ELK安装说明

最新推荐文章于 2025-06-01 10:19:08 发布

原创最新推荐文章于 2025-06-01 10:19:08 发布 · 168 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#数据分析 #log分析

数据分析专栏收录该内容

1 篇文章

订阅专栏

本文详细介绍如何使用Docker及docker-compose配置ELK Stack（Elasticsearch、Logstash、Kibana），包括环境搭建、配置文件修改及常见问题解决。

Docker

请参看文档

安装注意:

版本号大于 1.13.0
mac上安装需要使用全局代理

Elasticsearch&Logstash&Kibana安装

使用docker-compose安装
新建docker-compose.yml,内容如下

version: '3.0'
services:
  elasticsearchm:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.5.1
    container_name: elasticsearch
    ports:
      - "9200:9200"
      - "9300:9300"
    volumes:
      - ./Elasticsearch/data:/etc/elasticsearch/data
      - ./Elasticsearch/config/elasticsearch.yml:/etc/elasticsearch/config/elasticsearch.yml
    tty : true

  kibana:
    image: docker.elastic.co/kibana/kibana:6.5.1
    container_name: kibana
    environment:
      XPACK_SECURITY_ENABLED: 'False'
      ELASTICSEARCH_URL: 'http://elasticsearch_host:9200'
    volumes:
      - esdata1:/usr/share/kibana/data
    ports:
      - 5601:5601
    networks:
      - esnet


  logstash:
    image: docker.elastic.co/logstash/logstash:6.5.1
    container_name: logstash
    environment:
      XPACK_MONITORING_ENABLED: 'False'
    ports:
      - 5044:5044
    links:
      - elasticsearchm
    volumes:
      - /usr/share/logstash/pipeline:/usr/share/logstash/pipeline
    command: logstash -f /usr/share/logstash/pipeline/logstash.conf

volumes:
  esdata1:
    driver: local
  esdata2:
    driver: local


networks:
  esnet:

logstash配置
新建/usr/share/logstash/pipeline/logstash.conf内容如下

input {
 beats {
    port => "5044"
    ssl => false
 }
}

filter {
    grok {
        match => { "message" => "\[%{TIMESTAMP_ISO8601:request_time}\]\[%{WORD:logid}\]\[%{DATA:person}\]\[%{DATA:data_type}\] *%{GREEDYDATA:info}"}
    }
    geoip {
        source => "clientip"
    }
}

output {
  elasticsearch {
    hosts => "elasticsearchm:9200"
    manage_template => false
    index => "logstash-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

命令行执行

docker-compose up

坑：

提示：max virtual memory areas vm.max_map_count [65530] is too low
解决：

临时性解决：sysctl -w vm.max_map_count=262144
永久解决：/etc/sysctl.conf中添加"vm.max_map_count=262144"