基于Docker安装部署ELK版本7.17.3

Elasticsearch安装

1. 下载Elasticsearch7.17.3的docker镜像

docker pull elasticsearch:7.17.3

2. 修改虚拟内存区域大小，否则会因为过小而无法启动:

sysctl -w vm.max_map_count=262144

3. 创建Elasticsearch 相关挂载目录

mkdir -p /data/elasticsearch/config
mkdir -p /data/elasticsearch/data
mkdir -p /data/elasticsearch/plugins

4. 创建文件

vi /data/elasticsearch/config/elasticsearch.yml

5. elasticsearch.yml如下内容：

http.host: 0.0.0.0
http.cors.enabled: true
http.cors.allow-origin: "*"
http.cors.allow-headers: Authorization
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true

6. 设置目录权限，否则会报错

cd /data/elasticsearch/
chmod +x config/elasticsearch.yml

7. 使用如下命令启动Elasticsearch服务，内存小的服务器可以通过ES_JAVA_OPTS来设置占用内存大小：

docker run -p 9200:9200 -p 9300:9300 --name elasticsearch \
-e "discovery.type=single-node" \
-e "cluster.name=elasticsearch" \
-e "ES_JAVA_OPTS=-Xms512m -Xmx1024m" \
-v /etc/localtime:/etc/localtime \
-v /data/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
-v /data/elasticsearch/plugins:/usr/share/elasticsearch/plugins \
-v /data/elasticsearch/data:/usr/share/elasticsearch/data \
--restart=always \
-d elasticsearch:7.17.3

8. 启动时如果发现/usr/share/elasticsearch/data目录没有访问权限，只需要修改/data/elasticsearch/data目录的权限，再重新启动即可；

chmod 777 /data/elasticsearch/data/

9. 安装中文分词器IKAnalyzer，注意下载与Elasticsearch对应的版本，下载地址：https://github.com/medcl/elasticsearch-analysis-ik/releases
   
10. 创建存放目录：

cd /data/elasticsearch/plugins
mkdir elasticsearch-analysis-ik

11. 下载完成后解压到Elasticsearch的/data/elasticsearch/plugins/elasticsearch-analysis-ik目录下；
    

12. 重新启动服务：

docker restart elasticsearch

13. 进入运行elasticsearch的docker容器：

docker exec -it elasticsearch  /bin/bash

14. 配置访问es密码步骤

./bin/elasticsearch-setup-passwords interactive

15. 开启防火墙：

firewall-cmd --zone=public --add-port=9200/tcp --permanent
firewall-cmd --reload

Logstash安装

1. 下载Logstash7.17.3的docker镜像：

docker pull logstash:7.17.3

2. 创建Logstash 相关挂载目录:

mkdir /data/logstash

3. 创建Logstash的配置文件logstash.conf

cd /data/logstash
touch logstash.conf
vim logstash.conf

4. 放入一下内容：配置文件logstash.conf中output节点下的Elasticsearch连接地址为es:9200

	input {
	  tcp {
		mode => "server"
		host => "0.0.0.0"
		port => 4560
		codec => json_lines
		type => "debug"
	  }
	  tcp {
		mode => "server"
		host => "0.0.0.0"
		port => 4561
		codec => json_lines
		type => "error"
	  }
	  tcp {
		mode => "server"
		host => "0.0.0.0"
		port => 4562
		codec => json_lines
		type => "business"
	  }
	  tcp {
		mode => "server"
		host => "0.0.0.0"
		port => 4563
		codec => json_lines
		type => "record"
	  }
	}
	filter{
	  if [type] == "record" {
		mutate {
		  remove_field => "port"
		  remove_field => "host"
		  remove_field => "@version"
		}
		json {
		  source => "message"
		  remove_field => ["message"]
		}
	  }
	}
	output {
	  elasticsearch {
		hosts => "es:9200"
		index => "%{project}-%{service}"
		user => "elastic"
		password => "**********"
	  }
	}

5.创建创建Logstash的配置文件logstash.yml.

cd /data/logstash
touch logstash.yml
vim logstash.yml

6.logstash.yml文件内容：

http.host: "0.0.0.0"
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: elastic
xpack.monitoring.elasticsearch.password: *****
xpack.monitoring.elasticsearch.hosts: [ "http://elasticsearch:9200" ]

在logstash.yml中配置用户名和密码
xpack.monitoring.elasticsearch.username: elastic
xpack.monitoring.elasticsearch.password: *****
账号密码为es初始化中设置的密码

7. 启动logstash ：

docker run --name logstash -p 4560:4560 -p 4561:4561 -p 4562:4562 -p 4563:4563 \
--link elasticsearch:es \
-v /etc/localtime:/etc/localtime \
-v /data/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml \
-v /data/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf \
--restart=always \
-d logstash:7.17.3

8. 进入容器内部，安装json_lines插件。

docker exec -it logstash /bin/bash
logstash-plugin install logstash-codec-json_lines

Kibana安装

1. 下载Kibana7.17.3的docker镜像：

docker pull kibana:7.17.3

2. 创建kibana挂载的相关目录：

mkdir -p /data/kibana

3. 创建kibana的配置文件kibana.yml

cd /data/kibana
touch kibana.yml
vim kibana.yml

4. kibana.yml文件内容：

server.host: "0.0.0.0"
server.shutdownTimeout: "5s"
elasticsearch.hosts: [ "http://elasticsearch:9200" ]
elasticsearch.username: "elastic"
elasticsearch.password: "*****"
i18n.locale: "zh-CN"

在kibana.yml中配置用户名和密码
elasticsearch.username: “elastic”
elasticsearch.password: “*****”
账号密码为es初始化中设置的密码
重启kibana
输入http://ip:5601打开登录页面，使用elastic账号登录.

5. 使用如下命令启动Kibana服务：

docker run --name kibana -p 5601:5601 \
--link elasticsearch:es \
-e "elasticsearch.hosts=http://es:9200" \
-v /etc/localtime:/etc/localtime \
-v /data/kibana/kibana.yml:/usr/share/kibana/config/kibana.yml \
--restart=always \
-d kibana:7.17.3

6. 开启防火墙：

firewall-cmd --zone=public --add-port=5601/tcp --permanent
firewall-cmd --reload

访问地址进行测试：http://ip:5601

Analytics-->Discover-->mall-suite*