docker-compose部署elk

前言

略

部署配置

]# mkdir -p /data/elasticsearch
]# chown -R 1000:1000 /data/elasticsearch
]# mkdir -p /data/deploy/{elasticsearch,kibana,logstash}
]# cat > /data/deploy/elasticsearch/elasticsearch.yml <<-EOF
cluster.name: "docker-cluster"
network.host: 0.0.0.0
xpack.security.enabled: true
http.cors.enabled: true
http.cors.allow-origin: "*"
indices.breaker.total.use_real_memory: false
indices.breaker.total.limit: 60%
indices.fielddata.cache.size: 45%
indices.requests.cache.size: 20%
indices.breaker.fielddata.limit: 35%
indices.breaker.request.limit: 50%
network.breaker.inflight_requests.limit: 50%
indices.breaker.accounting.limit: 50%
EOF
]# cat > /data/deploy/kibana/kibana.yml <<EOF
server.name: kibana
server.host: "0"
elasticsearch.hosts: [ "http://elasticsearch:9200" ]
elasticsearch.username: "kibana"
elasticsearch.password: "oZcatxhfn1H8c21Nj6FI"
xpack.monitoring.ui.container.elasticsearch.enabled: true
EOF
]# cat > /data/deploy/logstash/logstash.yml <<-EOF
xpack:
  monitoring:
    enabled: true
    elasticsearch:
      hosts: elasticsearch:9200
      username: logstash_system
      password: "LwXkNpFtcjrgsGoomupP"
EOF      
]# cat > /data/deploy/elasticsearch/docker-compose.yaml <<-EOF
version: "3.5"
services:
  elasticsearch:
    image: elasticsearch:7.6.1
    container_name: elasticsearch
    hostname: elasticsearch
    privileged: true
    user: root
    ports:
      - 9200:9200
      - 9300:9300
    environment:
      - "discovery.type=single-node"
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - /data/deploy/elasticsearch/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
      - /data/elasticsearch:/usr/share/elasticsearch/data
    restart: always

  kibana:
    image: kibana:7.6.1
    container_name: kibana
    hostname: kibana
    links:
      - elasticsearch
    ports:
      - 5601:5601
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - /data/deploy/kibana/kibana.yml:/usr/share/kibana/config/kibana.yml:ro
    restart: always

  logstash:
    image: logstash:7.6.1
    container_name: logstash
    hostname: logstash
    links:
      - elasticsearch
    ports:
      - 4560:4560
      - 9600:9600
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - /data/deploy/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml:ro
    restart: always
EOF

获取es中各kibana、logstash等用户的密码

]# docker exec -it elasticsearch /bin/bash
]# elasticsearch-setup-passwords auto
Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user.
The passwords will be randomly generated and printed to the console.
Please confirm that you would like to continue [y/N]y	# 输入y


Changed password for user apm_system
PASSWORD apm_system = Qv75riLm0mN2heTY1Dzm

Changed password for user kibana
PASSWORD kibana = oZcatxhfn1H8c21Nj6FI

Changed password for user logstash_system
PASSWORD logstash_system = LwXkNpFtcjrgsGoomupP

Changed password for user beats_system
PASSWORD beats_system = t7i70lDSAD4XS9HHhEkz

Changed password for user remote_monitoring_user
PASSWORD remote_monitoring_user = PgZUx0ocdZjkJ2zCiVNr

Changed password for user elastic
PASSWORD elastic = hnfuYScCe8nX2R3aHGIK

将对应的kibana、logstash账户密码填入kibana.yml、logstash.yml文件中，后重启kibana、logstash服务

docker restart kibana
docker restart logstash

结语

… …