Ubuntu docker 安装elk

Elasticsearch安装

打开终端
1.代码全套
docker pull elasticsearch:7.6.2

2.运行,运行之后会出现数字和字母的话

docker run --restart=always -p 9200:9200 -p 9300:9300 --name elasticsearch \
-e "discovery.type=single-node" \
-e "cluster.name=elasticsearch" \
-e ES_JAVA_OPTS="-Xms512m -Xmx512m" \
-v /mydata/elasticsearch/plugins:/usr/share/elasticsearch/plugins \
-v /mydata/elasticsearch/data:/usr/share/elasticsearch/data \
-d elasticsearch:7.6.2

3.给目录权限
chmod 777 /mydata/elasticsearch/data/

安装插件中文分词器IKAnalyzer
docker exec -it elasticsearch /bin/bash
此命令需要在容器中运行
elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v7.6.2/elasticsearch-analysis-ik-7.6.2.zip
exit

docker restart elasticsearch
4.开放9200端口
sudo iptables -I INPUT -p tcp --dport 9200 -j ACCEPT

5.访问127.0.0.1:9200

如图成功

安装Logstash

1.打开终端

docker pull logstash:7.6.2

2.创建/mydata/logstash目录，并创建配置文件 logstash.conf

mkdir /mydata/logstash

3.然后进入logstash文件夹里面,使用命令

su
输入密码
vi logstash.conf

4.拷贝如下配置到 logstash.conf

input {
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4560
    codec => json_lines
    type => "debug"
  }
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4561
    codec => json_lines
    type => "error"
  }
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4562
    codec => json_lines
    type => "business"
  }
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4563
    codec => json_lines
    type => "record"
  }
}
filter{
  if [type] == "record" {
    mutate {
      remove_field => "port"
      remove_field => "host"
      remove_field => "@version"
    }
    json {
      source => "message"
      remove_field => ["message"]
    }
  }
}
output {
  elasticsearch {
    hosts => "es:9200"
    index => "mall-%{type}-%{+YYYY.MM.dd}"
  }
}

5.启动
docker run --restart=always --name logstash -p 4560:4560 -p 4561:4561 -p 4562:4562 -p 4563:4563
–link elasticsearch:es
-v /mydata/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
-d logstash:7.6.2
如果出错如下

这个是因为出现上述的错误，是因为docker容器里面已经存在，如果不需要，则删除。docker rm fb087642b497(该containerID)
如果想要再次使用，使用

docker restart 镜像名

则可以重启该容器。

6.安装json_lines插件
docker exec -it logstash /bin/bash
此命令需要在容器中运行
logstash-plugin install logstash-codec-json_lines
exit
docker restart logstash

安装Kibana

1.打开终端
docker pull kibana:7.6.2

2.启动
docker run --restart=always --name kibana -p 5601:5601
–link elasticsearch:es
-e “elasticsearch.hosts=http://es:9200”
-d kibana:7.6.2

3.开放5601端口
sudo iptables -I INPUT -p tcp --dport 5601 -j ACCEPT

4.安装完成访问http://127.0.0.1:5601/
完成!!!撒花撒花