elastic
拉取镜像:
docker pull docker.elastic.co/elasticsearch/elasticsearch:7.8.0
启动docker:
docker run --name elasticsearch --net elastic -p 9200:9200 -p 9300:9300 -it docker.elastic.co/elasticsearch/elasticsearch:7.8.0
启动报错:
max virtual memory areas vm.max_map_count [65530] is too low, increase to at least [262144]
系统虚拟内存默认最大映射数为65530,无法满足ES系统要求,需要调整为262144以上。
解决:设置vm.max_map_count参数
#修改文件
sudo vim /etc/sysctl.conf
#添加参数
vm.max_map_count = 262144
#重新加载/etc/sysctl.conf配置
sysctl -p
再次启动报错:
the default discovery settings are unsuitable for production use; at least one of [discovery.seed_hosts, discovery.seed_providers, cluster.initial_master_nodes] must be configured
-缺少默认配置,至少需要配置discovery.seed_hosts、discovery.seed_providers、cluster.initial_master_nodes中的一个参数
解决:
在虚拟机w'n创建elasticsearch.yml文件,
并添加配置
cluster.name: "docker-cluster"
network.host: 0.0.0.0
# 访问ID限定,0.0.0.0为不限制,生产环境请设置为固定IP
transport.host: 0.0.0.0
# elasticsearch节点名称
node.name: node-1
# elasticsearch节点信息
cluster.initial_master_nodes: ["node-1"]
# 下面的配置是关闭跨域验证
http.cors.enabled: true
http.cors.allow-origin: "*"
再次启动 使用创建的配置文件:
注意修改配置文件路径
docker run -di -p 9200:9200 -p 9300:9300 --name=elasticsearch -v /usr/liuzl/elk/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml docker.elastic.co/elasticsearch/elasticsearch:7.8.0
kinba:
拉取镜像:
docker pull kibana:7.8.0
创建配置文件kibana.yml
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://20.20.30.61:9200"]
# 操作界面语言设置
i18n.locale: "zh-CN"
启动kibana:
注意修改配置文件路径
docker run -di --name kibana -p 5601:5601 -v /usr/liuzl/elk/kibana.yml:/usr/share/kibana/config/kibana.yml kibana:7.8.0
logstash:
拉取镜像:
docker pull logstash:7.8.0
启动:
docker run -itd --name logstash -p 5044:5044 logstash:7.8.0
拷贝出logstash的配置文件:
docker cp logstash:/usr/share/logstash/pipeline/logstash.conf /usr/liuzl/elk/logstash.conf
docker cp logstash:/usr/share/logstash/config/logstash.yml /usr/liuzl/elk/logstash.yml
修改配置文件:
logstash.conf
input {
beats {
port => 5044
}
}
output {
stdout {
codec => rubydebug
}
elasticsearch {
hosts => ["elasticIP:9200"]
user => "elastic"
password => "changeme"
}
}
logstash.yml
http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.hosts: [ "http://elastic IP:9200" ]
重启
docker run -itd --name logstash -p 5044:5044 -e "ELASTICSEARCH_HOSTS=http://20.20.30.61:9200" -v /usr/liuzl/elk/logstash.yml:/usr/share/logstash/config/logstash.yml -v /usr/liuzl/elk/logstash.conf:/usr/share/logstash/pipeline/logstash.conf logstash:7.8.0