5分钟快速搭建ELK

一时失言乱红尘 2023-01-01 10:55 212阅读 0赞

##### （1）ES开发环境安装 #####

docker run -d --name elasticsearch  -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" elasticsearch:7.2.0

##### （2）ES生产集群安装 #####

1：创建docker-compose.yml文件

version: '2.2'
    services:
      es01:
        image: docker.elastic.co/elasticsearch/elasticsearch:7.5.2
        container_name: es01
        environment:
          - node.name=es01
          - cluster.name=es-docker-cluster
          - discovery.seed_hosts=es02,es03
          - cluster.initial_master_nodes=es01,es02,es03
          - bootstrap.memory_lock=true
          - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
        ulimits:
          memlock:
            soft: -1
            hard: -1
        volumes:
          - data01:/usr/share/elasticsearch/data
        ports:
          - 9200:9200
        networks:
          - elastic
      es02:
        image: docker.elastic.co/elasticsearch/elasticsearch:7.5.2
        container_name: es02
        environment:
          - node.name=es02
          - cluster.name=es-docker-cluster
          - discovery.seed_hosts=es01,es03
          - cluster.initial_master_nodes=es01,es02,es03
          - bootstrap.memory_lock=true
          - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
        ulimits:
          memlock:
            soft: -1
            hard: -1
        volumes:
          - data02:/usr/share/elasticsearch/data
        networks:
          - elastic
      es03:
        image: docker.elastic.co/elasticsearch/elasticsearch:7.5.2
        container_name: es03
        environment:
          - node.name=es03
          - cluster.name=es-docker-cluster
          - discovery.seed_hosts=es01,es02
          - cluster.initial_master_nodes=es01,es02,es03
          - bootstrap.memory_lock=true
          - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
        ulimits:
          memlock:
            soft: -1
            hard: -1
        volumes:
          - data03:/usr/share/elasticsearch/data
        networks:
          - elastic
    
    volumes:
      data01:
        driver: local
      data02:
        driver: local
      data03:
        driver: local
    
    networks:
      elastic:
        driver: bridge

运行docker-compose up

测试  
curl -X GET “localhost:9200/\_cat/nodes?v&pretty”

参考文档：  
https://www.elastic.co/guide/en/elasticsearch/reference/7.5/docker.html\#docker-compose-file

##### （3）ES安装IK分词器 #####

下载地址:  
https://github.com/medcl/elasticsearch-analysis-ik/releases  
下载后转移到服务器上  
通过docker cp 复制到容器内 /usr/share/elasticsearch/plugins 就是这个位置,别乱放

docker cp /XXX/analysis-ik 容器ID:/usr/share/elasticsearch/plugins

复制完后，重启即可

##### （4）Kibana #####

创建宿主目录  
/etc/kibana/config  
![在这里插入图片描述][20210102104944668.png]

Kibana.yml配置内容

server.name: kibana
    server.host: "0"
    elasticsearch.hosts: [ "http://172.17.0.17:9200" ]
    xpack.monitoring.ui.container.elasticsearch.enabled: true

docker运行

docker run -di --name=kibana  -p 5601:5601 -v /etc/kibana/config:/usr/share/kibana/config kibana:7.2.0

##### （5）安装logstash #####

![在这里插入图片描述][20210102105034540.png]

docker pull logstash:7.2.0
    
    docker run -di --name=logstash -v /etc/logstash/config:/usr/share/logstash/config -v /etc/logstash/pipeline:/usr/share/logstash/pipeline docker.elastic.co/logstash/logstash:7.2.0

logstash的安装需要根据实际业务需求配置

input { 
      tcp{ 
        port => 5044
        codec => json_lines
      }
    }
    
    filter { 
            json{ 
                source => "message"
                target => "message"
            }
    }
    output { 
      elasticsearch { 
        hosts => ["http://172.17.0.17:9200"]
        index  => "logstash-%{+YYYY.MM.dd}"
        #user => "elastic"
        #password => "changeme"
      }
      stdout {  codec => rubydebug }
    }

[20210102104944668.png]: /images/20221120/2980984cee5f46af925fe3a9a7620778.png
[20210102105034540.png]: /images/20221120/b3db7a225d8d4641af52f3baa712cdcb.png