passwd/kibana.passwd kibana kibana123（注意创建目录)

server
{listen 80;server_name kibana.shiji.com;access_log /var/log/nginx/kibana/kinaba_access.log main;error_log /var/log/nginx/kibana/kinaba_error.log;auth_basic "Kibana Auth";auth_basic_user_file /etc/nginx/passwd/kibana.passwd;location / {proxy_pass http://192.168.18.144:5601;
    proxy_redirect off;}}