大道至简之ELKF日志分析搭建

最新推荐文章于 2024-04-10 23:37:25 发布

后端大佬-明哥哥

最新推荐文章于 2024-04-10 23:37:25 发布

阅读量177

点赞数

分类专栏： docker Golang linux 文章标签： elasticsearch docker logstash kibana filebeat

本文链接：https://blog.csdn.net/qq_45722923/article/details/129857810

版权

ELKF日志分析架构

搭建
kibana日志分析
- es索引
- 同步日志

搭建

目录结构

在这里插入图片描述

docker compose

version: '3.7'

services:
  elasticsearch:
    image: elasticsearch:7.17.9
    container_name: es
    volumes:
      - ./es/plugins:/usr/share/elasticsearch/plugins 
      - ./es/data:/usr/share/elasticsearch/data
      - ./es/logs:/usr/share/elasticsearch/logs
      - ./es/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml
    ports:
      - '9200:9200'
      - '9300:9300'
    environment:
      - TZ=Asia/Shanghai
      - 'cluster.name=elasticsearch'
      - 'discovery.type=single-node'
      - 'ES_JAVA_OPTS=-Xms1024m -Xmx1024m'
    networks:
      - elk
    ulimits:
      memlock:
        soft: -1
        hard: -1
    
  logstash:
    image: logstash:7.17.9
    container_name: logstash
    volumes:
      - ./lg/config/pipelines.yml:/usr/share/logstash/config/pipelines.yml
      - ./lg/config/logstash.yml:/usr/share/logstash/config/logstash.yml
      - ./lg/pipeline/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
    ports:
      - 5044:5044
      - 9600:9600
    environment:
      LS_JAVA_OPTS: -Xms1024m -Xmx1024m
      TZ: Asia/Shanghai
    networks:
      - elk
    ulimits:
      memlock:
        soft: -1
        hard: -1