使用docker安装elk的步骤

自定义docker images 存储位置

修改docker.service文件，使用-g参数指定存储位置

vi /usr/lib/systemd/system/docker.service  

ExecStart=/usr/bin/dockerd --graph /usr/local/docker

// reload配置文件

systemctl daemon-reload

// 重启docker

systemctl restart docker.service

//查看 Docker Root Dir: /var/lib/docker是否改成设定的目录/new-path/docker

docker info

1、docker安装elasticsearch:6.6.1

1.1安装elasticsearch:6.6.1

docker pull elasticsearch:6.6.1

1.2、创建用户定义的网络（用于连接到同一网络的其他服务，例如Kibana）：

docker network create somenetwork

1.3启动myelasticsearch

docker run -di --name=myelasticsearch --net somenetwork -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" elasticsearch:6.6.1

1.4、查看是否启动

[root@localhost /]# docker ps

CONTAINER ID        IMAGE                 COMMAND                  CREATED              STATUS              PORTS                                            NAMES
ce5329fcd330        elasticsearch:6.6.1   "/usr/local/bin/dock…"   About a minute ago   Up About a minute   0.0.0.0:9200->9200/tcp, 0.0.0.0:9300->9300/tcp   myelasticsearch

1.5、Docker宿主机创建的elasticsearch配置文件复制到/usr/local/docker/elasticsearch下，方便后期修改

docker cp ce5329fcd330:/usr/share/elasticsearch/config   /usr/local/docker/elasticsearch

1.6修改配置文件

vim /usr/local/docker/elasticsearch/config/elasticsearch.yml

文件内容：
cluster.name: “docker-cluster”
network.host: 0.0.0.0
#允许任何端口访问
transport.host: 0.0.0.0

1.7根据修改的配置文件启动
停止

docker stop myelasticsearch

删除

docker rm myelasticsearch

启动myelasticsearch

docker run -di --name=myelasticsearch --net somenetwork -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" -v /usr/local/docker/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml elasticsearch:6.6.1

1.8查看是否创建成功
页面输入http://192.168.237.128:9200/，显示以下则启动elasticsearch成功

{
  "name" : "lb4BCKi",
  "cluster_name" : "docker-cluster",
  "cluster_uuid" : "-V-8VseXSKGaSIkvYqw32Q",
  "version" : {
    "number" : "6.6.1",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "1fd8f69",
    "build_date" : "2019-02-13T17:10:04.160291Z",
    "build_snapshot" : false,
    "lucene_version" : "7.6.0",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  },
  "tagline" : "You Know, for Search"
}

1.9、安装ik分词器
进入容器

docker exec -it myelasticsearch /bin/bash

#运行安装命令

/usr/share/elasticsearch/bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v6.6.1/elasticsearch-analysis-ik-6.6.1.zip

重启elasticsearch容器

docker restart  myelasticsearch

1.10测试ik分词器,使用postman

1.11修改Elasticsearch的JVM配置
Elasticsearch默认会配置1G的JVM堆的初始值和最大值，个人电脑的话可以改小些

vim  /config/jvm.options

-Xms512m
-Xmx512m

2、安装Logstash

2.1 安装logstash

docker pull docker.elastic.co/logstash/logstash:6.6.2

2.2启动logstash

docker run --rm -di docker.elastic.co/logstash/logstash:6.6.2

#创建用于存放配置的目录

mkdir -p /usr/local/docker/logstash

#复制配置文件，冒号前面为容器ID

docker cp 59f81468e077:/usr/share/logstash/config  /usr/local/docker/logstash

#复制logstash管道文件

docker cp 59f81468e077:/usr/share/logstash/pipeline  /usr/local/docker/logstash

2.3重新创建容器，并挂载上面两个文件夹
#停止原有容器，否则无法删除

docker stop 59f81468e077

#删除原有容器，使用容器ID删除

docker rm 59f81468e077

#创建新容器并挂载目录

docker run -di --name=mylogstash -v  /usr/local/docker/logstash/config:/usr/share/logstash/config -v  /usr/local/docker/logstash/pipeline:/usr/share/logstash/pipeline docker.elastic.co/logstash/logstash:6.6.2

2.4安装插件
插件安装需要进入容器内部
#进入容器

docker exec -it mylogstash bash

#进入logstash的bin目录

cd /usr/share/logstash/bin

#安装插件,我这里的示例是安装的jdbc

./logstash-plugin install logstash-input-jdbc

3、安装Kibana

3.1安装kibana:6.6.1版本

docker pull kibana:6.6.1

3.2启动kibana

docker run -di -p 5601:5601 kibana:6.6.1

3.3创建存放配置文件的目录
#创建存放配置文件的目录

mkdir -p  /usr/local/docker /kibana

#复制

docker cp 80ed92c7dcec:/usr/share/kibana/config   /usr/local/docker/kibana

#停止原有容器

docker stop 80ed92c7dcec

#删除原有容器

docker rm 80ed92c7dcec

#创建新容器

docker run -di --name=mykibana --net somenetwork -p 5601:5601 -v /usr/local/docker/kibana/config:/usr/share/kibana/config kibana:6.6.1

3.4修改配置文件

vim /usr/local/docker/kibana/config/kibana.yml

server.name: kibana
#允许所有地址访问
server.host: "0.0.0.0"
#elasticsearch的地址
elasticsearch.url: http://192.168.237.128:9200
xpack.monitoring.ui.container.elasticsearch.enabled: true

3.5重启kibana，使配置生效

docker restart mykibana

4、异常处理：打不开kibana的可视化界面：

查看日志：

docker logs mykibana

{"type":"log","@timestamp":"2019-11-30T03:13:45Z","tags":["warning","elasticsearch","admin"],"pid":1,"message":"Unable to revive connection: http://192.168.237.129:9200/"}
{"type":"log","@timestamp":"2019-11-30T03:13:45Z","tags":["warning","elasticsearch","admin"],"pid":1,"message":"No living connections"}

查看防火墙状态：

firewall-cmd --state

关闭防火墙：

#关闭firewalld
systemctl stop firewalld

setenforce 0

–重启docker

systemctl restart docker

–重启elasticsearch

docker restart myelasticsearch

–重启logstash

docker restart mylogstash

–重启kibana

docker restart mykibana

问题解决，可以正常打开kibana可视化界面