利用 docker-compose 无痛搭建单机 ELK 8+

简介

 ELK 8+ 由于 SSL 和 xpack security 策略导致单机搭建 ELK 较为困难，此处给出 docker-compose 
 文件，直接运行即可搭建成功

运行环境

运行环境：Ubuntu 22.0.0 LTS，ELK 8.7.1，Docker 27.2.0

compose 文件

services:
  elasticsearch:
    image: elasticsearch:8.7.1
    container_name: elasticsearch
    environment:
      - node.name=es01
      - cluster.name=es-cluster
      - discovery.type=single-node
      - xpack.security.enabled=false
      - xpack.ml.enabled=false
      - xpack.watcher.enabled=false
      - xpack.graph.enabled=false
    ports:
      - "9200:9200"
      - "9300:9300"
    networks:
      - elk

  logstash:
    image: logstash:8.7.1
    container_name: logstash
    environment:
      - xpack.monitoring.enabled=false
    ports:
      - "5044:5044"
    networks:
      - elk
    volumes:
      - ./logstash/config/logstash.conf:/usr/share/logstash/pipeline/logstash.conf

  kibana:
    image: kibana:8.7.1
    container_name: kibana
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - xpack.security.enabled=false
    ports:
      - "5601:5601"
    networks:
      - elk

networks:
  elk:
    driver: bridge

logstash 配置文件

input {
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 5670
    codec => json_lines
  }
}

filter {
}

output {
  elasticsearch {
    hosts => ["http://elasticsearch:9200"]
    index => "logstash-%{+yyyy.MM.dd}"
  }
}