创建网络名为 elk

127.0.0.1换成服务器ip

docker network create elk

安装 elasticsearch

docker run --name elasticsearch \
--network elk \
-v "$PWD"/esdata:/usr/share/elasticsearch/data \
-e "ES_JAVA_OPTS=-Xms512m -Xmx512m"  \
-p 9200:9200 \
-d elasticsearch

$PWD 表示当前目录

url访问验证, 换成自己服务器ip

http://127.0.0.1:9200

安装 logstash

新建logstash文件夹，并在其下新建config、pipeline两个文件夹
config文件夹下有文件 logstash.yml 、pipelines.yml
pipeline文件夹下有文件logstash.conf

logstash.yml

config:
  reload:
    automatic: true
    interval: 3s
xpack:
  management.enabled: false
  monitoring.enabled: false

pipelines.yml

- pipeline.id: test
  path.config: "/usr/share/logstash/pipeline/logstash-test.conf"

logstash.conf

input {
    file {
        path => ["/usr/share/logstash/logs/*.log"]
        type => "system"
        start_position => "beginning"
    }
}
 
filter {
  mutate {
    gsub => ["message", "\r", ""]
  }
  dissect {
    mapping => {"message" => "%{date} %{+date} [%{task} %{+task}] [%{type}] %{class} - %{info}"}
  }
}
 
output {
    elasticsearch { 
        hosts => ["127.0.0.1:9200"] 
        index => "logstash-%{type}-%{+yyyy.MM.dd}"
        # 由logstash控制ES模板
        template_overwrite => true
        #document_type => "_doc"
        #user => "用户名"
        #password => "密码
    }
    stdout { codec => rubydebug }
}

logstash目录下运行

docker run --rm -it --name logstash \
--network elk \
-v "$PWD"/pipeline:/usr/share/logstash/pipeline   \
-v "$PWD"/config:/usr/share/logstash/config   \
-v "$PWD"/logs:/usr/share/logstash/logs \
-d logstash

安装kibana

新建kibana文件夹，并在其下新建config/kibana.yml文件

server.host: "0.0.0.0"
elasticsearch.url: http://127.0.0.1:9200
xpack:
  apm.ui.enabled: false
  graph.enabled: false
  ml.enabled: false
  monitoring.enabled: false
  reporting.enabled: false
  security.enabled: false
  grokdebugger.enabled: false
  searchprofiler.enabled: false

在kibana文件夹下运行

docker run --name kibana \
--network elk \
-v "$PWD"/config/kibana.yml:/usr/share/kibana/config/kibana.yml  \
-p 5601:5601 \
-d kibana

访问 http://127.0.0.1:5601

新建 Index，可以直接向 Elastic 服务器发出 PUT 请求。下面的例子是新建一个名叫 logstash-system 的 Index

curl -X PUT '127.0.0.1:9200/logstash-system'

$ curl -X PUT 'localhost:9200/weather'