简介
ELK 8+ 由于 SSL 和 xpack security 策略导致单机搭建 ELK 较为困难,此处给出 docker-compose
文件,直接运行即可搭建成功
运行环境
运行环境:Ubuntu 22.0.0 LTS,ELK 8.7.1,Docker 27.2.0
compose 文件
services:
elasticsearch:
image: elasticsearch:8.7.1
container_name: elasticsearch
environment:
- node.name=es01
- cluster.name=es-cluster
- discovery.type=single-node
- xpack.security.enabled=false
- xpack.ml.enabled=false
- xpack.watcher.enabled=false
- xpack.graph.enabled=false
ports:
- "9200:9200"
- "9300:9300"
networks:
- elk
logstash:
image: logstash:8.7.1
container_name: logstash
environment:
- xpack.monitoring.enabled=false
ports:
- "5044:5044"
networks:
- elk
volumes:
- ./logstash/config/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
kibana:
image: kibana:8.7.1
container_name: kibana
environment:
- ELASTICSEARCH_HOSTS=http://elasticsearch:9200
- xpack.security.enabled=false
ports:
- "5601:5601"
networks:
- elk
networks:
elk:
driver: bridge
logstash 配置文件
input {
tcp {
mode => "server"
host => "0.0.0.0"
port => 5670
codec => json_lines
}
}
filter {
}
output {
elasticsearch {
hosts => ["http://elasticsearch:9200"]
index => "logstash-%{+yyyy.MM.dd}"
}
}