安装docker环境

参考我之前写的博客
https://blog.csdn.net/qq_41980563/article/details/88362801

安装elk

官方下载地址https://www.elastic.co/downloads

1. 安装elasticsearch和head插件
   docker pull docker.elastic.co/elasticsearch/elasticsearch:6.6.1
   docker pull mobz/elasticsearch-head:5
2. 安装kibana
   docker pull docker.elastic.co/kibana/kibana:6.6.1
3. 安装logstash
   docker pull docker.elastic.co/logstash/logstash:6.6.1
4. 在需要获取日志的服务器上安装filebeat
   docker pull docker.elastic.co/beats/filebeat:6.6.1

配置elk

1. 配置elasticsearch
   docker pull docker.elastic.co/elasticsearch/elasticsearch:6.6.1

cluster.name: mycs-es
node.name: node-1
path.data: /usr/share/elasticsearch/data/
network.host: 0.0.0.0
http.port: 9200
transport.tcp.port: 9300
http.cors.enabled: true
http.cors.allow-origin: "*"

2. 配置kibana

server.port: 5601
server.host: "0.0.0.0"
elasticsearch.url: "http://192.168.10.201:9200"

3.配置logstash

http.host: "0.0.0.0"

4.这几个容器都是用指定用户启动的，都是uid和gid为1000的用户，可以chown 1000:1000 -R *或者创建一个uid和gid为1000的用户，再把这几个文件的属组改为这个用户。
groupadd -g 1000 elk
useradd -u 1000 -g 1000 elk
chown elk. -R *

编写docker-compose.yml,把配置文件和es数据目录挂载进去

#author menard 2019-2-28
version: '2.2'
networks:
  elknet:
    ipam:
      config:
      - subnet: 172.11.0.0/24
        gateway: 172.11.0.1

services:

  es-head:
    image: "mobz/elasticsearch-head:5"
    hostname: es-head
    container_name: es-head
    restart: always
    ports:
     - '9100:9100'
    networks:
      elknet:
        ipv4_address: 172.11.0.2

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.6.1
    container_name: elasticsearch
    hostname: elasticsearch
    environment:
      #- cluster.name=mycs-es
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - /path/es-data/:/usr/share/elasticsearch/data/
      - /path/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml
    ports:
      - 9200:9200
      - 9300:9300
    networks:
      elknet:
        ipv4_address: 172.11.0.3

  kibana:
    image: docker.elastic.co/kibana/kibana:6.6.1
    container_name: kibana
    hostname: kibana
    volumes:
      - /path/kibana.yml:/usr/share/kibana/config/kibana.yml
    ports:
      - 5601:5601
    networks:
      elknet:
        ipv4_address: 172.11.0.4

  logstash:
    image: docker.elastic.co/logstash/logstash:6.6.1
    container_name: logstash
    hostname: logstash
    volumes:
      - /path/logstash.yml:/usr/share/logstash/config/logstash.yml
      - /path/logstash-etc/:/etc/logstash/
    ports:
      - 5044:5044
    networks:
      elknet:
        ipv4_address: 172.11.0.5

启动elk

1.docker-compose up -d启动容器

2.浏览器输入ip:9200访问

2.浏览器输入ip:9100访问head插件
3.浏览器输入ip:5601访问kibana

下一篇：数据收集传输过滤filebeat+logstash的配置
其他篇：elasticsearch设置密码