1.拉取镜像

docker pull docker.elastic.co/elasticsearch/elasticsearch:7.8.0

2.启动容器，设置部分参数是为了支持跨域访问。

docker run -d --name elasticsearch  -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" -e http.cors.enabled=true -e http.cors.allow-origin="*" -e http.cors.allow-headers=X-Requested-With,X-Auth-Token,Content-Type,Content-Length,Authorization -e http.cors.allow-credentials=true elasticsearch:7.8.0

3.通过ip:9200 访问，会返回集群状态信息，证明安装成功。

{
  "name" : "5dd2a7d3354a",
  "cluster_name" : "docker-cluster",
  "cluster_uuid" : "08oprFX1QHqvMuCZHJJMYQ",
  "version" : {
    "number" : "7.8.0",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "757314695644ea9a1dc2fecd26d1a43856725e65",
    "build_date" : "2020-06-14T19:35:50.234439Z",
    "build_snapshot" : false,
    "lucene_version" : "8.5.1",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

4.chrome安装head插件--ElasticSearch Head。

5.此刻你会发现Elasticsearch是裸奔的，现在添加基本安全验证。

5.1 进入容器

docker ps
docker exec -it 容器ID bash

5.2 进入到Elasticsearch安装目录

cd /usr/share/elasticsearch

5.3使用下列命令生成证书，证书生成后在config下

bin/elasticsearch-certutil cert -out config/elastic-certificates.p12 -pass ""

此时/usr/share/elasticsearch/config目录下会多出2个文件：elastic-certificates.p12 和 elasticsearch.keystore。
修改文件所属用户和权限：

chown -R elasticsearch:elasticsearch /usr/share/elasticsearch/config/

5.4 修改配置，打开config/elasticsearch.yml，添加以下内容：

vi /usr/share/elasticsearch/config/elasticsearch.yml
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12

5.5 重启容器

docker restart 容器ID

5.6 进入容器

docker exec -it 容器ID bash

执行

elasticsearch-setup-passwords auto

请记住生成的密码。

Changed password for user apm_system
PASSWORD apm_system = qJFIxIjffpGe0o9QzKJf
Changed password for user kibana_system
PASSWORD kibana_system = EM3gO5q5nJOxEIyyomnA
Changed password for user kibana
PASSWORD kibana = EM3gO5q5nJOxEIyyomnA
Changed password for user logstash_system
PASSWORD logstash_system = qheZS2uy6c3OVDEId6kJ
Changed password for user beats_system
PASSWORD beats_system = aAqBG05BjYneMCXB3i78
Changed password for user remote_monitoring_user
PASSWORD remote_monitoring_user = OCZIk6HRvQJcDRaGFAUU
Changed password for user elastic
PASSWORD elastic = XdATDBkyNvlOPYKoUfSb

如果想自己设置密码，请执行

elasticsearch-setup-passwords interactive

5.7 打开浏览器，访问localhost:9200 会提示你输入用户名密码。至此，密码设置完成。

6.安装分词器

进入到docker容器内

elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v7.8.0/elasticsearch-analysis-ik-7.8.0.zip

安装完成后查看

elasticsearch-plugin list

删除分词器

elasticsearch-plugin remove analysis-ik

7安装kabana

7.1拉取kabana镜像

docker pull kibana:7.8.0

7.2启动kibana

docker run --name kibana -p 5601:5601 -d kibana:7.8.0

7.3修改elasticsearch配置

进入到容器

docker exec -it ac016117a18d bash

修改/usr/share/kibana/config/kibana.yml
elasticsearch.hosts: [ "http://xx.x.xx.xx:9200" ]
elasticsearch.username: "elastic"
elasticsearch.password: "123456"
退出重启kibana
然后浏览器访问ip:5601就能进入kibana，账号密码为elsticsearch的账号密码

7.4验证IK分词器是否配置成功

在elk的dev-tools输入，提示如下

POST /_analyze
{
  "analyzer": "ik_max_word",
  "text": "我是Joey"
}

image.png

8.安装logstash

docker run -d --restart=always --log-driver json-file --log-opt max-size=100m --log-opt max-file=2 -p 5044:5044 --name logstash --privileged=true -v /data/elk/logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml -v /data/elk/logstash/conf.d/:/usr/share/logstash/conf.d/ logstash:7.8.0

docker安装Elasticsearch7.8.0