今天安装一下elasticsearch和 logstash，上来就踩了一个坑
原本打算用docker-compose安装，一直报错

version: "2"
services:
  elasticsearch:
    image: elasticsearch:7.4.2
    restart: always
    container_name: es
    ports:
      - 9200:9200
      - 9300:9300
      - 9100:9100
    environment:
      - discovery.type=single-node
      - TZ=Asia/Shanghai
      - "ES_JAVA_OPTS=-Xms64m -Xmx251m" #不加此内容会出现内存问题
    #command: rm -rf /usr/share/elasticsearch/config/elasticsearch.yml
    privileged: true
    volumes:
      - /root/soft/base/data/elasticsearch/data:/usr/share/elasticsearch/data
      - /root/soft/base/data/elasticsearch/logs:/usr/share/elasticsearch/logs
      - /root/soft/base/data/elasticsearch/plugins:/usr/share/elasticsearch/plugins
      - /root/soft/base/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml

  logstash:
    image: logstash:7.4.2
    restart: always
    container_name: ls
    privileged: true
    environment:
      - TZ=Asia/Shanghai
    volumes:
      - /root/soft/base/data/logstash/pipeline/:/usr/share/logstash/pipeline/
      - /root/soft/base/data/logstash/glog:/var/log/glog/
      - /root/soft/base/data/mysql-connector-java-8.0.15.jar:/usr/share/logstash/logstash-core/lib/jars/mysql-connector-java-8.0.15.jar
      - /root/soft/base/data/mysql-connector-java-8.0.15.jar:/resource/mysql-connector-java-8.0.15.jar
      - /root/soft/base/data/logstash/mysql:/mysql
    command: bin/logstash -f /usr/share/logstash/pipeline/mysqltoes.conf

[0.001s][error][logging] Initialization of output 'file=logs/gc.log' using options 'filecount=32,filesize=64m' failed.
error:
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
Could not rename log file 'logs/gc.log' to 'logs/gc.log.00' (Permission denied).
Invalid -Xlog option '-Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m', see error log for details.
Error: Could not create the Java Virtual Machine.
Error: A fatal exception has occurred. Program will exit.
	at org.elasticsearch.tools.launchers.JvmErgonomics.flagsFinal(JvmErgonomics.java:111)
	at org.elasticsearch.tools.launchers.JvmErgonomics.finalJvmOptions(JvmErgonomics.java:79)
	at org.elasticsearch.tools.launchers.JvmErgonomics.choose(JvmErgonomics.java:57)
	at org.elasticsearch.tools.launchers.JvmOptionsParser.main(JvmOptionsParser.java:89)
Exception in thread "main" java.lang.RuntimeException: starting java failed with [1]
output:
[0.001s][error][logging] Error opening log file 'logs/gc.log': Permission denied
[0.001s][error][logging] Initialization of output 'file=logs/gc.log' using options 'filecount=32,filesize=64m' failed.

尴尬了，最后不得不放弃，尝试使用命令行启动

docker run -d -e "ES_JAVA_OPTS=-Xms64m -Xmx251m" --name es2 -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" bdaab402b220

感谢以下文章的启发
https://blog.csdn.net/sinat_36483049/article/details/109304280

判断原因有两个 一个是内存问题 一个是权限问题
在宿主机使用 sudo chown -R 1000:1000 /root/soft 给予权限

运行 docker-compose -f docker-compose.yml up 启动成功

然后是logstash的问题

WARNING: Found orphan containers (es) for this project. If you removed or renamed this service in your compose file, you can run this command with the --remove-orphans flag to clean it up.
Creating ls ... done
Attaching to ls
ls          | OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
ls          | OpenJDK 64-Bit Server VM warning: INFO: os::commit_memory(0x00000000c5330000, 986513408, 0) failed; error='Not enough space' (errno=12)
ls          | #
ls          | # There is insufficient memory for the Java Runtime Environment to continue.
ls          | # Native memory allocation (mmap) failed to map 986513408 bytes for committing reserved memory.
ls          | # An error report file with more information is saved as:
ls          | # /usr/share/logstash/hs_err_pid1.log

出现如下内容。因为用的阿里云，应该是内存不足了

find / -name jvm.options

使用该指令查找jvm配置

找到对应容器的配置文件并修改

-Xms64m
-Xmx128m

最好还是升级服务器配置，不然服务器会挂