基於elastic官方docker映象、版本5.5.1

一、目錄結構

二、ELK的docker映象安裝

1、docker-compose.yml

version: '2'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:5.5.1
    environment:
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    volumes:
      - $PWD/elasticsearch/data:/usr/share/elasticsearch/data
 
    container_name: elasticsearch551
    hostname: elasticsearch
    restart: always
    ports:
      - "9200:9200"
      - "9300:9300"
  kibana:
    image: docker.elastic.co/kibana/kibana:5.5.1
    environment:
      - ELASTICSEARCH_URL=http://elasticsearch:9200
    container_name: kibana551
    hostname: kibana
    depends_on:
      - elasticsearch
 
    restart: always
    ports:
      - "5601:5601"
  logstash:
    image: docker.elastic.co/logstash/logstash:5.5.1
    command: logstash -f /etc/logstash/conf.d/logstash.conf
    volumes:
      - $PWD/logstash/conf.d:/etc/logstash/conf.d
      - $PWD/log:/tmp
    container_name: logstash551
    hostname: logstash
    restart: always
    depends_on:
      - elasticsearch
 
    ports:
      - "7001-7005:7001-7005"
      - "4567:4567"

2.logstash.conf
監控4567埠，logback日誌的輸出將全部輸出到4567埠 logstash獲取資料 輸入到es中，實現監控

input {  
  tcp {  
        port => 4567
        #模式選擇為server  
        mode => "server"  
        tags => ["tags"] 
        #message格式化json輸入，可以解決中文亂碼問題 
        codec => json_lines 
      }  
}  

filter {  
}  

output { 
   elasticsearch {
    hosts => ["elasticsearch:9200"]
    user => "elastic"
    password => "changeme"
  }
}

三、logback.xml配置

1.maven安裝對應的包

 <!-- Logstash encoder -->
 <dependency>
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>4.4</version>
 </dependency>

2.配置logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration debug="false" scan="false" scanPeriod="30 seconds" >
    <include resource="org/springframework/boot/logging/logback/defaults.xml"/>
   <appender name="logstash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <param name="Encoding" value="UTF-8"/>
        <remoteHost>localhost</remoteHost>
        <port>4567</port>
        <!-- encoder is required -->
        <encoder class="net.logstash.logback.encoder.LogstashEncoder" />
    </appender>
    <logger name="com.zhijia" level="TRACE" additivity="false">
        <appender-ref ref="logstash" />
    </logger>

    <root level="INFO">
        <appender-ref ref="logstash" />
    </root>

問題

1、don’t run elasticsearch as root.

因為安全問題elasticsearch 不讓用root使用者直接執行，所以要建立新使用者

第一步：liunx建立新使用者  adduser XXX    然後給建立的使用者加密碼 passwd XXX    輸入兩次密碼。

第二步：給XXX賦許可權，chown -R XXX /你的ELK的docker-compose的目錄。

然後執行成功。