ELK初探

docker安装 elasticsearch

elasticsearch:7.7.0

创建elasticsearch.yml,配置外部访问和跨域 

启动命令

docker run --name elasticsearch -p 9200:9200 \
 -p 9300:9300 \
 -e "discovery.type=single-node" \
 -e ES_JAVA_OPTS="-Xms512m -Xmx512m" \
 -v/data/Ai-Sensing/DeployCenter/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
 -d elasticsearch:7.7.0

安装成功 

 安装elasticsearch head

docker pull mobz/elasticsearch-head:5

docker run -d -p 9100:9100 docker.io/mobz/elasticsearch-head:5

安装logstash

下载地址https://mirrors.huaweicloud.com/logstash/7.3.0/logstash-7.3.0.tar.gz

解压tar -zxvf logstash-7.3.0.tar.gz

测试验证logstash
cd /opt/logstash/logstash-7.3.0/bin
./logstash -e 'input { stdin { } } output { elasticsearch { hosts => ["192.168.12.136:9200"] } stdout { codec => rubydebug }}'

显示successful

简单启动

 停止logstash

在config目录下新建配置文件，编辑配置文件，设置输入日志地址，输出到elasticsearch的地址和索引相关信息

添加新的日志文件时用type字段来进行区分并且输出到不同的索引

4 input {
  5   file {
  6     path => "/home/deployadmin/test_tang/modulecenter/og.log"
  7     type => "modulecenter"
  8     start_position => beginning
  9   }
 10   file {
 11     path => "/home/deployadmin/test_tang/worlflow/og.log"
 12     type => "workflow"
 13     start_position => beginning
 14   }
 15 }
 16 
 17 output {
 18   if [type] == "modulecenter" {
 19       elasticsearch {
 20           hosts => ["http://localhost:9200"]
 21           index => "servercenter-modulecenter-service-%{+YYYY.MM.dd}"
 22       }
 23   }
 24   if [type] == "workflow" {
 25       elasticsearch {
 26           hosts => ["http://localhost:9200"]
 27           index => "servercenter-workflow-service-%{+YYYY.MM.dd}"
 28       }
 29   }
 30 
 31 }

 bin目录下以配置文件启动

 发现这个elasticsearch-head页面显示有问题

解决方法https://blog.csdn.net/weixin_52109184/article/details/121855357 

#进入容器
docker exec -it cf74156f18fa /bin/bash
#下载VIM
apt-get update、apt-get install vim

 成功显示 

后续会根据elasticsearch的接口写自己的页面；所以就用不到kibana了