环境

主机ip 192.168.0.9

docker version 19.03.2

docker-compose version 1.24.0-rc1

elasticsearch version 6.6.1

kibana version 6.6.1

logstash version 6.6.1

一、elk-dockerfile文件编写及配置文件

● elasticsearch

1、elasticsearch-dockerfile

? 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 from centos:latest add elasticsearch-6.6.1.tar.gz /usr/local/ copy elasticsearch.yml /usr/local/elasticsearch-6.6.1/config/ copy jdk1.8 /usr/local/ env java_home=/usr/local/jdk1.8 env classpath=$classpath:$java_home/lib:$java_home/jre/lib env path=$java_home/bin:$java_home/jre/bin:$path:$home/bin run groupadd elsearch && \ useradd elsearch -g elsearch -p elasticsearch && \ chown -r elsearch:elsearch /usr/local/elasticsearch-6.6.1 && \ cp /usr/share/zoneinfo/asia/shanghai /etc/localtime && \ echo "asia/shanghai" > /etc/timezone && \ yum install which -y && \ mkdir /opt/data && \ mkdir /opt/logs expose 9200 9300 #主要是切换到elsearch用户启动es user elsearch workdir /usr/local/elasticsearch-6.6.1/bin/ entrypoint ["./elasticsearch"]

2、elasticsearch.yml

? 1 2 3 4 5 6 7 8 9 10 11 12 [root@localhost elasticsearch]# egrep "^[^#]" elasticsearch.yml cluster.name: es-cluster node.name: node-1 path.data: /opt/data path.logs: /opt/logs network.host: 0.0.0.0 http.port: 9200 cluster.routing.allocation.disk.threshold_enabled: true cluster.routing.allocation.disk.watermark.low: 94% cluster.routing.allocation.disk.watermark.high: 96% cluster.routing.allocation.disk.watermark.flood_stage: 98% discovery.zen.minimum_master_nodes: 1

● logstash

1、logstash-dockerfile

? 1 2 3 4 5 6 7 8 9 10 11 12 13 from centos:latest add logstash-6.6.1.tar.gz /usr/local/ copy logstash.yml /usr/local/logstash-6.6.1/config/ copy logstash.conf /usr/local/logstash-6.6.1/config/ copy jdk1.8 /usr/local/ copy start.sh /start.sh env java_home=/usr/local/jdk1.8 env classpath=$classpath:$java_home/lib:$java_home/jre/lib env path=$java_home/bin:$java_home/jre/bin:$path:$home/bin run mkdir /opt/data && \ mkdir /opt/logs && \ chmod +x /start.sh entrypoint ["/start.sh"]

2、logstash-start.sh

? 1 2 #!/bin/bash /usr/local/logstash-6.6.1/bin/logstash -f /usr/local/logstash-6.6.1/config/logstash.conf

3、logstash.yml

? 1 2 3 4 [root@localhost logstash]# egrep "^[^#]" logstash.yml path.data: /opt/data path.logs: /opt/logs pipeline.batch.size: 200

4、logstash.conf

? 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 input { file { path => "/usr/local/nginx/logs/access.log" type => "nginx" start_position => "beginning" sincedb_path => "/dev/null" } file { path => "/var/log/secure" type => "secure" start_position => "beginning" sincedb_path => "/dev/null" } } #详细说明可以查看我之前的博客 filter { grok { match => { "message" => '(?<clientip>[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}) - - (?<requesttime>\[[0-9]{1,2}\/[a-z]+\/[0-9]{4}\:[0-9]{2}\:[0-9]{2}\:[0-9]{2} \+[0-9]*\]) "(?<requesttype>[a-z]+) (?<requesturl>[^ ]+) (?<requestv>http/\d\.\d)" (?<requestnode>[0-9]+) (?<requestsize>[0-9]+) "(?<content>[^ ]|(http|https)://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/)" "(?<ua>(a-z|0-9| |.)+)"' } remove_field => ["message","log","beat","offset","prospector","host","@version"] } } #output指向es容器 output { if [type] == "nginx" { elasticsearch { hosts => ["es:9200"] index => "nginx-%{+yyyy.mm.dd}" } } else if [type] == "secure" { elasticsearch { hosts => ["es:9200"] index => "secure-%{+yyyy.mm.dd}" } } }

● kibana

1、kibana-dockerfile

? 1 2 3 4 5 6 7 from centos:latest add kibana-6.6.1-linux-x86_64.tar.gz /usr/local/ copy kibana.yml /usr/local/kibana-6.6.1-linux-x86_64/config/ copy start.sh /start.sh run chmod +x /start.sh expose 5601 entrypoint ["/start.sh"]

2、kibana.yml

? 1 2 3 4 5 [root@localhost kibana]# egrep "^[^#]" kibana.yml server.port: 5601 server.host: "0.0.0.0" #指向es容器的9200端口 elasticsearch.hosts: ["http://es:9200"]

3、kibana-start.sh

? 1 2 #!/bin/bash /usr/local/kibana-6.6.1-linux-x86_64/bin/kibana

二、docker-compose,yml文件编写

? 1 [root@localhost elk_dockerfile]# cat docker-compose.yml ? 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 version: '3.7' services: elasticsearch: image: elasticsearch:elk container_name: es networks: - elk volumes: - /opt/data:/opt/data - /opt/logs:/opt/logs expose: - 9200 - 9300 restart: always depends_on: - logstash - kibana logstash: image: logstash:elk container_name: logstash networks: - elk volumes: - /opt/logstash/data/:/op/data - /opt/logstash/logs/:/opt/logs - /opt/elk/elk_dockerfile/logstash/logstash.conf:/usr/local/logstash-6.6.1/config/logstash.conf - /usr/local/nginx/logs:/usr/local/nginx/logs - /var/log/secure:/var/log/secure restart: always kibana: image: kibana:elk container_name: kibana ports: - 5601:5601 networks: - elk volumes: - /opt/elk/elk_dockerfile/kibana/kibana.yml:/usr/local/kibana-6.6.1-linux-x86_64/config/kibana.yml networks: elk:

compose文件version版本指向

三、访问界面

以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持服务器之家。

原文链接：https://blog.51cto.com/13760226/2438738