架构
一台docker虚拟机
docker部署elasticsearch-6.7.2 ES1 ：172.111.0.11
docker部署elasticsearch-6.7.2 ES2 ：172.111.0.12
docker部署logstash-6.7.2 ：172.111.0.13 可以用现成的镜像
docker部署kibana-6.7.2-x86_64 ：172.111.0.14 可以用现成的镜像
实验步骤
cd /opt
mkdir es1 es2 logstash kibana
Elasticsearch镜像
ES1
cd /opt
上传elasticsearch的rpm包安装包
cd es1
cp /etc/yum.repos.d/Centos-7.repo .
rpm -ivh /opt/elasticsearch-6.7.2.rpm
cp /etc/elasticsearch/elasticsearch.yml .
对elasticsearch.yml文件进行修改
vim elasticsearch.yml
--17行-- 取消注释
cluster.name: elk-cluster
--23行-- 取消注释
node.name: node-1
--55行-- 取消注释，修改
network.host: 0.0.0.0
--59行-- 取消注释
http.port: 9200
#--23行-- 回到23行开始添加内容
node.master: true
node.data: true
--61行-- 添加
transport.tcp.port: 9300
--71行-- 取消注释，修改，这里可以直接用容器名通信，不必非得写IP地址
discovery.zen.ping.unicast.hosts: "172.111.0.11:9300","172.111.0.12:9300"
编写Dockerfile
vim Dockerfile
bash
FROM centos:7
MAINTAINER this is ES1 <ELK>
COPY Centos-7.repo elasticsearch-6.7.2.rpm /opt/
WORKDIR /etc/yum.repos.d/
RUN rm -rf * && \
cp /opt/Centos-7.repo . && \
yum clean all && yum makecache && \
yum -y install java ntpdate net-tools && \
useradd -M -s /bin/bash elasticsearch && \
rpm -ivh /opt/elasticsearch-6.7.2.rpm && \
chown -R elasticsearch:elasticsearch /usr/share/elasticsearch
COPY elasticsearch.yml /etc/elasticsearch/elasticsearch.yml
RUN chown -R elasticsearch:elasticsearch /etc/elasticsearch
USER elasticsearch
EXPOSE 9200
CMD ["/usr/share/elasticsearch/bin/elasticsearch"]docker build -t es:master .
创建自定义网络
docker run -itd --name es1 --net=mynetwork1 --ip 172.111.0.11 -p 9200:9200 es:master
docker exec -it es1 bash
docker ps -a
ES2
cp /opt/es1/* /opt/es2
对elasticsearch.yml文件进行修改
vim elasticsearch.yml
--23行-- 修改
node.name: node2
node.master: false
再修改Dockerfile
MAINTAINER this is ES2 <ELK>
完整版
bash
vim Dockerfile
FROM centos:7
MAINTAINER this is ES2 <ELK>
COPY Centos-7.repo elasticsearch-6.7.2.rpm /opt/
WORKDIR /etc/yum.repos.d/
RUN rm -rf * && \
cp /opt/Centos-7.repo . && \
yum clean all && yum makecache && \
yum -y install java ntpdate net-tools && \
useradd -M -s /bin/bash elasticsearch && \
rpm -ivh /opt/elasticsearch-6.7.2.rpm && \
chown -R elasticsearch:elasticsearch /usr/share/elasticsearch
COPY elasticsearch.yml /etc/elasticsearch/elasticsearch.yml
RUN chown -R elasticsearch:elasticsearch /etc/elasticsearch
USER elasticsearch
EXPOSE 9200
CMD ["/usr/share/elasticsearch/bin/elasticsearch"]docker build -t es:slave .
docker run -itd --name es2 --net=mynetwork1 --ip 172.111.0.12 -p 9201:9201 es:slave
docker exec -it es2 bash
验证
浏览器访问宿主机的地址
http://192.168.233.11:9200/ ，http://192.168.233.11:9201/
Logstash镜像
拉取logstash和kibana的v6.7.2版本镜像
docker pull logstash:6.7.2
docker pull kibana:6.7.2
logstash镜像编排
cd /opt/logstash
vim logstash.yml
编写yml文件
http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.url: "http://es1:9200","http://es2:9200"
vim logstash.conf
编写 conf 文件，定义输入输出，指定输入之一为宿主机Apache的日志文件
input {
tcp {
mode => "server"
host => "0.0.0.0"
port => 5044
codec => "json"
}
file {
path => "/opt/logs/*_log"
start_position => "beginning"
}
}
output {
elasticsearch {
hosts => "http://es1:9200","http://es2:9202"
index => "elk-%{+YYYY.MM.dd}"
}
}
vim Dockerfile
bash
FROM logstash:6.7.2
USER root
COPY logstash.yml ./config/logstash.yml
COPY logstash.conf ./pipeline/logstash.conf
docker build -t logstash:elk .
docker run -itd --name logstash -v /etc/httpd/logs/:/opt/logs/ --net mynetwork1 --ip 172.111.0.13 -p 5044:5044 -p 9600:9600 logstash:elk
docker exec -it logstash bash
cd /opt/logs/注：为了方便，把logstash镜像的权限设置为root，否则宿主机共享过去的Apache日志文件logstash都无权限访问
访问几次宿主机的Apache服务，并查看Apache的日志文件是否共享到容器内
kibana镜像
cd /opt/kibana
vim kibana.yml
server.name: kibana
server.host: "0"
elasticsearch.hosts: "http://es1:9200","http://es2:9201"
vim Dockerfile
bash
FROM kibana:6.7.2
COPY kibana.yml ./config/kibana.yml
USER root
RUN chown kibana.kibana ./config/kibana.yml
USER kibana
docker build -t kibana:elk .
docker run -itd --name kibana --net mynetwork1 --ip 172.111.0.14 -p 5601:5601 kibana:elk
docker exec -it kibana bash访问kibana的web页面，查看日志数据并建立对应索引