ELK日志收集系统搭建
首先我们需要搭建ELK日志收集系统,这里使用在Docker环境下安装的方式。
-
安装并运行Elasticsearch容器,使用如下命令即可;
docker run -p 9200:9200 -p 9300:9300 --name elasticsearch \-e "discovery.type=single-node" \-e "cluster.name=elasticsearch" \-e "ES_JAVA_OPTS=-Xms512m -Xmx1024m" \-v /mydata/elasticsearch/plugins:/usr/share/elasticsearch/plugins \-v /mydata/elasticsearch/data:/usr/share/elasticsearch/data \-d elasticsearch:7.17.3
-
启动时会发现/usr/share/elasticsearch/data目录没有访问权限,只需要修改/mydata/elasticsearch/data目录的权限,再重新启动即可;
chmod 777 /mydata/elasticsearch/data/
-
安装并运行Logstash容器,使用如下命令即可,logstash.conf文件地址:https://github.com/macrozheng/mall/blob/master/document/elk/logstash.conf
docker run --name logstash -p 4560:4560 -p 4561:4561 -p 4562:4562 -p 4563:4563 \--link elasticsearch:es \-v /mydata/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf \-d logstash:7.17.3
-
进入容器内部,安装json_lines插件;
docker exec -it logstash /bin/bashlogstash-plugin install logstash-codec-json_lines
-
安装并运行Kibana容器,使用如下命令即可;