单机elk的搭建

1、拉取elasticsearch镜像
sudo docker pull elasticsearch:7.3.1
单节点启动：
es启动的：sudo docker run -itd --name=elasticsearch -v /data/elasticsearch/logs:/usr/share/elasticsearch/logs -p 9821:9200 -p 9831:9300 -e “discovery.type=single-node” elasticsearch:7.3.1
多节点启动：
sudo docker run -itd --name=elasticsearch1 -v /data/elasticsearch/node1/logs:/usr/share/elasticsearch/logs -v /data/elasticsearch/conf/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml -p 9821:9200 -p 9831:9300 elasticsearch:7.3.1
sudo docker run -itd --name=elasticsearch2 -v /data/elasticsearch/node2/logs:/usr/share/elasticsearch/logs -p 9822:9201 -p 9832:9301 elasticsearch:7.3.1

-v /data/elasticsearch/node1/data:/usr/share/elasticsearch/data
node.name: “es_node”
cluster.name: “docker-cluster”
network.host: 0.0.0.0
http.cors.enabled: true
http.cors.allow-origin: “*”
discovery.zen.minimum_master_nodes: 2
discovery.zen.ping.unicast.hosts: [“127.0.0.1”,“172.17.0.2:9200”,“172.17.0.7:9201”,“172.17.0.2:9300”,“172.17.0.7:9301”]

2、拉取elasticsearch-head镜像
sudo docker run -itd --restart always --name head --link elasticsearch1 -p 9100:9100 docker.io/mobz/elasticsearch-head:5
需要修改配置文件
Vi Gruntfile.js
3、拉取kibana镜像
Sudo docker pull kibana:7.3.1
kibana启动的：sudo docker run -itd --name=kibana -p 6781:5601 --link elasticsearch -e ELASTICSEARCH_URL=http://47.104.27.246:9821 kibana:7.3.1

没有vi
apt-get update，这个命令的作用是：同步 /etc/apt/sources.list 和 /etc/apt/sources.list.d 中列出的源的索引，这样才能获取到最新的软件包。
apt-get install -y vim

4、安装logstash(传统的)
启动Logstash(两种方式)
nohup /data/logstash-6.2.3/bin/logstash -f /data/logstash-6.2.3/config/logstash.conf &
systemctl restart logstash
配置logstash通过TCP收集输出到elasticsearch

input{
tcp{
port => 5699
mode => “server”
type => “tcplog”
}
}
output{
if [type] == “tcp”{
elasticsearch{
hosts =>[“47.104.27.246:9821”]
index=>“tcp-log-%{+YYYY.MM.dd}.log”
}
}
file {
path => “/tmp/tcp-test5612-%{+YYYY.MM.dd}”
}

}
测试是否配置成功
echo "hello world " | nc 47.104.27.246 5699

Kibana设置登录认证
生成密码文件
// 安装工具包
yum install httpd-tools
// 生成密码，用户名 admin
htpasswd -c /usr/local/nginx/.htpasswd admin

提示输入2遍密码New password:

Re-type new password:
Adding password for user admin
（2）nginx 配置
location / {
# 设置 auth
auth_basic “kibana login auth”;
auth_basic_user_file /usr/local/nginx/.htpasswd;

# 转发到 kibana
proxy_pass http://192.168.3.132:5601;
proxy_redirect off;

}
重新加载：
nginx -s reload

location / {
# 设置 auth
auth_basic “kibana login auth”;
auth_basic_user_file /usr/local/nginx/.htpasswd;

# 转发到 kibana
proxy_pass http://47.104.27.246:6781;
proxy_redirect off;

}