git 專案地址
https://github.com/Gekkoou/docker-elk

目錄結構

├── elasticsearch                      elasticsearch目錄
│   └── es                             es目錄
│       │── config                     es配置目錄
│       │   │── elasticsearch.yml      es配置檔案
│       │   │── jvm.options            es配置檔案
│       │   └── log4j2.
 
properties      es配置檔案
│       │── data                       data目錄
│       │── logs                       logs目錄
│       └── plugins                    plugins目錄
│           └── ik                     ik分詞
│── log                                log目錄
│   └── nginx_access.log               nginx日誌(測試用)
│── logstash                           logstash目錄
│   │── config                         logstash配置目錄
│   │   │── log4j2.
 
properties          logstash配置檔案
│   │   │── logstash.yml               logstash配置檔案
│   │   └── logstash-nginx.conf        logstash配置檔案
│   │── data                           data目錄
│   └── logs                           logs目錄
└── docker-compose.yml                 docker-compose配置檔案

使用

1. 安裝 docker
   和 docker-compose
2. git clone 程式碼到本地
   
$ git clone [email protected]:Gekkoou/docker-elk.git

3. 執行命令 (Ubuntu為例)
   
$ cd docker-elk
$ sudo sysctl -w vm.max_map_count=262144
$ sudo chmod 777 log
$ sudo chmod 777 ./logstash/logs
$ sudo chmod 777 ./logstash/data
$ docker-compose up -d


開啟 chrome 外掛 ElasticSearch Head 檢視詳情, 或瀏覽器訪問 localhost:5601 進入 Kibana 介面進行操作

本例子通過 logstash 讀取 nginx_access.log 日誌, 過濾後輸出到 elasticsearch
可自行更改 logstash/config/logstash-nginx.conf 程式碼和 docker-compose.yml 中 logstash 的 command 命令

es叢集

elasticsearch 目錄下存有 es1 es2 目錄, 可開啟叢集
docker-compose.yml 去除 es1 es2 相關注釋
elasticsearch/es/config/elasticsearch.yml 去除註釋
docker-compose up -d 啟動
es 與 es1 為 master 節點, es2 為 data 節點

docker-compose.yml

version: "2"
services:
  es:
    image: elasticsearch:5.6.9-alpine
    container_name: es
    environment:
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    ports:
      - "9200:9200"
      - "9300:9300"
    volumes:
      - ./elasticsearch/es/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro
      - ./elasticsearch/es/config/jvm.options:/usr/share/elasticsearch/config/jvm.options:ro
      - ./elasticsearch/es/config/log4j2.properties:/usr/share/elasticsearch/config/log4j2.properties:ro
      - ./elasticsearch/es/data/:/usr/share/elasticsearch/data/:rw
      - ./elasticsearch/es/logs/:/usr/share/elasticsearch/logs/:rw
      - ./elasticsearch/es/plugins/:/usr/share/elasticsearch/plugins/:rw
    networks:
      - net-elk
  logstash:
    image: logstash:5.6.9-alpine
    container_name: logstash
    volumes:
      - ./logstash/config/log4j2.properties:/usr/share/logstash/config/log4j2.properties:ro
      - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml:ro
      - ./logstash/config/logstash-nginx.conf:/usr/share/logstash/config/logstash-nginx.conf:ro
      - ./logstash/data/:/usr/share/logstash/data/:rw
      - ./logstash/logs/:/usr/share/logstash/logs/:rw
      - ./log/:/var/log/logstash/:rw
    command: logstash -f /usr/share/logstash/config/logstash-nginx.conf
    depends_on:
      - es
    networks:
      - net-elk
  kibana:
    image: kibana:5.6.9
    container_name: kibana
    environment:
      - "ELASTICSEARCH_URL=http://es:9200"
    ports:
      - "5601:5601"
    depends_on:
      - es
    networks:
      - net-elk
networks:
  net-elk: