EFK日志系统搭建

最新推荐文章于 2025-09-01 14:23:48 发布

原创最新推荐文章于 2025-09-01 14:23:48 发布 · 270 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#docker

运维相关专栏收录该内容

13 篇文章

订阅专栏

本文详细介绍了如何从镜像开始，依次安装Elasticsearch、Kibana，并配置跨域、安全和分词，同时部署Filebeat收集日志并同步到Elasticsearch。最后，通过Docker Compose管理工具整合并设置权限。

安装 elasticsearch-7.8.0

pull 镜像命令如下:

docker pull elasticsearch:7.8.0

启动

docker run --name elasticsearch -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" -d elasticsearch:7.8.0

检查es是否安装完成是否有进程

docker ps -a

修改配置，解决跨域问题，进入容器找到elasticsearch.yml

#进入容器
docker exec -it elasticsearch /bin/bash
#修改配置文件
cd /usr/share/elasticsearch/config/
vi elasticsearch.yml
#添加配置
http.cors.enabled: true

http.cors.allow-origin: "*"

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
#退出
esc :q
exit

安装ik分词器命令如下

cd /usr/share/elasticsearch/plugins/

elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v7.8.0/elasticsearch-analysis-ik-7.8.0.zip

重启容器

docker restart elasticsearch

设置密码

docker exec -it elasticsearch /bin/bash
cd bin/
./elasticsearch-setup-passwords interactive

安装kibana-7.8.0

安装kibana

docker pull kibana:7.8.0

初始化启动

docker run --name kibana --link=elasticsearch:test -p 5601:5601 -d kibana:7.8.0
docker start kibana

配置es

docker exec -it kibana /bin/bash
cd config/
cat kibana.yml 
#修改host

server:
  name: kibana
  host: 0.0.0.0
  port: 5601
elasticsearch:
  hosts: ["http://192.168.13.1:9200"]
  username: kibana
  password: xxxxx
i18n:
  locale: zh-CN
xpack:
  reporting:
    encryptionKey: 2221xx
  security:
    encryptionKey: xxxx
kibana:
  index: .kibana

配置x-pack

curl  -H "Content-Type: application/json"   -XPUT http://localhost:9200/_cluster/settings -d '{
  "persistent" : {
    "xpack" : {
      "monitoring" : {
        "collection" : {
          "enabled" : "true"
        }
      }
    }
  }
}'

安装filebeat-7.8.0

下载filebeat 7.8.0
修改配置文件

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /mnt/data/aliplatform/community-portalcenter/logs/stdout.log
  fields:
    service_name: community-service-test

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup:
  ilm:
    enabled: false
  template:
    name: filebeat-community-log
    pattern: filebeat-community-log-*
    overwrite: true
    enabled: true
    settings:
      index:
        number_of_shards: 1
        number_of_replicas: 0
        codec: best_compression
        lifecycle:
          name: filebeat-community-log
          rollover_alias: filebeat-community-log

output.elasticsearch:
  hosts: ["192.168.13.99:9200"]
  username: "elastic"
  password: "xxxx"
  index: "filebeat-community-log-%{[fields.service_name]}-%{+yyyy.MM.dd}"

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

安装docker管理工具 docker portainer

拉取镜像
```
docker pull portainer/portainer
```

创建并运行

docker run -d -p 9000:9000 -v /root/portainer:/data -v /var/run/docker.sock:/var/run/docker.sock --name dev-portainer portainer/portainer

访问端口设置密码
单机版这里选择local, 点击Connect进行连接即可