EFK日志系统搭建

安装 elasticsearch-7.8.0

• pull 镜像命令如下:

docker pull elasticsearch:7.8.0

 

• 启动

docker run --name elasticsearch -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" -d elasticsearch:7.8.0

• 检查es是否安装完成 是否有进程

docker ps -a 

• 修改配置，解决跨域问题，进入容器 找到elasticsearch.yml

#进入容器
docker exec -it elasticsearch /bin/bash
#修改配置文件
cd /usr/share/elasticsearch/config/
vi elasticsearch.yml
#添加配置
http.cors.enabled: true
​
http.cors.allow-origin: "*"
​
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
#退出
esc :q
exit

• 安装ik分词器 命令如下

cd /usr/share/elasticsearch/plugins/
​
elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v7.8.0/elasticsearch-analysis-ik-7.8.0.zip

• 重启容器

docker restart elasticsearch

• 设置密码

docker exec -it elasticsearch /bin/bash
cd bin/
./elasticsearch-setup-passwords interactive

安装kibana-7.8.0

• 安装kibana

docker pull kibana:7.8.0

• 初始化启动

docker run --name kibana --link=elasticsearch:test -p 5601:5601 -d kibana:7.8.0
docker start kibana

• 配置es

docker exec -it kibana /bin/bash
cd config/
cat kibana.yml 
#修改host

server:
  name: kibana
  host: 0.0.0.0
  port: 5601
elasticsearch:
  hosts: ["http://192.168.13.1:9200"]
  username: kibana
  password: xxxxx
i18n:
  locale: zh-CN
xpack:
  reporting:
    encryptionKey: 2221xx
  security:
    encryptionKey: xxxx
kibana:
  index: .kibana

• 配置x-pack

curl  -H "Content-Type: application/json"   -XPUT http://localhost:9200/_cluster/settings -d '{
  "persistent" : {
    "xpack" : {
      "monitoring" : {
        "collection" : {
          "enabled" : "true"
        }
      }
    }
  }
}'

安装filebeat-7.8.0

• 下载filebeat 7.8.0

• 修改配置文件

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /mnt/data/aliplatform/community-portalcenter/logs/stdout.log
  fields:
    service_name: community-service-test
​
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
​
setup:
  ilm:
    enabled: false
  template:
    name: filebeat-community-log
    pattern: filebeat-community-log-*
    overwrite: true
    enabled: true
    settings:
      index:
        number_of_shards: 1
        number_of_replicas: 0
        codec: best_compression
        lifecycle:
          name: filebeat-community-log
          rollover_alias: filebeat-community-log
​
output.elasticsearch:
  hosts: ["192.168.13.99:9200"]
  username: "elastic"
  password: "xxxx"
  index: "filebeat-community-log-%{[fields.service_name]}-%{+yyyy.MM.dd}"
​
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

 

安装docker管理工具 docker portainer

• 拉取镜像

  docker pull portainer/portainer

   

• 创建并运行

  docker run -d -p 9000:9000 -v /root/portainer:/data -v /var/run/docker.sock:/var/run/docker.sock --name dev-portainer portainer/portainer

• 访问端口 设置密码 

• 单机版这里选择local, 点击Connect进行连接即可