docker快速部署ELK日志系统

docker快速部署

# 1.创建虚拟网络
docker network create elk

#2.创建elasticsearch
docker run  --name elasticsearch  -e  ES_JAVA_OPTS="-Xms512m -Xmx512m" -e "discovery.type=single-node" --net=elk  -d -p 10092:9200 -p 10093:9300 elasticsearch:7.12.1

#3.查看网络
sudo docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' elasticsearch

#4.创建 kibana
sudo docker run -d --name kibana --net elk -p 10256:5601 kibana:7.12.1

logf4j config配置

input {
    tcp {
        port => 3456
        codec => "json"
    }
}
output {

    elasticsearch { hosts => ["172.18.0.2:9200"] } #docker虚拟网络的ip地址
  stdout { codec => rubydebug }
}   

启动logstash

docker run  --name logstash  -d \
            -v /data/logstash/config:/config-dir \
            -p 10345:3456 \
            --net elk \
            logstash:7.12.1 \
            logstash -f /data/logstash/config/logstash.conf
            
            

配置数据源

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.12.1-linux-x86_64.tar.gz
tar xzvf filebeat-7.12.1-linux-x86_64.tar.gz


#修改 filebeat.yml 以设置连接信息：

output.elasticsearch:
  hosts: ["<es_url>"] #172.20.0.2:9200
  username: "elastic"
  password: "<password>" 
setup.kibana:
  host: "<kibana_url>"#172.20.0.4:5601
  
  

#启动
./filebeat modules enable kibana


#setup 命令加载 Kibana 仪表板。如果仪表板已设置，请省略此命令。
./filebeat setup
./filebeat -e