docker 搭建elk

一、Docker 安装 Elasticsearch

1、拉镜像

docker pull elasticsearch:latest

2、创建文件夹

mkdir -p /home/elasticsearch/config
mkdir -p /home/elasticsearch/data
echo "http.host: 0.0.0.0">>/home/elasticsearch/config/elasticsearch.yml
chmod -R 777 /home/elasticsearch/

3、启动镜像

docker run --privileged=true --name elasticsearch -p 9200:9200 \
 -p 9300:9300 \
 -e "discovery.type=single-node" \
 -e ES_JAVA_OPTS="-Xms64m -Xmx128m" \
 -v /home/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
 -v /home/elasticsearch/data:/usr/share/elasticsearch/data \
 -v /home/elasticsearch/plugins:/usr/share/elasticsearch/plugins \
 -d elasticsearch

4、搭建前端框架

docker pull mobz/elasticsearch-head:5
docker run --privileged=true -d -p 9100:9100 docker.io/mobz/elasticsearch-head:5

5、配置文件

修改/home/elasticsearch/config/elasticsearch.yml文件

cluster.name: "docker-cluster"
network.host: 0.0.0.0
# 访问ID限定，0.0.0.0为不限制，生产环境请设置为固定IP
transport.host: 0.0.0.0
# elasticsearch节点名称
node.name: node-1
# elasticsearch节点信息
cluster.initial_master_nodes: ["node-1"]
# 下面的配置是关闭跨域验证（可以不开启）
http.cors.enabled: true
http.cors.allow-origin: "*"

二、Docker 安装 Kibana

1、拉镜像

docker pull kibana

2、文件夹和配置文件

mkdir -p /home/elk
vi /home/elk/kibana.yml

srver.port: 5601
server.host: "0.0.0.0"
# 操作界面语言设置为中文
i18n.locale: "zh-CN"

# 地址为es地址
# Default Kibana configuration for docker target
server.name: kibana
elasticsearch.hosts: [ "http://192.168.12.183:9200" ]
xpack.monitoring.ui.container.elasticsearch.enabled: true

3、启动

docker run --name kibana       -e ELASTICSEARCH_URL=http://192.168.2.134:9200       -p 5601:5601 -d kibana

docker run \
--privileged=true -d \
--log-driver json-file \
--log-opt max-size=100m \
--log-opt max-file=2 \
--name kibana \
-p 5601:5601 \
-v /home/elk/kibana.yml:/usr/share/kibana/config/kibana.yml 
kibana

安装logstash

docker pull logstash-7.6.0
docker run -di -p 5044:5044 -v /home/elk/logstash.conf:/usr/share/logstash/pipeline/logstash.conf --name logstash logstash:7.6.0

配置文件logstash.conf

input {
    tcp {
        port => 5044
        mode => "server"
        tags => ["tags"]
                # 输入为json数据
        codec => json_lines
    }
}
filter {

}
output {
        # elasticsearch配置
        elasticsearch {
                hosts => ["http://192.168.2.134:9200"]
                # 索引名称，没有会自动创建
                index => "logstash-%{[appname]}-%{+YYYY.MM.dd}"
        }
}