elastic stack安装运行(docker)

https://www.docker.elastic.co

 

elasticsearch

参考
https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html

拉取镜像
docker pull docker.elastic.co/elasticsearch/elasticsearch:7.2.0

查看命令
docker inspect docker.elastic.co/elasticsearch/elasticsearch:7.2.0

mkdir /opt/elasticsearch -p
vim /opt/elasticsearch/Dockerfile

FROM docker.elastic.co/elasticsearch/elasticsearch:7.2.0
EXPOSE 9200
EXPOSE 9300

 

 

mkdir /opt/elasticsearch/usr/share/elasticsearch/data/ -p
cat /etc/passwd
data及其子目录(-R)赋予权限，否则无法写入数据
chown 1000:1000 -R /opt/elasticsearch/usr/share/elasticsearch/data/

chown 1000:1000 -R /opt/elasticsearch/usr/share/elasticsearch/logs/

 

vim /opt/elasticsearch/docker-compose.yml

version: '2.2'
services:
  elasticsearch:
    image: elasticsearch
    restart: always
    container_name: elasticsearch
    build: 
      context: .
      dockerfile: Dockerfile
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      - cluster.name=docker-cluster
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - network.host=0.0.0.0
      - http.cors.enabled=true
      - http.cors.allow-origin=*
      - ES_JAVA_OPTS=-Xms256m -Xmx256m
    ulimits:
      memlock:
        soft: -1
        hard: -1
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:9200"]
      retries: 300
      interval: 1s
    volumes: 
      - ./usr/share/elasticsearch/data/:/usr/share/elasticsearch/data
      - ./usr/share/elasticsearch/logs:/usr/share/elasticsearch/logs

 

也可以用先写好配置文件的方式

version: '2.2'
services:
  elasticsearch:
    image: elasticsearch
    restart: always
    container_name: elasticsearch
    build: 
      context: .
      dockerfile: Dockerfile
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      - ES_JAVA_OPTS=-Xms256m -Xmx256m
    ulimits:
      memlock:
        soft: -1
        hard: -1
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:9200"]
      retries: 300
      interval: 1s
    volumes: 
      - ./usr/share/elasticsearch/data/:/usr/share/elasticsearch/data
      - ./usr/share/elasticsearch/logs:/usr/share/elasticsearch/logs
      - ./usr/share/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml

 

配置文件参考：
https://github.com/elastic/elasticsearch-docker/tree/master/.tedi/template
https://www.elastic.co/guide/en/elasticsearch/reference/current/bootstrap-checks.html
https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-xpack.html

mkdir -p /opt/elasticsearch/usr/share/elasticsearch/config/
vim /opt/elasticsearch/usr/share/elasticsearch/config/elasticsearch.yml

---
discovery.type: single-node
bootstrap.memory_lock: true
cluster.name: docker-cluster
network.host: 0.0.0.0
http.cors.enabled: true
http.cors.allow-origin: "*"
http.cors.allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE
http.cors.allow-headers: "X-Requested-With, Content-Type, Content-Length, X-User"

 

ES的密码管理是用x-pack来实现的
默认账户为elastic默认密码为changme
这里省略掉x-pack

cd /opt/elasticsearch
docker-compose build
docker-compose up -d --force-recreate
docker-compose down
docker-compose restart

查看日志
docker logs --tail="500" elasticsearch

检查状态
curl http://127.0.0.1:9200/_cat/health

netstat -anltp|grep 9200

进入容器
docker exec -it elasticsearch /bin/bash

检查容器
docker exec -it elasticsearch /bin/bash /usr/share/elasticsearch/bin/elasticsearch --help
docker exec -it elasticsearch /bin/bash /usr/share/elasticsearch/bin/elasticsearch --version

复制配置文件
docker cp elasticsearch:/usr/share/elasticsearch/config/elasticsearch.yml /opt/elasticsearch/elasticsearch_bak.yml

 

-----------------------------------

elasticsearch-head

 

mkdir /opt/elasticsearch-head -p
vim /opt/elasticsearch-head/Dockerfile

FROM mobz/elasticsearch-head:5
EXPOSE 9100

vim /opt/elasticsearch-head/docker-compose.yml

version: '2.2'
services:
  elasticsearch-head: 
    image: elasticsearch-head
    restart: always
    container_name: elasticsearch-head
    build: 
      context: .
      dockerfile: Dockerfile
    ports: 
      - 9100:9100

 

cd /opt/elasticsearch-head
docker-compose build
docker-compose up -d --force-recreate
docker-compose down
docker-compose restart

查看日志
docker logs --tail="500" elasticsearch-head

netstat -anltp|grep 9100

进入容器
docker exec -it elasticsearch-head /bin/bash

检查容器
docker exec -it elasticsearch-head /bin/bash /usr/share/elasticsearch-head/bin/elasticsearch-head --help
docker exec -it elasticsearch-head /bin/bash /usr/share/elasticsearch-head/bin/elasticsearch-head --version

导出配置文件
docker cp elasticsearch-head:/usr/src/app/Gruntfile.js /opt/elasticsearch-head/Gruntfile_bak.js
docker cp elasticsearch-head:/usr/src/app/_site/app.js /opt/elasticsearch-head/app_bak.js

------------------------------------

kibana

 

https://www.elastic.co/guide/en/kibana/current/docker.html

docker pull docker.elastic.co/kibana/kibana:7.2.0

docker inspect docker.elastic.co/kibana/kibana:7.2.0

mkdir /opt/kibana -p
vim /opt/kibana/Dockerfile

FROM docker.elastic.co/kibana/kibana:7.2.0
EXPOSE 5601

vim /opt/kibana/docker-compose.yml

version: '2.2'
services:
  kibana:
    image: kibana
    restart: always
    container_name: kibana
    build: 
      context: .
      dockerfile: Dockerfile
    environment:
      - SERVER_NAME=kibana
      - SERVER_HOST=0.0.0.0
      - ELASTICSEARCH_HOSTS=http://192.168.1.101:9200
      - KIBANA_DEFAULTAPPID=discover
      - I18N_LOCALE=zh-CN
    network_mode: host
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:5601"]
      retries: 300
      interval: 1s
    ports:
      - 5601:5601

也可以用先写好配置文件的方式

vim /opt/kibana/docker-compose.yml

version: '2.2'
services:
  kibana:
    image: kibana
    restart: always
    container_name: kibana
    build: 
      context: .
      dockerfile: Dockerfile
    network_mode: host
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:5601"]
      retries: 300
      interval: 1s
    ports:
      - 5601:5601
    volumes: 
      - ./usr/share/kibana/config/kibana.yml:/usr/share/kibana/config/kibana.yml

 

mkdir -p /opt/kibana/usr/share/kibana/config/
vim /opt/kibana/usr/share/kibana/config/kibana.yml

server.name: kibana
server.host: "0.0.0.0"
elasticsearch.hosts: [ "http://192.168.101:9200" ]
kibana.defaultAppId: discover
i18n.locale: zh-CN
xpack.monitoring.ui.container.elasticsearch.enabled: true

 

cd /opt/kibana
docker-compose build
docker-compose up -d --force-recreate
docker-compose down
docker-compose restart

查看日志
docker logs --tail="500" kibana

检查状态
curl http://192.168.1.101:5601/_cat/health

netstat -anltp|grep 5601

进入容器
docker exec -it kibana /bin/bash

检查容器
docker exec -it kibana /bin/bash /usr/share/kibana/bin/kibana --help
docker exec -it kibana /bin/bash /usr/share/kibana/bin/kibana --version

复制配置文件
docker cp kibana:/usr/share/kibana/config/kibana.yml /opt/kibana/kibana_bak.yml

 

------------------------

logstash

 

参考
https://www.elastic.co/guide/en/logstash/current/docker.html
https://www.elastic.co/guide/en/logstash/current/docker-config.html

docker pull docker.elastic.co/logstash/logstash:7.2.0

docker inspect docker.elastic.co/logstash/logstash:7.2.0

 

mkdir /opt/logstash -p
vim /opt/logstash/Dockerfile

jdk8

FROM openjdk:8 AS jdk
FROM docker.elastic.co/logstash/logstash:7.2.0
COPY --from=jdk /usr/local/openjdk-8 /usr/local
ENV JAVA_HOME=/usr/local/openjdk-8
ENV PATH=$JAVA_HOME/bin:$PATH
ENV CLASSPATH=.:$JAVA_HOME/lib/dt.jar:$JAVA_HOME/lib/tools.jar
EXPOSE 9600
EXPOSE 5044

内置jdk会抛警告

FROM docker.elastic.co/logstash/logstash:7.2.0
EXPOSE 9600
EXPOSE 5044

vim /opt/logstash/docker-compose.yml

version: '2.2'
services:
  logstash:
    image: logstash
    restart: always
    container_name: logstash
    build: 
      context: .
      dockerfile: Dockerfile
    environment:
      - PATH_DATA=/usr/share/logstash/data
      - XPACK_MONITORING_ELASTICSEARCH_HOSTS=http://192.168.1.101:9200
      - XPACK_MONITORING_ENABLED=false
    ports:
      - 9600:9600
      - 5044:5044
    network_mode: host
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:9600/_node/stats"]
      retries: 300
      interval: 1s
    volumes: 
      - ./usr/share/logstash/pipeline/logstash1.conf:/usr/share/logstash/pipeline1/logstash.conf

command: ./bin/logstash -f ./pipeline/logstash.conf --path.data=./data

挂载data目录会报错
volumes:
- ./usr/share/logstash/data/:/usr/share/logstash/data/

也可以用先写好配置文件的方式

vim /opt/logstash/docker-compose.yml

version: '2.2'
services:
  logstash:
    image: logstash
    restart: always
    container_name: logstash
    build: 
      context: .
      dockerfile: Dockerfile
    ports:
      - 9600:9600
      - 5044:5044
    network_mode: host
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:9600/_node/stats"]
      retries: 300
      interval: 1s
    volumes: 
      - ./usr/share/logstash/pipeline/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
      - ./usr/share/logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml

command: ./bin/logstash -f ./pipeline/logstash.conf --path.data=./data

挂载data目录会报错
volumes:
- ./usr/share/logstash/data:/usr/share/logstash/data

mkdir -p /opt/logstash/usr/share/logstash/config/
vim /opt/logstash/usr/share/logstash/config/logstash.yml

http.host: 0.0.0.0
path.data: /usr/share/logstash/data1
xpack.monitoring.elasticsearch.hosts: [ "http://192.168.1.101:9200" ]
xpack.monitoring.enabled: false

vim /opt/logstash/usr/share/logstash/pipeline/logstash.conf

input{
        stdin{
        }
}
output {
        elasticsearch {
                hosts => "192.168.1.101:9200"
        }
}

input{
    stdin{
    }
}
output {
    elasticsearch {
        hosts => "192.168.1.101:9200"
        user => "elastic"
        password => "changeme"
    }
}

input{stdin{}}output{stdout{codec=>rubydebug}}

input{stdin{}}output{stdout{codec=>json_lines}}

input {
  beats {
    port => 5044
  }
}
output {
  stdout {
    codec => rubydebug
  }
}

 

cd /opt/logstash
docker-compose build
docker-compose up -d --force-recreate
docker-compose down
docker-compose restart

查看日志
docker logs --tail="500" logstash
docker logs -f logstash

进入容器
docker exec -it logstash /bin/bash

检查容器
docker exec -it logstash /bin/bash /usr/share/logstash/bin/logstash --help
docker exec -it logstash /bin/bash /usr/share/logstash/bin/logstash --version

netstat -anltp|grep 9600
netstat -anltp|grep 5044

复制配置文件
docker cp logstash:/usr/share/logstash/config/logstash.yml /opt/logstash/logstash_bak.yml
docker cp logstash:/usr/share/logstash/pipeline/logstash.conf /opt/logstash/logstash_bak.conf

测试
数据放data1以另一个实例运行
docker exec -it logstash /bin/bash /usr/share/logstash/bin/logstash --path.data=./data1 -e 'input{stdin{}}output{stdout{codec=>rubydebug}}'
docker exec -it logstash /bin/bash /usr/share/logstash/bin/logstash --path.data=./data1 -e 'input{stdin{}}output{stdout{codec=>json_lines}}'
docker exec -it logstash /bin/bash /usr/share/logstash/bin/logstash --path.data=./data1 -e 'input{stdin{}}output{elasticsearch{hosts=>"192.168.1.101:9200"}}'

 

----------------------------
Filebeat

 

docker pull docker.elastic.co/beats/filebeat:7.2.0

docker inspect docker.elastic.co/beats/filebeat:7.2.0

参考
https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html

mkdir /opt/filebeat -p
vim /opt/filebeat/Dockerfile

FROM docker.elastic.co/beats/filebeat:7.2.0

vim /opt/filebeat/docker-compose.yml

version: '2.2'
services:
  filebeat:
    image: filebeat
    restart: always
    container_name: filebeat
    build: 
      context: .
      dockerfile: Dockerfile
    network_mode: host
    volumes: 
      - ./usr/share/filebeat/data/:/usr/share/filebeat/data/
      - ./usr/share/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml

 

mkdir /opt/filebeat/usr/share/filebeat -p
vim /opt/filebeat/usr/share/filebeat/filebeat.yml

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false
processors:
- add_cloud_metadata: ~
output.elasticsearch:
  hosts: '${ELASTICSEARCH_HOSTS:192.168.1.101:9200}'
  username: '${ELASTICSEARCH_USERNAME:}'
  password: '${ELASTICSEARCH_PASSWORD:}'

output.elasticsearch:
  hosts: ["192.168.1.101:9200"]

output.logstash:
  hosts: ["192.168.1.101:5044"]

 

cd /opt/filebeat
docker-compose build
docker-compose up -d --force-recreate
docker-compose down
docker-compose restart

查看日志
docker logs --tail="500" filebeat
docker logs -f filebeat

进入容器
docker exec -it filebeat /bin/bash

检查容器
docker exec -it filebeat /bin/bash /usr/share/filebeat/bin/filebeat --help
docker exec -it filebeat /bin/bash /usr/share/filebeat/bin/filebeat --version

复制配置文件
docker cp filebeat:/usr/share/filebeat/filebeat.yml /opt/filebeat/filebeat_bak.yml

 

---------------------------------------

apm-server

 

docker pull docker.elastic.co/apm/apm-server:7.2.0

docker inspect docker.elastic.co/apm/apm-server:7.2.0

参考
https://www.elastic.co/guide/en/apm/server/current/running-on-docker.html

mkdir /opt/apm-server -p
vim /opt/apm-server/Dockerfile

FROM docker.elastic.co/apm/apm-server:7.2.0
EXPOSE 8200

 

docker-compose参考
https://github.com/elastic/apm-server/blob/master/tests/docker-compose.yml

vim /opt/apm-server/docker-compose.yml

version: '2.2'
services:
  apm-server:
    image: apm-server
    restart: always
    container_name: apm-server
    build: 
      context: .
      dockerfile: Dockerfile
    environment:
      - output.elasticsearch.hosts=['http://192.168.1.101:9200']
      - apm-server.host="0.0.0.0:8200"
      - setup.kibana.host="192.168.1.101:5601"
    network_mode: host
    ports:
      - 8200:8200
    healthcheck:
      test: ["CMD", "curl", "-f" ,"http://127.0.0.1:8200/"]

command: apm-server -e -d "*" -E apm-server.host="0.0.0.0:8200" -E apm-server.expvar.enabled=true -E output.elasticsearch.hosts=['http://192.168.1.101:9200']

volumes:
- ./usr/share/apm-server/apm-server.yml:/usr/share/apm-server/apm-server.yml

volumes:
- ./usr/share/apm-server/data:/usr/share/apm-server/data:ro

cd /opt/apm-server
docker-compose build
docker-compose up -d --force-recreate
docker-compose down
docker-compose restart

查看日志
docker logs --tail="500" apm-server
docker logs -f apm-server

进入容器
docker exec -it apm-server /bin/bash

检查容器
docker exec -it apm-server /bin/bash /usr/share/apm-server/bin/apm-server --help
docker exec -it apm-server /bin/bash /usr/share/apm-server/bin/apm-server --version

复制配置文件
docker cp apm-server:/usr/share/apm-server/apm-server.yml /opt/apm-server/apm-server_bak.yml

转载于:https://www.cnblogs.com/wintersoft/p/11213475.html