docker部署elk監控runtime日志 # 第1章 官方地址 ``` https://www.elastic.co/guide/en/elasticsearch/reference/6.3/docker.html https://www.elastic.co/guide/en/kibana/current/docker.html https://hub.docker.com/r/alivv/elasticsearch-head/ ``` # 第2章 部署步驟 ## 2.1 下載需要的鏡像 需要注意的是es的官方鏡像國內下載不了,需要翻墻下載 es鏡像 docker pull docker.elastic.co/elasticsearch/elasticsearch-oss:6.3.0 kibana鏡像 docker pull docker.elastic.co/kibana/kibana-oss:6.3.0 es-head插件鏡像 docker pull alivv/elasticsearch-head ## 2.2 docker-compose啟動管理文件 ``` version: '2.2' services: elasticsearch: image: elasticsearch:v2 container_name: elasticsearch environment: - cluster.name=docker-cluster - bootstrap.memory_lock=true - "ES_JAVA_OPTS=-Xms512m -Xmx512m" - "discovery.zen.ping.unicast.hosts=elasticsearch" ulimits: memlock: soft: -1 hard: -1 volumes: - /data/docker_es_data:/usr/share/elasticsearch/data ports: - 9200:9200 networks: - esnet elasticsearch-head: image: elasticsearch-head:v1 container_name: elasticsearch-head ports: - 9100:9100 networks: - esnet kibana: image: kibana:v1 container_name: kibana environment: - ELASTICSEARCH_URL="http://elasticsearch:9200" - kibana.index=".kibana" ports: - 5601:5601 networks: - esnet networks: esnet: ``` ## 2.3 需要修改的地方 官方鏡像的es配置里并沒有并沒有提供head插件訪問的訪問的而配置項,需要自己添加然后重新build鏡像,在es的配置文件elasticsearch.yml里添加如下兩行 ``` http.cors.enabled: true http.cors.allow-origin: "*" ``` 編寫Dockerfile文件 ``` FROM docker.elastic.co/elasticsearch/elasticsearch:6.3.0 COPY --chown=elasticsearch:elasticsearch elasticsearch.yml /usr/share/elasticsearch/config/ ``` 重新bulid鏡像 ``` docker build --tag=elasticsearch-custom . docker run -ti -v /usr/share/elasticsearch/data elasticsearch-custom ``` ## 2.4 filebeat安裝 直接使用官方提供的deb安裝包安裝即可,需要注意軟件版本需要和es以及kibana一致 ## 2.5 filebeat配置文件 ``` filebeat.prospectors: - type: log enabled: true paths: - /www/log/runtime.log json.keys_under_root: true json.overwrite_keys: true filebeat.config.modules: path: ${path.config}/modules.d/*.yml reload.enabled: false setup.template.settings: index.number_of_shards: 3 setup.kibana: output.elasticsearch: hosts: ["192.168.47.100:9200"] index: "runtime-%{+yyyy.MM}" setup.template: name: 'runtime' pattern: 'runtime-*' enabled: false ``` ansible elk_cluster -m shell -a "echo vm.max_map_count=262144 >> /etc/sysctl.conf && sysctl -p" 數據目錄權限需要 775 ``` chmod 0775 /data/docker_es_data/ ```