docker-compose部署elk（8.9.0）并开启ssl认证

已于 2023-10-22 16:54:59 修改
阅读量2.1k 收藏 7
点赞数 1
分类专栏： # elastic 文章标签： docker elk ssl
于 2023-10-15 21:54:51 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/qq_41139119/article/details/133843723
版权

docker部署elk并开启ssl认证

docker-compose部署elk

部署所需yml文件 —— docker-compose-elk.yml

version: '3.7'
services:
  elasticsearch:
    image: elasticsearch:8.9.0
    container_name: elasticsearch
    hostname: elasticsearch
    restart: "no"
    volumes:
      - /opt/space/soft/docker/elasticsearch/data:/usr/share/elasticsearch/data:rw
      - /opt/space/soft/docker/elasticsearch/config:/usr/share/elasticsearch/config:rw
      - /opt/space/soft/docker/elasticsearch/logs:/usr/share/elasticsearch/logs:rw
      - /opt/space/soft/docker/elasticsearch/plugins:/usr/share/elasticsearch/plugins:rw
    ports:
      - "21033:9200"
      - "21133:9300"
    networks:
      elastic:
        aliases:
          - elasticsearch

  kibana:
    image: kibana:8.9.0
    container_name: kibana
    hostname: kibana
    restart: "no"
    volumes:
      - /opt/space/soft/docker/kibana/data:/usr/share/kibana/data:rw
      - /opt/space/soft/docker/kibana/config:/usr/share/kibana/config:rw
      - /opt/space/soft/docker/kibana/logs:/usr/share/kibana/logs:rw
    ports:
      - 21041:5601
    depends_on:
      - elasticsearch
    networks:
      elastic:
        aliases:
          - kibana
          
  logstash:
    image: logstash:8.9.0
    container_name: logstash
    hostname: logstash
    restart: "no"
    volumes:
      - /opt/space/soft/docker/logstash/config:/usr/share/logstash/config:rw
      - /opt/space/soft/docker/logstash/logs:/usr/share/logstash/logs:rw
      - /opt/space/soft/docker/logstash/pipeline:/usr/share/logstash/pipeline:rw
    ports:
      - 21066:5044
      - 21067:9066
      - 21068:21068
    depends_on:
      - elasticsearch
    networks:
      elastic:
        aliases:
          - logstash


networks:
  elastic:
    name: elastic
    driver: bridge

这里做了端口映射以及挂载数据卷。

部署

1.使用docker-compose命令部署

docker-compose -f docker-compose-elk.yml up -d

部署前需要先将挂载的数据卷注释掉，用于拷贝配置文件到本地磁盘
部署前需要先将挂载的数据卷注释掉，用于拷贝配置文件到本地磁盘

  1. 创建所需目录，拷贝配置文件到本地，并设置读写权限为 777
cd /opt/space/soft/docker/
sudo mkdir -p elasticsearch/{config,data,logs,plugins}
sudo mkdir -p kibana/{config,data,logs}
sudo mkdir -p logstash/{config,pipeline,logs}

sudo docker cp elasticsearch:/usr/share/elasticsearch/config ./elasticsearch/
sudo docker cp kibana:/usr/share/kibana/config ./kibana/
sudo docker cp  logstash:/usr/share/logstash/config ./logstash/
sudo docker cp  logstash:/usr/share/logstash/pipeline ./logstash/

sudo chmod 777 -R /opt/space/soft/docker/elasticsearch/*
sudo chmod 777 -R /opt/space/soft/docker/kibana/*
sudo chmod 777 -R /opt/space/soft/docker/logstash/*
  1. 修改jvm参数（作者电脑配置不够高，所以需要进行修改）
    3.1 修改elasticsearch的jvm参数
    打开/opt/space/soft/docker/elasticsearch/config/jvm.options文件，按图中所示进行配置。
    修改elasticsearch的jvm参数
    3.2 修改logstash的jvm参数
    打开/opt/space/soft/docker/logstash/config/jvm.options文件，按图中所示进行配置。
    修改logstash的jvm参数
  2. 放开docker-compose-elk.yml文件内挂载数据卷的注释，并执行下列命令。
docker-compose  -f docker-compose-elk.yml stop
docker-compose  -f docker-compose-elk.yml rm
docker-compose  -f docker-compose-elk.yml up -d

配置elasticsearch和kibana并开启ssl

配置基础数据认证

参考文档

  1. 进入elasticsearch的docker容器内
docker exec -it elasticsearch bash
  1. 生成elastic-stack-ca.p12
./bin/elasticsearch-certutil ca

命令示意图

  1. 生成elastic-certificates.p12
./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12

命令示意图
4. 拷贝elastic-certificates.p12到目录/usr/share/elasticsearch/config/certs，删除elastic-stack-ca.p12

mv elastic-certificates.p12 config/certs/
mv elastic-stack-ca.p12 ./config/

elastic-stack-ca.p12文件保留下来，后面有用

5.设置elasticsearch.yml配置文件
安装如图所示进行修改

xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/elastic-certificates.p12
  truststore.path: certs/elastic-certificates.p12

按照如图所示修改
6.如果certificate设置了密码，需要执行一下两个命令

./bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password

./bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password

命令1示意图
命令2示意图

此处可能出现以下错误，需要退出容器，给提示的文件设置所属用户

sudo chown linux当前登录用户名 elasticsearch/config/elasticsearch.keystore

注意点

  1. 退出elasticsearch容器，给certificates文件赋予777权限
sudo chmod 777 elasticsearch/config/certs/elastic-certificates.p12
  1. 重启elasticsearch容器
docker restart elasticsearch

配置elasticsearch和kibana开启https访问

参考文档

  1. 再次进入elasticsearch的docker容器内
docker exec -it elasticsearch bash
  1. 生成elasticsearch-ssl-http.zip

命令所需操作过长，此处不在截图

elasticsearch@elasticsearch:~$ ./bin/elasticsearch-certutil http

## Elasticsearch HTTP Certificate Utility

The 'http' command guides you through the process of generating certificates
for use on the HTTP (Rest) interface for Elasticsearch.

This tool will ask you a number of questions in order to generate the right
set of files for your needs.

## Do you wish to generate a Certificate Signing Request (CSR)?

A CSR is used when you want your certificate to be created by an existing
Certificate Authority (CA) that you do not control (that is, you don't have
access to the keys for that CA). 

If you are in a corporate environment with a central security team, then you
may have an existing Corporate CA that can generate your certificate for you.
Infrastructure within your organisation may already be configured to trust this
CA, so it may be easier for clients to connect to Elasticsearch if you use a
CSR and send that request to the team that controls your CA.

If you choose not to generate a CSR, this tool will generate a new certificate
for you. That certificate will be signed by a CA under your control. This is a
quick and easy way to secure your cluster with TLS, but you will need to
configure all your clients to trust that custom CA.

## 生成CSR 输入n
Generate a CSR? [y/N]n

## Do you have an existing Certificate Authority (CA) key-pair that you wish to use to sign your certificate?

If you have an existing CA certificate and key, then you can use that CA to
sign your new http certificate. This allows you to use the same CA across
multiple Elasticsearch clusters which can make it easier to configure clients,
and may be easier for you to manage.

If you do not have an existing CA, one will be generated for you.

## 是否使用存在的ca 输入y（在基础配置时生成了）
Use an existing CA? [y/N]y

## What is the path to your CA?

Please enter the full pathname to the Certificate Authority that you wish to
use for signing your new http certificate. This can be in PKCS#12 (.p12), JKS
(.jks) or PEM (.crt, .key, .pem) format.
## 输入ca文件的地址
CA Path: /usr/share/elasticsearch/config/elastic-stack-ca.p12
Reading a PKCS12 keystore requires a password.
It is possible for the keystore's password to be blank,
in which case you can simply press <ENTER> at the prompt
## 输入文件设置的密码
Password for elastic-stack-ca.p12:

## How long should your certificates be valid?

Every certificate has an expiry date. When the expiry date is reached clients
will stop trusting your certificate and TLS connections will fail.

Best practice suggests that you should either:
(a) set this to a short duration (90 - 120 days) and have automatic processes
to generate a new certificate before the old one expires, or
(b) set it to a longer duration (3 - 5 years) and then perform a manual update
a few months before it expires.

You may enter the validity period in years (e.g. 3Y), months (e.g. 18M), or days (e.g. 90D)

## 设置过期时间
For how long should your certificate be valid? [5y] 5y

## Do you wish to generate one certificate per node?

If you have multiple nodes in your cluster, then you may choose to generate a
separate certificate for each of these nodes. Each certificate will have its
own private key, and will be issued for a specific hostname or IP address.

Alternatively, you may wish to generate a single certificate that is valid
across all the hostnames or addresses in your cluster.

If all of your nodes will be accessed through a single domain
(e.g. node01.es.example.com, node02.es.example.com, etc) then you may find it
simpler to generate one certificate with a wildcard hostname (*.es.example.com)
and use that across all of your nodes.

However, if you do not have a common domain name, and you expect to add
additional nodes to your cluster in the future, then you should generate a
certificate per node so that you can more easily generate new certificates when
you provision new nodes.

## 是否为每一个节点生成证书 输入n
Generate a certificate per node? [y/N]n

## Which hostnames will be used to connect to your nodes?

These hostnames will be added as "DNS" names in the "Subject Alternative Name"
(SAN) field in your certificate.

You should list every hostname and variant that people will use to connect to
your cluster over http.
Do not list IP addresses here, you will be asked to enter them later.

If you wish to use a wildcard certificate (for example *.es.example.com) you
can enter that here.

## 节点的hostname,设置为elasticsearch，敲两次回车
Enter all the hostnames that you need, one per line.
When you are done, press <ENTER> once more to move on to the next step.

elasticsearch

You entered the following hostnames.

 - elasticsearch

## 配置是否正确
Is this correct [Y/n]y

## Which IP addresses will be used to connect to your nodes?

If your clients will ever connect to your nodes by numeric IP address, then you
can list these as valid IP "Subject Alternative Name" (SAN) fields in your
certificate.

If you do not have fixed IP addresses, or not wish to support direct IP access
to your cluster then you can just press <ENTER> to skip this step.

## 节点的ip(可以在宿主机通过命令docker inspect elasticsearch查看),设置为172.27.0.2，敲两次回车
Enter all the IP addresses that you need, one per line.
When you are done, press <ENTER> once more to move on to the next step.

172.27.0.2

You entered the following IP addresses.

 - 172.27.0.2
## 配置是否正确
Is this correct [Y/n]y

## Other certificate options

The generated certificate will have the following additional configuration
values. These values have been selected based on a combination of the
information you have provided above and secure defaults. You should not need to
change these values unless you have specific requirements.

Key Name: elasticsearch
Subject DN: CN=elasticsearch
Key Size: 2048

## 是否更改任意项
Do you wish to change any of these options? [y/N]n

## What password do you want for your private key(s)?

Your private key(s) will be stored in a PKCS#12 keystore file named "http.p12".
This type of keystore is always password protected, but it is possible to use a
blank password.

If you wish to use a blank password, simply press <enter> at the prompt below.
## 输入生成文件的密码（可不设置，设置需要在后面进行配置）
Provide a password for the "http.p12" file:  [<ENTER> for none]
## 再次输入生成文件的密码
Repeat password to confirm: 

## Where should we save the generated files?

A number of files will be generated including your private key(s),
public certificate(s), and sample configuration options for Elastic Stack products.

These files will be included in a single zip archive.

## 生成压缩文件的地址和名称，直接敲回车即可
What filename should be used for the output zip file? [/usr/share/elasticsearch/elasticsearch-ssl-http.zip] 

Zip file written to /usr/share/elasticsearch/elasticsearch-ssl-http.zip
  1. 移动elasticsearch-ssl-http.zip压缩包
 mv elasticsearch-ssl-http.zip ./config/
  1. 解压，并移动elasticsearc的http.p12文件，删除其余文件
unzip config/elasticsearch-ssl-http.zip
mv elasticsearch/http.p12 ./config/certs/
rm -rf elasticsearch/  kibana/
  1. 设置密码是需要执行该命令，没有设置则跳过
./bin/elasticsearch-keystore add xpack.security.http.ssl.keystore.secure_password

命令示意图
7. 退出elasticsearch容器，给http.p12文件赋予777权限

sudo chmod 777 elasticsearch/config/certs/http.p12
  1. 重启elasticsearch容器
docker restart elasticsearch

10.进入容器给elastic用户设置密码，验证https访问
修改密码参考资料

bin/elasticsearch-reset-password -u elastic -i

修改密码示意图
浏览器访问
https://宿主机IP:映射端口

作者这里宿主机IP为192.168.0.100 映射端口为21033
故访问https://192.168.0.100:21033/
访问需要帐号密码进行验证，帐号为elastic 密码为刚刚设置的密码
需要帐号密码验证

登录成功后可看到elasticsearch配置
在这里插入图片描述
11. 复制压缩包（第二步生成的）内kibana文件夹下elasticsearch-ca.pem到kibana的配置文件夹内
12. 配置kibana_system用户的密码
进入elasticsearch容器内，执行下列命令

bin/elasticsearch-reset-password -u kibana_system -i
  1. 生成kibana用https访问的公钥和私钥
./bin/elasticsearch-certutil csr -name kibana-server

会生成一个压缩文件，解压后有一下文件

/kibana-server
|_ kibana-server.csr
|_ kibana-server.key
  1. 将kibana-server.csr和kibana-server.key两个文件拷贝到kibana配置文件夹内
  2. 执行下列命令，生成
openssl  x509 -req -days 3650 -in kibana-server.csr -signkey kibana-server.key -out kibana-server.crt
  1. 打开kibana配置文件kibana.yml，添加和修改以下配置（IP自查）
server.host: "0.0.0.0"
server.shutdownTimeout: "5s"
elasticsearch.hosts: [ "https://172.27.0.2:9200" ]
monitoring.ui.container.elasticsearch.enabled: true
elasticsearch.ssl.certificateAuthorities: ["/usr/share/kibana/config/elasticsearch-ca.pem"]
elasticsearch.username: "kibana_system"
elasticsearch.password: "12步设置的密码"

server.ssl.certificate: "/usr/share/kibana/config/kibana-server.crt"
server.ssl.key: "/usr/share/kibana/config/kibana-server.key"
server.ssl.enabled: true
# 设置中文访问
i18n.locale: "zh-CN"
  1. 给生成的四个文件设置777权限
sudo chmod 777 elasticsearch-ca.pem kibana-server.csr kibana-server.key kibana-server.crt
  1. 重启kibana
  2. 登录kibana控制台验证
    浏览器访问
    https://宿主机IP:映射端口

作者这里宿主机IP为192.168.0.100 映射端口为21041
故访问https://192.168.0.100:21041/
访问需要帐号密码进行验证，帐号为elastic 密码为刚刚设置的密码，登录成功后选择自己浏览
kibana控制台登录页
登录成功标识

配置logstash

  1. 设置elasticsearch内置用户logstash_system密码（上面已经设置过两个用户的密码了，此处就当留一个考点吧）
  2. 生成logstash和elasticsearch之间的安全认证文件（文件elastic-certificates.p12大家还有印象吗？）
#如果设置有密码此命令需要输入密码
openssl pkcs12 -in elasticsearch/config/certs/elastic-certificates.p12 -cacerts -nokeys -chain  -out logstash.pem
  1. 移动logstash.pem文件到logstash配置文件目录下，并设置777权限
sudo chmod 777 logstash.pem
  1. 配置logstash.yml文件
http.host: "0.0.0.0"

xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: logstash_system
xpack.monitoring.elasticsearch.password: 第一步设置的密码

#这里必须用 https 这里必须用 https 这里必须用 https
xpack.monitoring.elasticsearch.hosts: [ "https://172.27.0.2:9200" ]
#你的ca.pem 的所在路径
xpack.monitoring.elasticsearch.ssl.certificate_authority: "/usr/share/logstash/config/logstash.pem"
xpack.monitoring.elasticsearch.ssl.verification_mode: certificate
# 探嗅 es节点，设置为 false
xpack.monitoring.elasticsearch.sniffing: false
  1. 使用kabina配置一个新的elasticsearch用户给logstash使用

在这里插入图片描述
在这里插入图片描述

在这里插入图片描述

在这里插入图片描述
在这里插入图片描述

  1. 在pipeline目录下，增加logstash.conf文件
    配置如下
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  tcp {
    port => 21068
    codec => json_lines
  }
}

output {
  elasticsearch {
    hosts => ["https://172.27.0.2:9200"]
    index => "自定义索引名称-%{+YYYY.MM.dd}"
    user => "自定义用户"
    password => "自定义密码"
    ssl_enabled => true
    ssl_certificate_authorities => ["/usr/share/logstash/config/logstash.pem"]
  }
}
  1. 重启logstash

创建springboot项目进行测试

  1. 在pom文件内添加依赖
       <dependency>
           <groupId>net.logstash.logback</groupId>
           <artifactId>logstash-logback-encoder</artifactId>
           <version>7.4</version>
       </dependency>
  1. 配置logback.xml文件，添加以下appender
    destination配置问logstash的地址，需要哪些数据请自定义。
	<springProperty scope="context" name="appName" source="spring.application.name"/>
    <springProperty scope="context" name="port" source="server.port"/>
    <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>ip:port</destination>
        <encoder class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
            <timestamp>
                <timeZone>Asia/Shanghai</timeZone>
            </timestamp>
            <providers>
                <pattern>
                    <pattern>
                        {
                        "index":"index-%d{yyyy-MM-dd}",
                        "appName":"${appName}",
                        "pid": "${PID:-}",
                        "port":"${port}",
                        "timestamp":"%d{yyyy-MM-dd HH:mm:ss.SSS}",
                        "thread":"%thread",
                        "level":"%level",
                        "class": "%logger",
                        "message": "%message",
                        "stack_trace":"%exception"
                        }
                    </pattern>
                </pattern>
            </providers>
        </encoder>
        <keepAliveDuration>5 minutes</keepAliveDuration>
    </appender>
  1. 将新增加appender的名字添加到root内
    <root level="INFO">
        <appender-ref ref="ERROR"/>
        <appender-ref ref="WARN"/>
        <appender-ref ref="INFO"/>
        <appender-ref ref="DEBUG"/>
        <appender-ref ref="LOGSTASH"/>
        <appender-ref ref="STDOUT"/>
    </root>

4.启动验证

kibana创建视图，查询日志

在这里插入图片描述
在这里插入图片描述
在这里插入图片描述

码农稻草人
关注
  • 1
    点赞
  • 踩
  • 7
    收藏
    觉得还不错? 一键收藏
  • 5
    评论
专栏目录
【云原生 | 59】Docker中通过docker-compose部署ELK
小鹏linux的博客
05-29 1715
各个组件的作用如下： Filebeat：采集文件等日志数据； LogStash：过滤日志数据； Elastic Search：存储、索引日志； Kibana：用户界面；
Elasticsearch 8.x ELK 搭建并配置 SSL
最新发布
换条路吧，编程没意思的~
04-04 917
说明：这只是本人在家里组网搭建的集群，所以内容排版可能比较随意了，没有耐心的同学直接跳过去看别的文章吧，我只是放在这里留作记录方便以后翻阅。为了好看可能我下面会出现多个这种的命令行。
Docker-Compose部署ELK
weixin_44359151的博客
03-04 2635
Docker-Compose部署ELK
docker-compose部署ELK
weixin_48562791的博客
04-17 4707
Docker部署ELK
dockercompose搭建elk
qq_38899062的博客
08-02 6091
Elastic Stack简介 如果你没有听说过Elastic Stack，那你一定听说过ELK，实际上ELK是三款软件的简称，分别是Elasticsearch、 Logstash、Kibana组成，在发展的过程中，又有新成员Beats的加入，所以就形成了Elastic Stack。所以说，ELK是旧的称呼，Elastic Stack是新的名字。 全系的Elastic Stack技术栈包括： Elasticsearch ElasticSearch是一个基于Lucene的搜索服务器。它提供了一个分布式多用
docker生成ssl证书（按步骤来即可，真实可用）
guochengabcd的博客
09-06 2184
docker生成证书
docker-compose搭建ELK
qq_33888850的博客
10-29 132
【代码】docker-compose搭建ELK。
Docker-compose部署ELK的示例代码
09-29
主要介绍了Docker-compose部署ELK的示例代码，文中通过示例代码介绍的非常详细，对大家的学习或者工作具有一定的参考学习价值，需要的朋友们下面随着小编来一起学习学习吧
docker docker-compose部署harbor
08-26
docker docker-compose部署harbor
docker-compose部署配置jenkins的详细教程
01-09
【Docker Compose 部署 Jenkins 知识点详解】 Docker Compose 是一个用于定义和运行多容器 Docker 应用程序的工具。在本教程中，我们将使用 Docker Compose 部署 Jenkins，一个流行的持续集成和持续交付(CI/CD)平台...
使用docker compose搭建一个elk系统的方法
09-30
主要介绍了使用docker-compose搭建一个elk系统的方法，小编觉得挺不错的，现在分享给大家，也给大家做个参考。一起跟随小编过来看看吧
免费SSL证书申请，Docker容器搭建Nginx配置HTTPS
05-18
申请免费的SSL证书，用docker容器搭建Nginx服务端，详细的Nginx配置ssl证书的方法。
利用docker和docker-compose部署单机kafka
01-20
本文将详细介绍如何使用Docker和Docker Compose部署单机版Apache Kafka，以及如何进行测试和验证其工作状态。 1. **Docker基础** Docker是一种流行的容器化技术，它允许我们将应用程序及其依赖环境打包成独立的可...
ruoyi-cloud微服务Linux中docker-compose部署
05-10
ruoyi-cloud微服务Linux中docker-compose部署 博客链接:https://blog.csdn.net/zht3306/article/details/124687425?spm=1001.2014.3001.5501
ELk安装部署
LT19990304的博客
08-10 154
ELK由ElasticSearch、Logstash、Kibana三个根据组成。ES是个开源分布式搜索引擎，它的特点有：分布式，零配置，自动发现，索引自动分片，索引副本机制，restful风格接口，多数据源，自动搜索负载等。Logstash是一个完全开源的工具，可以对日志进行收集、分析、并将其存储供以后使用。kibana也是一个开源和免费的工具，他Kibana可以为Logstash和ES提供的日志分析友好的Web界面，可以帮助您汇总、分析和搜索重要数据日志。
10、全文检索 -- Elasticsearch -- 介绍、下载、安装、配置、开启权限认证、为 Elasticsearch 启用 SSL 和 HTTPS 支持
Java 领域技术分享
02-19 1629
全文检索 -- Elasticsearch -- 介绍、下载、安装、配置、开启权限认证、为 Elasticsearch 启用 SSL 和 HTTPS 支持
ELK日志平台分析（Elasticsearch安装配置+logstash数据采集+Kibana数据可视化+xpack安全验证）
Aimee_c的博客
06-12 4640
文章目录1.Elasticsearch1.1 Elasticsearch介绍1.2 Elasticsearch的安装与配置1.安装软件并修改配置文件2.修改系统限制3.修改systemd启动文件4.elasticsearch插件安装5.更换npm的yum源（要求虚拟机可上网）6.修改es主机ip和端口7.启动head插件8.修改ES跨域主持9.创建索引1.3 配置Elasticsearch集群1.4 Elasticsearch中的节点角色与优化1.Elasticsearch中的节点角色2.Elasticse
Elasticsearch8使用统一的CA为HTTP层更新证书
weixin_42264524的博客
01-22 2110
Elasticsearch8使用统一的CA为HTTP层更新证书
docker-compose部署elk
05-18
Docker-compose 部署 ELK（Elasticsearch、Logstash、Kibana）的步骤如下： 1. 创建一个目录，例如 elk，用于存放 docker-compose.yml 文件和其他配置文件。 2. 在 elk 目录下创建一个 docker-compose.yml 文件，内容如下： ``` version: '3' services: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:7.10.2 container_name: elasticsearch environment: - discovery.type=single-node ports: - "920:920" - "930:930" volumes: - ./elasticsearch/data:/usr/share/elasticsearch/data networks: - elk logstash: image: docker.elastic.co/logstash/logstash:7.10.2 container_name: logstash volumes: - ./logstash/config:/usr/share/logstash/pipeline/ environment: - ELASTICSEARCH_HOSTS=http://elasticsearch:920 ports: - "500:500" - "960:960" networks: - elk kibana: image: docker.elastic.co/kibana/kibana:7.10.2 container_name: kibana environment: - ELASTICSEARCH_HOSTS=http://elasticsearch:920 ports: - "5601:5601" networks: - elk networks: elk: driver: bridge ``` 3. 在 elk 目录下创建一个 elasticsearch 目录，用于存放 Elasticsearch 的数据。 4. 在 elk 目录下创建一个 logstash 目录，用于存放 Logstash 的配置文件。 5. 在 logstash 目录下创建一个 logstash.conf 文件，用于配置 Logstash 的输入、过滤和输出，例如： ``` input { tcp { port => 500 codec => json } } filter { # 过滤器配置 } output { elasticsearch { hosts => ["http://elasticsearch:920"] index => "logstash-%{+YYYY.MM.dd}" } } ``` 6. 在 elk 目录下运行以下命令启动 ELK： ``` docker-compose up -d ``` 7. 访问 http://localhost:5601 即可打开 Kibana 界面，开始使用 ELK。 注意：在生产环境中，应该根据实际需求对 ELK 进行配置和优化，例如设置 Elasticsearch 的内存和磁盘限制、配置 Logstash 的过滤器和输出、使用安全证书等。
评论 5
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值