docker部署elk

1镜像版本
kibana 6.8.2 docker pull kibana:6.8.2
elasticsearch 6.8.2 docker pull elasticsearch：6.8.2
logstash 6.8.2 docker pull logstash:6.8.2
elasticsearch-head:5 docker pull mobz/elasticsearch-head
docker pull registry.cn-hongkong.aliyuncs.com/hyn-beats/filebeat:6.5.4
docker run -d -p 9100:9100 docker.io/mobz/elasticsearch-head:5
2 启动镜像
docker run -d -p 9200:9200 -p 9300:9300 --name elasticsearch -e “discovery.type=single-node” elasticsearch:6.8.2
docker run -d -p 5601:5601 --link elasticsearch -e ELASTICSEARCH_URL=http://elasticsearch:9200 kibana:6.8.2
docker run -it --name logstash --link elasticsearch -d -p 5044:5044 -v
/var/log/nginx/access_applet.log:/usr/share/logstash/access_applet.log logstash:6.8.2

* 生产环境中可将各组件配置数据挂载出来，方便备份
* 挂载日志时请注意日志文件权限
* 启动logstash时 使用命令验证conf文件

logstash --path.settings /usr/share/logstash/config/ -f /usr/share/logstash/pipeline/logstash.conf --config.test_and_exit
–path.settings 指定config
-f 指定.conf文件
–config.test_and_exit 验证完不启动
logstash.conf 配置
input{
file {
path => “/usr/share/nginx.log”
type => “nginx-access-log”
start_position => “beginning”
stat_interval => “2”
}
}
output{
elasticsearch{
hosts =>[“192.168.1.64:9200”]
index =>“nginx-access-log-%{+YYYY.MM.dd}.log”
}
}
3验证