Docker-Compose部署ELK教程

1. 环境

• Ubuntu 20以上
• Docker version 20以上
• Docker-Compose version 1.25以上
  安装Docker和Docker-Compose教程

2. 部署elasticsearch

2.1.创建elasticsearch.yml文件

vim elasticsearch.yml

cluster:
  name: "cluster-elastic"
discovery:
  type:  single-node 
network:
  host: 0.0.0.0 
node:
  name: standalone-node-1
http:
  host: 0.0.0.0 
  cors:
    enabled: true 
    allow-origin: "*"
xpack: 
  security: 
    enabled: true  

2.2. 创建elasticsearch的docker-compose.yml文件

vim docker-compose.yml

version: '3'
services:
  elasticsearch:
    image: elasticsearch:7.17.4  #镜像
    container_name: pl_elk_elasticsearch  #定义容器名称
    restart: always  #开机启动，失败也会一直重启
    environment:
      - "cluster.name=elasticsearch" #设置集群名称为elasticsearch
      - "discovery.type=single-node" #以单一节点模式启动
      - "ES_JAVA_OPTS=-Xms1g -Xmx2g" #设置使用jvm内存大小
    volumes:
      - /home/data/elk/elasticsearch/plugins:/usr/share/elasticsearch/plugins #插件文件挂载
      - /home/data/elk/elasticsearch/data:/usr/share/elasticsearch/data #数据文件挂载
      - /home/data/elk/elasticsearch/logs:/usr/share/elasticsearch/logs #日志文件挂载
      - /home/data/elk/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml #日志文件挂载
      - /etc/localtime:/etc/localtime #时区
    ports:
      - 9200:9200
      - 9300:9300

2.3. 启动elasticsearch

docker-compose up -d 

3. 部署kibana和logstash

3.1. 创建kibana.yml文件

vim kibana.yml

server: 
  name: kibana 
  host: "0" 
xpack:
  monitoring:
    ui:
      container:
        elasticsearch:
          enabled: true 
elasticsearch:
  # 自定义账号
  username: "elastic" 
  #自定义密码
  password: "elastic@2022" 
  # http://内网ip+elasticsearch端口号
  hosts: [ "http://10.0.168.217:9200" ]

3.2. 创建logstash.conf

vim logstash.conf

input {
  beats {
    port => 5044
  }
}

filter {
	kv {
		source => "message"
	}	
}

output {
  stdout {
    codec => rubydebug
  }
}

3.3. 创建kibana和logstash的docker-compose.yml文件

vim docker-compose.yml

version: '3'
services:
  kibana:
    image: kibana:7.17.4
    container_name: pl_kibana
    restart: always
    environment:
      - ELASTICSEARCH_URL=http://10.0.168.217:9200 #设置访问elasticsearch的地址
      - SERVICE_IP=10.0.168.217
      - ELASTIC_USERNAME=elastic
      - ELASTIC_PASSWORD=elastic@2022
    ports:
      - 5601:5601
    volumes:
      - /home/data/kibana/config:/usr/share/kibana/config
      - /etc/localtime:/etc/localtime
  logstash:
    image: logstash:7.17.4
    container_name: pl_elk_logstash
    restart: always
    volumes:
      - /home/data/elk/logstash/config/conf.d:/usr/share/logstash/pipeline #挂载logstash的配置文件
      - /home/data/elk/logstash/config/yaml:/usr/share/logstash/config #挂载logstash的配置文件
      - /etc/localtime:/etc/localtime
    ports:
      - 4560:4560
      - 9600:9600

3.4. 启动kibana和logstash

docker-compose up -d 

4. 自此ELK部署完成