环境：centos7
安装 docker 1.12
安装 1.12之前先把之前docker卸载掉吧，不然后面有可能还是会提示你删除的。
cat > /etc/yum.repos.d/docker.repo <<-EOF
[dockerrepo]
name=Docker Repository
baseurl=https://yum.dockerproject.org/repo/experimental/centos/7/
enabled=1
gpgcheck=1
gpgkey=https://yum.dockerproject.org/gpg
EOF
# yum -y install docker-engine
# systemctl start docker
# docker -v
安装docker-compose
# curl -L https://github.com/docker/compose/releases/download/1.7.1/docker-compose-`uname -s`-`uname -m` > /usr/local/bin/docker-compose
# chmod +x /usr/local/bin/docker-compose
# docker-compose --vesion
直接从 https://github.com/yeasy/docker-compose-files/tree/master/elk_netflow 下载 docker-compose 模板，一键部署并启动。
# cd /opt/
# mkdir -p /opt/data/elasticsearch/
# git clone https://github.com/yeasy/docker-compose-files.git
# cd /opt/docker-compose-files/elk_netflow
# docker-compose up
# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
11aa4e81e594 kibana:4.1 "/docker-entrypoint.s" 2 hours ago Up 2 hours 0.0.0.0:5601->5601/tcp elknetflow_kibana_1
986293df6529 yeasy/logstash:1.5 "/docker-entrypoint.s" 2 hours ago Up 2 hours 0.0.0.0:2055->2055/udp elknetflow_logstash_1
5e87319a466c yeasy/elasticsearch:1.7 "/docker-entrypoint.s" 2 hours ago Up 2 hours 0.0.0.0:9200->9200/tcp, 9300/tcp elknetflow_elasticsearch_1
b515c6cfbed1 elasticsearch:1.7 "/docker-entrypoint.s" 2 hours ago Up 2 hours 9200/tcp, 9300/tcp elknetflow_es_1
启动后，logstash 将监听本地 2055 端口过来的 netflow 消息；kibana 监听在 5601 端口；elasticsearch 监听在 9200 端口。
浏览器访问 http://servier-IP:5601
屏幕快照 2016-09-22 12.47.38.png
