前言

GrayLog6.1版本开始,可以不用单独安装OpenSearch，直接安装GrayLog-DataNode，其已经内置Opensearch 经过参考官方安装文档，测试验证安装过程https://go2docs.graylog.org/current/downloading_and_installing_graylog/red_hat_installation.htm

最终整理成如下一键安装脚本GrayLogAndGrayLogDataNode6.1.2_EL9_install.sh 脚本内容如下

#!/bin/bash
#关闭SELINUX
sed -i 's/enforcing/disabled/g' /etc/selinux/config
setenforce 0
hostnamectl set-hostname almalinux
echo "127.0.0.1 almalinux" >> /etc/hosts
sed -i "s/2.almalinux.pool.ntp.org/ntp.aliyun.com/g" /etc/chrony.conf
systemctl enable chronyd.service
systemctl restart chronyd.service
#解压安装包
mkdir -p /opt/GrayLog_install
tar -zxvf ./GrayLog6.1.2_MongoDB6.0_GrayLogDataNode6.1.2_EL9_RPM.tar.gz -C /opt/GrayLog_install
cat > /etc/yum.repos.d/mongodb-org.repo << \EOF
[mongodb-org-6.0]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/9/mongodb-org/6.0/x86_64/
gpgcheck=0
enabled=1
gpgkey=https://pgp.mongodb.com/server-6.0.asc
EOF

cd /opt/GrayLog_install
#安装mongodb-server服务
rpm -ivh cyrus-sasl*.rpm
rpm -ivh mongodb*.rpm
#启动mongodb-server服务
systemctl daemon-reload
systemctl enable mongod.service
systemctl start mongod.service
systemctl --type=service --state=active | grep mongod
firewall-cmd --add-port=27017/tcp --permanent --zone=public 
firewall-cmd --reload 
sysctl -w vm.max_map_count=262144;
echo 'vm.max_map_count=262144' >> /etc/sysctl.conf
sysctl -p
cd /opt/GrayLog_install
rpm -ivh graylog-datanode-6.1.2-1.x86_64.rpm
#生成password_secret随机密钥
#< /dev/urandom tr -dc A-Z-a-z-0-9 | head -c${1:-96};echo;
#例如我这里生成的为64IpxHgU43trO6mNW34FsHv6Is5c4c5H1FmWM-XF77eAjcg7Zi3Wc7lMj7IIvXbyap2C1yOn3SiCMqnCHe9QSd7PORhyHS3o
mkdir -p /data/graylog-datanode
mkdir -p /data/graylog-datanode/opensearch/config
mkdir -p /data/graylog-datanode/opensearch/data
mkdir -p /data/graylog-datanode/opensearch/logs
chown -R graylog-datanode:graylog-datanode /data/graylog-datanode
#修改graylog-server相关配置文件
sed -i "s/password_secret =/password_secret = 64IpxHgU43trO6mNW34FsHv6Is5c4c5H1FmWM-XF77eAjcg7Zi3Wc7lMj7IIvXbyap2C1yOn3SiCMqnCHe9QSd7PORhyHS3o/g" /etc/graylog/datanode/datanode.conf
sed -i "s#opensearch_config_location = /var/lib/graylog-datanode/opensearch/config#opensearch_config_location = /data/graylog-datanode/opensearch/config#g" /etc/graylog/datanode/datanode.conf
sed -i "s#opensearch_data_location = /var/lib/graylog-datanode/opensearch/data#opensearch_data_location = /data/graylog-datanode/opensearch/data#g" /etc/graylog/datanode/datanode.conf
sed -i "s#opensearch_logs_location = /var/log/graylog-datanode/opensearch#opensearch_logs_location = /data/graylog-datanode/opensearch/logs#g" /etc/graylog/datanode/datanode.conf

systemctl enable graylog-datanode.service
systemctl start graylog-datanode
cd /opt/GrayLog_install
rpm -ivh graylog-server-6.1.2-1.x86_64.rpm
#修改graylog-server相关配置文件 
cp /etc/graylog/server/server.conf /etc/graylog/server/server.conf_default
sed -i "s/password_secret =/password_secret = 64IpxHgU43trO6mNW34FsHv6Is5c4c5H1FmWM-XF77eAjcg7Zi3Wc7lMj7IIvXbyap2C1yOn3SiCMqnCHe9QSd7PORhyHS3o/g" /etc/graylog/server/server.conf
sed -i "s/root_password_sha2 =/root_password_sha2 = 429d280c5ddad83d94770b077b22124231efc727d504b107883297304b3e2939/g" /etc/graylog/server/server.conf
sed -i "s@#root_timezone = UTC@root_timezone = Asia/Shanghai@g" /etc/graylog/server/server.conf
sed -i "s@#http_bind_address = 127.0.0.1:9000@http_bind_address = 0.0.0.0:9000@g" /etc/graylog/server/server.conf
sed -i "s/allow_highlighting = false/allow_highlighting = true/g" /etc/graylog/server/server.conf

#修改graylog-server启动时JVM内存大小
sed -i "s/-Xms1g -Xmx1g/-Xms2g -Xmx2g/g" /etc/sysconfig/graylog-server

firewall-cmd --add-port=9000/tcp --permanent --zone=public 
firewall-cmd --reload
systemctl daemon-reload
systemctl start graylog-server
systemctl enable graylog-server
sleep 5s
tail -f /var/log/graylog-server/server.log

一键脚本安装与初始化过程

1、一键脚本进行安装

脚本安装完成可以看到初始配置的账号密码

It seems you are starting Graylog for the first time. To set up a fresh install, a setup interface has
been started. You must log in to it to perform the initial configuration and continue.

Initial configuration is accessible at 0.0.0.0:9000, with username 'admin' and password 'XWRPsdpRXu'.
Try clicking on http://admin:XWRPsdpRXu@0.0.0.0:9000