服务器信息：
ip     :   192.168.1.50
系统：centos7.3 x64
elk官网：https://www.elastic.co/downloads
elk版本：5.4.0

elk 3个组件全部安装到一台机器测试

环境配置：
1、修改主机名及hosts映射

[root@elk ~]# hostname elk
[root@elk ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.50 elk
[root@elk ~]# cat /etc/hostname
elk

2、安装jdk1.8
过程略…

[root@elk ~]# java -version
java version "1.8.0_131"
Java(TM) SE Runtime Environment (build 1.8.0_131-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.131-b11, mixed mode)

3、iptables停掉，firewalld停掉（安装完成后手动开放相应端口）。

安装elasticsearch：

[root@localhost ELK]# rpm -ivh elasticsearch-5.4.0.rpm
warning: elasticsearch-5.4.0.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY
Preparing... ################################# [100%]
Creating elasticsearch group... OK
Creating elasticsearch user... OK
Updating / installing...
 1:elasticsearch-0:5.4.0-1 ################################# [100%]
### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using systemd
 sudo systemctl daemon-reload
 sudo systemctl enable elasticsearch.service
### You can start elasticsearch service by executing
 sudo systemctl start elasticsearch.service

修改elasticsearch配置文件：

[root@elk ~]# cat /etc/elasticsearch/elasticsearch.yml | grep -v "#"
node.name: elk # 主机名
path.data: /home/elk/data # 数据目录
path.logs: /home/elk/logs # 日志目录
network.host: 192.168.1.50 # 监听地址
http.port: 9200 # 监听端口
discovery.zen.ping.unicast.hosts: ["elk"] # 手动发现节点
http.cors.enabled: true # 允许跨域
http.cors.allow-origin: "*" # 允许跨域

# 创建目录

[root@elk ~]# mkdir -p /home/elk/data
[root@elk ~]# mkdir -p /home/elk/logs

# 写入权限，否则/var/log/message里会提示拒绝访问
[root@elk ~]# chmod -R 777 /home/elk

# 文件打开数
[root@elk ~]# cat /etc/security/limits.conf | grep -v "#" | grep -v "^$"
* soft nofile 65535
* hard nofile 65535
# java命令软连接，否则启动es的时候日志报找不到java
[root@localhost ~]# ln -s /usr/local/jdk/bin/java /usr/local/bin/java
# 开机启动
[root@elk ~]# systemctl enable elasticsearch.service

# 启动elasticsearch
[root@elk ~]# systemctl start elasticsearch.service

# 查看elasticsearch端口状态
[root@elk ~]# netstat -tnlp | grep -E "9200|9300"
tcp6 0 0 192.168.1.50:9200 :::* LISTEN 5419/java
tcp6 0 0 192.168.1.50:9300 :::* LISTEN 5419/java

安装elasticsearch图形插件：
先安装nodejs

[root@elk ~]# yum install -y epel-*
[root@elk ~]# yum install -y nodejs

# 安装node.js构建工具
[root@elk ~]# npm install -g grunt

# 克隆elasticsearch-head
[root@elk ~]# cd /usr/local/
[root@elk local]# git clone git://github.com/mobz/elasticsearch-head.git
[root@elk local]# cd elasticsearch-head/
[root@elk elasticsearch-head]# npm install phantomjs-prebuilt@2.1.13 --ignore-scripts

# 修改 _site/app.js 里的地址
[root@elk elasticsearch-head]# vi _site/app.js

this.base_uri = this.config.base_uri || this.prefs.get("app-base_uri") || "http://localhost:9200";
改为
this.base_uri = this.config.base_uri || this.prefs.get("app-base_uri") || "http://192.168.1.50:9200";

# 启动 elasticsearch-head
[root@elk elasticsearch-head]# grunt server &
# 监听在9100端口

安装logstash：

[root@elk ELK]# ln -s /usr/local/jdk/bin/java /usr/bin/java
[root@elk ELK]# rpm -ivh logstash-5.4.0.rpm

# 创建配置文件目录
[root@elk ~]# mkdir /usr/share/logstash/conf
[root@elk ~]# cd /usr/share/logstash/conf

[root@elk conf]# cat test.conf
input {
 file {
 type => "nginx_log"
 path => "/var/log/nginx/access.log"
 }
}
output {
 elasticsearch {
 hosts => "192.168.1.50"
 index => "nginx-access-%{+YYYY.MM.dd}"
 }
 stdout {
 codec => rubydebug
 }
}

# 启动logstash
[root@elk conf]# /usr/share/logstash/bin/logstash -f /usr/share/logstash/conf/test.conf &

# yum 安装nginx测试，启动nginx，访问以下80端口，产生访问日志，去es里查看

安装kibana：

[root@elk ELK]# rpm -ivh kibana-5.4.0-x86_64.rpm
修改配置文件：
[root@elk ~]# cat /etc/kibana/kibana.yml | grep -v "#" | grep -v "^$"
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.url: "http://elk:9200"

# 启动kibana ，端口5601
[root@elk ELK]# systemctl start kibana

浏览器访问

PS：
项目环境的jdk可能不会与elk的jdk版本一直，就会存在两个版本jdk
logstash可以修改java版本，通过在/usr/share/logstash/bin/logstash头部添加：
#!/bin/sh
JAVACMD=/usr/local/jdk1.8.0_131/bin/java

在/etc/logstash/startup.options 配置中发现可以修改jdk，但是始终没有生效。还是选择上面方法。
# After changing anything here, you need to re-run $LS_HOME/bin/system-install
# as root to push the changes to the init script.
################################################################################

# Override Java location
JAVACMD=/usr/local/jdk1.8.0_131/bin/java

最新的5.4版本要求jdk1.8，如果低于1.8，组件无法启动。