主流的 ELK（Elasticsearch，Logstash，Kibana）目前已经转变为EFK（Elasticsearch，Filebeat or Fluentd，Kibana）。

[root@sh2-vsvl-q9011 ~]# firewall-cmd --permanent --add-port=9200/tcp --zone=public # 放行 Elasticsearch 5601 和 Kibana 9200 端口
[root@sh2-vsvl-q9011 ~]# firewall-cmd --permanent --add-port=5601/tcp --zone=public
[root@sh2-vsvl-q9011 ~]# firewall-cmd --reload 

[root@sh2-vsvl-q9011 ~]# rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch # 配置EFK的yum环境
[root@sh2-vsvl-q9011 ~]# vim /etc/yum.repos.d/efk.repo # 创建yum源文件

[elasticsearch]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
autorefresh=1
type=rpm-md

[elastic-7.x]
name=Elastic repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

[kibana-7.x]
name=Kibana repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

[root@sh2-vsvl-q9011 ~]# yum install --enablerepo=elasticsearch elasticsearch -y # 部署EFK
[root@sh2-vsvl-q9011 ~]# yum install kibana -y
[root@sh2-vsvl-q9011 ~]# yum install filebeat -y

[root@sh2-vsvl-q9011 ~]# vim /etc/elasticsearch/elasticsearch.yml

node.name: es-node1
cluster.initial_master_nodes: ["es-node1"]
http.port: 9200
network.host: 0.0.0.0

[root@sh2-vsvl-q9011 ~]# vim /etc/kibana/kibana.yml

server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: [" #IP 修改为 elasticsearch 服务的IP
kibana.index: ".kibana"

[root@sh2-vsvl-q9011 ~]# vim /etc/filebeat/filebeat.yml

setup.kibana:
       host: "  # IP 修改为kibana服务的IP

    output.elasticsearch:
       hosts: ["localhost:9200"]            # iIP 修改为 elasticsearch 服务的IP

    filebeat.inputs:
    - type: log
       enabled: false
       paths:        # 日志收集的路径
        - /var/log/*.log

[root@sh2-vsvl-q9011 ~]# systemctl start elasticsearch.service
[root@sh2-vsvl-q9011 ~]# systemctl enable elasticsearch.service
[root@sh2-vsvl-q9011 ~]# systemctl start kibana.service
[root@sh2-vsvl-q9011 ~]# systemctl enable kibana.service
[root@sh2-vsvl-q9011 ~]# systemctl start filebeat.service
[root@sh2-vsvl-q9011 ~]# systemctl enable filebeat.service

其他问题

[root@sh2-vsvl-q9011 ~]# systemctl stop kibana.service # Kibana server is not ready yet
[root@sh2-vsvl-q9011 ~]# curl -XDELETE http://192.168.9.11:9200/.kibana* # 删除索引
[root@sh2-vsvl-q9011 ~]# systemctl restart kibana.service