ELK20分钟入门并部署（IT老齐学习笔记）

最新推荐文章于 2023-09-26 11:00:21 发布

艾米莉亚碳！

最新推荐文章于 2023-09-26 11:00:21 发布

阅读量287

点赞数 1

文章标签：学习笔记 elasticsearch

本文链接：https://blog.csdn.net/a20714835/article/details/130796761

版权

cat >> /etc/sysctl.conf <<-'EOF'
net.ipv4.ip_forward=1
vm.max_map_count=655360
EOF
sysctl -p

docker network create -d macvlan \
 --subnet=192.168.233.0/24 \
 --ip-range=192.168.233.0/24 \
 --gateway=192.168.233.1 \
 -o parent=ens160 \
macvlan31


docker run --name elasticsearch \
--restart=always \
--network macvlan31 --ip=192.168.233.130 \
-e "discovery.type=single-node" -d \
elasticsearch:7.9.3


docker exec -it elasticsearch /bin/bash

tee >>/usr/share/elasticsearch/config/elastcsearch.yml <<-'EOF'
http.cors.enabled: true
http.cors.allow-origin: "*"
EOF



exit
docker restart elasticsearch


docker run --name kibana \
 --restart=always \
 --network macvlan31 --ip=192.168.233.131 \
 -e ELASTCISEARCH_URL=http://192.168.233.130:9200 \
 -d kibana:7.9.3


mkdir /home/elk


tee >/home/elk/logstash.conf <<-'EOF'
input{
    tcp{
	  port => 5044
	  codec =>json_lines
    }
}
filter{
  ruby {
    code => "event.set('timestamp',event.get('@timestamp').time.localtime + 8*60*60)"
  }
  ruby {
    code => "event.set('@timestamp',event.get('timestamp'))"
  }
  mutate{
    remove_field => ["timestamp"]
  }
}
output{
    stdout {
	codec =>rubydebug
    }
    elasticsearch {      
        hosts => ["192.168.233.130:9200"]
        index => "logstash-%{[server_name]}-%{+YYYY.MM.dd}"   
    }
}
EOF

docker run --network macvlan31 --ip=192.168.233.132 -v /home/elk/logstash.conf:/usr/share/logstash/pipeline/logstash.conf --name logstash -d logstash:7.17.5