ELK的docker简单部署实验

https://www.elastic.co

ELK是啥：

E：Elasticsearch        # 对数据进行搜索、分析和存储
L：Logstash             # 动态数据收集管道 同类软件：flime
K：Kibana               # 实现数据可视化

# Beats                 # 轻量型采集器的平台

类似架构：

hbase + impala + solr
hbase + phoenix

北京用ELK作服务的公司：

日志易
splunk

Docker Hub 下载链接

# Elasticsearch 6.6.1

# This image re-bundles the Docker image from the upstream provider, Elastic. 
FROM docker.elastic.co/elasticsearch/elasticsearch:6.6.1@sha256:b3c3863bfef1bdc79ebb55e61a5f140b397cc6406638b42b7b624ef9742bece3

# The upstream image was built by:
#   https://github.com/elastic/dockerfiles/tree/v6.6.1/elasticsearch

# For a full list of supported images and tags visit https://www.docker.elastic.co

# For Elasticsearch documentation visit https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html

# See https://github.com/docker-library/official-images/pull/4916 for more details.

# Kibana 6.6.1

# This image re-bundles the Docker image from the upstream provider, Elastic. 
FROM docker.elastic.co/kibana/kibana:6.6.1@sha256:237e44f395b21fc285985a65ba373228d07ccfa1971ebac3a4dc851a573f149f

# The upstream image was built by:
#   https://github.com/elastic/kibana-docker/tree/6.6.1

# For a full list of supported images and tags visit https://www.docker.elastic.co

# For Elasticsearch documentation visit https://www.elastic.co/guide/en/kibana/reference/current/docker.html

# See https://github.com/docker-library/official-images/pull/4917 for more details.

# Logstash 6.6.1

# This image re-bundles the Docker image from the upstream provider, Elastic.
FROM docker.elastic.co/logstash/logstash:6.6.1@sha256:717891aea5030345ed2ca635b8e363578630a69fd1b906abe2bcc634a4a126b5

# The upstream image was built by:
#   https://github.com/elastic/logstash-docker/tree/6.6.1

# For a full list of supported images and tags visit https://www.docker.elastic.co

# For Logstash documentation visit https://www.elastic.co/guide/en/logstash/current/docker.html

# See https://github.com/docker-library/official-images/pull/5039 for more details.

使用 docker pull 命令获取镜像后再 docker tag 打上标签就可以使用了。

1. Docker 部署 ElasticSearch

1.1 拉取镜像：

docker pull docker.elastic.co/elasticsearch/elasticsearch:6.6.1

1.2 运行容器

在elasticsearch的docker版本文档中，官方提到了vm.max_map_count的值在生产环境最少要设置成262144。设置的方式有两种

永久性的修改,在/etc/sysctl.conf文件中添加一行：

grep vm.max_map_count /etc/sysctl.conf # 查找当前的值。

vm.max_map_count=262144 # 修改或者新增

正在运行的机器：

sysctl -w vm.max_map_count=262144

ElasticSearch的默认端口是9200，我们把宿主环境9200端口映射到Docker容器中的9200端口，就可以访问到Docker容器中的ElasticSearch服务了，同时我们把这个容器命名为es。

docker run --rm -d -p 9200:9200 -p 9300:9300 --name elasticsearch -e "discovery.type=single-node" docker.elastic.co/elasticsearch/elasticsearch:6.6.1 

使用web访问192.168.99.100:9200即可测试服务是否启动。

1.3 配置跨域

进入容器：由于要进行配置，因此需要进入容器当中修改相