使用docker-compose在docker环境中部署elk

• docker-compose.yml

  version: '3.8'
  services:
    elasticsearch:
      image: docker.elastic.co/elasticsearch/elasticsearch:7.14.0
      container_name: elasticsearch
      environment:
        - discovery.type=single-node
      ulimits:
        memlock:
          soft: -1
          hard: -1
      mem_limit: 2g
      volumes:
        - elasticsearch-data:/usr/share/elasticsearch/data
      ports:
        - 9200:9200
        - 9300:9300
  
    logstash:
      image: docker.elastic.co/logstash/logstash:7.14.0
      container_name: logstash
      volumes:
        - ./logstash/config/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
        - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml
      ports:
        - 5044:5044
  
    kibana:
      image: docker.elastic.co/kibana/kibana:7.14.0
      container_name: kibana
      environment:
        - ELASTICSEARCH_URL=http://172.20.171.2:9200
      ports:
        - 5601:5601
  
  volumes:
    elasticsearch-data:
  

下面是在docker-compose.yml配置中需要挂载的配置文件：
注意：文中“http://172.20.171.2:9200”是我的es的地址，需要全部更换掉

• logstash.conf

  input {
    tcp {
      port => 5044
      codec => json_lines
    }
  }
  
  output {
    elasticsearch {
      hosts => ["http://172.20.171.2:9200"]
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
      #user => "elastic"
      #password => "changeme"
    }
  }
  

• logstash.yml

  http.host: "0.0.0.0"
  xpack.monitoring.elasticsearch.hosts: [ "http://172.20.171.2:9200" ]
  

• 在docker-compose.yml文件目录执行

  docker-compose up -d
  

tips：对于这种需要网络传输的服务，能走内网就走内网，效率会更高，我这里也是配置的内网地址