搭建elk环境并接入frostmourne，实现监控报警效果（一）

lisanmengmeng2026-08-20 9:26

1.部署elasticsearch

#拉取镜像

执行下面拉取镜像命令（默认拉取最新版）：

docker pull docker.elastic.co/elasticsearch/elasticsearch:8.6.0

#创建目录，分配权限

cd /data/elk_monitor

mkdir -p es/{config,config/certs,data,plugins}

chmod -R 777 es/data*

#证书配置

es_config.tgz

放到 config/certs

#配置文件：config/es.yaml

复制代码

cluster.name: elasticsearch-cluster
node.name: es1
network.host: 0.0.0.0
network.publish_host: es1 
http.port: 9200
http.cors.enabled: true
http.cors.allow-origin: "*"
http.cors.allow-headers: Authorization
cluster.initial_master_nodes: es1
discovery.seed_hosts: ["es1:9300"]
transport.profiles.default.port: 9300
#xpack
#xpack.security.enabled: false
xpack.security.enabled: true
xpack.security.audit.enabled: false
#xpack.security.transport.ssl.enabled: false
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12

#docker-compose.yaml文件

复制代码

version: '3.8'
services:
  es1:
    # 镜像名称
    image: docker.elastic.co/elasticsearch/elasticsearch:8.6.0 
    # 容器名称
    container_name: es1
    hostname: es1
    environment:
      - "ES_JAVA_OPTS=-Xms256m -Xmx256m"
      - ELASTIC_PASSWORD=vsUZGKNvjWRtTKPmDG
    # 文件映射到主机
    volumes:
      - /data/elk_monitor/es/config/es.yml:/usr/share/elasticsearch/config/elasticsearch.yml
      - /data/elk_monitor/es/plugins:/usr/share/elasticsearch/plugins
      - /data/elk_monitor/es/data:/usr/share/elasticsearch/data
      - /data/elk_monitor/es/config/certs:/usr/share/elasticsearch/config/certs
    # 赋予权限
    privileged: true
    #端口映射
    ports:
      - 9200:9200
      - 9300:9300
    networks:
      - meta
    deploy:
      replicas: 1

networks:
  meta:
    external: true # 用已经创建好的网络