docker部署elk

es1镜像

两个容器 171.111.0.11


172.111.0.12


npm可以不装


l logstash


k 也有


docker安装es1

[root@docker2 es1]# ls

Dockerfile  elasticsearch-6.7.2.rpm  elasticsearch.yml  node-v8.2.1.tar.gz  phantomjs-2.1.1-linux-x86_64.tar.bz2

[root@docker2 es1]# vim Dockerfile

FROM centos:7

RUN rm -rf /etc/yum.repos.d/*

ADD http://mirrors.aliyun.com/repo/Centos-7.repo /etc/yum.repos.d/Centos-7.repo

RUN yum clean all && yum makecache

RUN yum -y install epel-release

RUN yum -y install gcc gcc-c++ make

RUN yum -y install java

RUN yum clean all

COPY elasticsearch-6.7.2.rpm /opt

RUN rpm -ivh /opt/elasticsearch-6.7.2.rpm

COPY elasticsearch.yml /etc/elasticsearch/elasticsearch.yml

EXPOSE 9200

CMD ["/usr/share/elasticsearch/bin/elasticsearch"]

WORKDIR /opt/

ADD node-v8.2.1.tar.gz /opt/

RUN cd node-v8.2.1 \

   && ./configure \

   && make -j 2 \

   && make install

ADD phantomjs-2.1.1-linux-x86_64.tar.bz2 /opt/es1

RUN ln -s /opt/es1/phantomjs-2.1.1-linux-x86_64/bin/phantomjs /usr/local/bin/phantomjs

RUN chown -R elasticsearch:elasticsearch /usr/share/elasticsearch \

   && chown -R elasticsearch:elasticsearch /etc/elasticsearch

USER elasticsearch

[root@docker2 es1]# vim elasticsearch.yml

cluster.name: elk-cluster

node.name: node1

node.master: true

node.data: true

path.data: /var/lib/elasticsearch

path.logs: /var/log/elasticsearch

network.host: 0.0.0.0

http.port: 9200

transport.tcp.port: 9300

discovery.zen.ping.unicast.hosts: ["172.111.0.11","172.111.0.12"]

[root@docker2 es1]# docker build -t es1:elk .

[root@docker2 es1]# docker run -itd --name es1 -p 9200:9200 --net mynetwork --ip 172.111.0.11 es1:elk

58ed4d572bece8ae75ec9be63d5f1335ee9b3e7c0ccfd40ba23909faf4223402

[root@docker2 es1]# docker ps

CONTAINER ID   IMAGE     COMMAND                   CREATED         STATUS         PORTS                                       NAMES

58ed4d572bec   es1:elk   "/usr/share/elastics…"   3 seconds ago   Up 3 seconds   0.0.0.0:9200->9200/tcp, :::9200->9200/tcp   es1

es2镜像

docker创建es2

[root@docker2 es2]# vim elasticsearch.yml

cluster.name: elk-cluster

node.name: node2

node.master: false

node.data: true

path.data: /var/lib/elasticsearch

path.logs: /var/log/elasticsearch

network.host: 0.0.0.0

http.port: 9200

transport.tcp.port: 9300

discovery.zen.ping.unicast.hosts: ["172.111.0.11","172.111.0.12"]

[root@docker2 es2]# vim Dockerfile

FROM centos:7

RUN rm -rf /etc/yum.repos.d/*

ADD http://mirrors.aliyun.com/repo/Centos-7.repo /etc/yum.repos.d/Centos-7.repo

RUN yum clean all && yum makecache

RUN yum -y install epel-release

RUN yum -y install gcc gcc-c++ make

RUN yum -y install java

RUN yum clean all

COPY elasticsearch-6.7.2.rpm /opt

RUN rpm -ivh /opt/elasticsearch-6.7.2.rpm

COPY elasticsearch.yml /etc/elasticsearch/elasticsearch.yml

EXPOSE 9200

CMD ["/usr/share/elasticsearch/bin/elasticsearch"]

WORKDIR /opt/

ADD node-v8.2.1.tar.gz /opt/

RUN cd node-v8.2.1 \

   && ./configure \

   && make -j 2 \

   && make install

ADD phantomjs-2.1.1-linux-x86_64.tar.bz2 /opt/es1

RUN ln -s /opt/es1/phantomjs-2.1.1-linux-x86_64/bin/phantomjs /usr/local/bin/phantomjs

RUN chown -R elasticsearch:elasticsearch /usr/share/elasticsearch \

   && chown -R elasticsearch:elasticsearch /etc/elasticsearch

USER elasticsearch

[root@docker2 es2]# docker build -t es2:elk .

[root@docker2 es1]# docker run -itd --name es2 -p 9201:9200 --net mynetwork --ip 172.111.0.12 es2:elk

logstash镜像

拉取logstash和kibana的v6.7.2版本镜像


docker pull logstash:6.7.2

docker pull kibana:6.7.2

logstash镜像编排


cd /opt/logstash

vim logstash.yml

# 编写yml文件

http.host: "0.0.0.0"

xpack.monitoring.elasticsearch.url: [ "http://es1:9200","http://es2:9201" ]

vim logstash.conf

# 编写 conf 文件，定义输入输出，指定输入之一为宿主机Apache的日志文件

input {

 tcp {

   mode => "server"

   host => "0.0.0.0"

   port => 5044

   codec => "json"

 }

 file {

   path => "/opt/logs/*_log"

   start_position => "beginning"

 }

}

output {

 elasticsearch {

   hosts => [ "http://es1:9200","http://es2:9201" ]

   index => "elk-%{+YYYY.MM.dd}"

 }

}

为了方便，把logstash镜像的权限设置为root，否则宿主机共享过去的Apache日志文件logstash都无权限访问


vim Dockerfile

FROM logstash:6.7.2

USER root

COPY logstash.yml ./config/logstash.yml

COPY logstash.conf ./pipeline/logstash.conf

docker build -t logstash:elk .

docker run -itd --name logstash -v /etc/httpd/logs/:/opt/logs/ --net mynetwork1 --ip 172.111.0.30 -p 5044:5044 -p 9600:9600 logstash:elk

docker exec -it logstash bash

cd /opt/logs/

doc  

访问几次宿主机的Apache服务，并查看Apache的日志文件是否共享到容器内


kibana镜像编排

cd /opt/kibana

vim kibana.yml

server.name: kibana

server.host: "0"

elasticsearch.hosts: [ "http://172.111.0.11:9200","http://172.111.0.12:9201" ]

vim Dockerfile

FROM kibana:6.7.2

COPY kibana.yml ./config/kibana.yml

USER root

RUN chown kibana.kibana ./config/kibana.yml

USER kibana

docker build -t kibana:elk .

docker run -itd --name kibana --net mynetwork --ip 172.111.0.40 -p 5601:5601 kibana:elk

docker exec -it kibana bash

访问kibana的web页面，查看日志数据并建立对应索引