Docker搭建ELK

一、安装准备

1、下载镜像

docker pull docker.io/elasticsearch:7.3.1
docker pull docker.io/kibana:7.3.1
docker pull docker.io/logstash:7.3.1
docker pull mobz/elasticsearch-head:5

二、安装elasticsearch

#启动容器
docker run -d --name es -p 9200:9200 -p 9300:9300 --net=host -e "discovery.type=single-node" docker.io/elasticsearch:7.3.1
#进入容器
docker exec -it es /bin/bash
cd config
vi elasticsearch.yml
# 加入跨域配置
http.cors.enabled: true
http.cors.allow-origin: "*"
#退出容器
exit
#重启容器
docker restart es 

访问地址：http://localhost:9200/

三、安装elasticsearch-head

docker run -d --name es_admin -p 9100:9100 --net=host  mobz/elasticsearch-head:5

访问地址：http://localhost:9100/

四、安装logstash

docker run -d --name es_logstash -p 5044:5044 -p 9600:9600 --net=host docker.io/logstash:7.3.1
mkdir -p /home/elk/logstash
chown -R 1000 /home/elk/logstash
docker cp es_logstash:/usr/share/logstash/config/ /home/elk/logstash/
cd /home/elk/logstash/config

mkdir conf
cp logstash-sample.conf  conf/logstash.conf

vim logstash.conf
#修改配置
input {
  tcp{
      port => 5044
      codec => "json"
  }
  #beats {
  #  port => 5044
  #}
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    action => "index"
    index => "%{[appname]}"
    #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    #user => "elastic"
    #password => "changeme"
  }
}

#修改配置
vim logstash.yml 
#内容如下
http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.hosts: [ "http://localhost:9200" ]

vim pipelines.yml
#指定配置文件路径
- pipeline.id: main
  path.config: "/usr/share/logstash/config/conf"

#删除容器
docker rm es_logstash

#重新启动容器
docker run --name es_logstash -d -p 5044:5044 -p 9600:9600 -v /home/elk/logstash/config:/usr/share/logstash/config --net=host docker.io/logstash:7.3.1 -f /usr/share/logstash/config/conf/logstash.conf

五、安装kibana

docker run --name es_kibana -p 5601:5601 -d --net=host docker.io/kibana:7.3.1
#进入容器 修改配置文件
docker exec -it es_kibana /bin/bash
cd /usr/share/kibana/config/
vi kibana.yml 
#修改配置文件
elasticsearch.hosts: [ "http://localhost:9200" ]
xpack.monitoring.ui.container.elasticsearch.enabled: false
exit
docker restart es_kibana

访问地址：http://localhost:5601

六、spring boot logback配置

<dependency>
      <groupId>net.logstash.logback</groupId>
      <artifactId>logstash-logback-encoder</artifactId>
      <version>6.2</version>
</dependency>

#logback.xml
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <include resource="org/springframework/boot/logging/logback/base.xml"/>
    <appender name="stash" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
        <destination>103.240.16.226:5044</destination>
        <!-- encoder is required -->
        <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder">
            <customFields>{"appname":"spcloud-sentinel"}</customFields>
        </encoder>
    </appender>
    <root level="INFO">
        <appender-ref ref="stash"/>
        <appender-ref ref="CONSOLE"/>
    </root>
</configuration>