5分钟快速搭建ELK

（1）ES开发环境安装

docker run -d --name elasticsearch  -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" elasticsearch:7.2.0

（2）ES生产集群安装

1：创建docker-compose.yml文件

version: '2.2'
services:
  es01:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.5.2
    container_name: es01
    environment:
      - node.name=es01
      - cluster.name=es-docker-cluster
      - discovery.seed_hosts=es02,es03
      - cluster.initial_master_nodes=es01,es02,es03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - data01:/usr/share/elasticsearch/data
    ports:
      - 9200:9200
    networks:
      - elastic
  es02:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.5.2
    container_name: es02
    environment:
      - node.name=es02
      - cluster.name=es-docker-cluster
      - discovery.seed_hosts=es01,es03
      - cluster.initial_master_nodes=es01,es02,es03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - data02:/usr/share/elasticsearch/data
    networks:
      - elastic
  es03:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.5.2
    container_name: es03
    environment:
      - node.name=es03
      - cluster.name=es-docker-cluster
      - discovery.seed_hosts=es01,es02
      - cluster.initial_master_nodes=es01,es02,es03
      - bootstrap.memory_lock=true
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - data03:/usr/share/elasticsearch/data
    networks:
      - elastic

volumes:
  data01:
    driver: local
  data02:
    driver: local
  data03:
    driver: local

networks:
  elastic:
    driver: bridge

运行docker-compose up

测试
curl -X GET “localhost:9200/_cat/nodes?v&pretty”

参考文档：
https://www.elastic.co/guide/en/elasticsearch/reference/7.5/docker.html#docker-compose-file

（3）ES安装IK分词器

下载地址:
https://github.com/medcl/elasticsearch-analysis-ik/releases
下载后转移到服务器上
通过docker cp 复制到容器内 /usr/share/elasticsearch/plugins 就是这个位置,别乱放

docker cp /XXX/analysis-ik 容器ID:/usr/share/elasticsearch/plugins

复制完后，重启即可

（4）Kibana

创建宿主目录
/etc/kibana/config

Kibana.yml配置内容

server.name: kibana
server.host: "0"
elasticsearch.hosts: [ "http://172.17.0.17:9200" ]
xpack.monitoring.ui.container.elasticsearch.enabled: true

docker运行

docker run -di --name=kibana  -p 5601:5601 -v /etc/kibana/config:/usr/share/kibana/config kibana:7.2.0

（5）安装logstash

docker pull logstash:7.2.0

docker run -di --name=logstash -v /etc/logstash/config:/usr/share/logstash/config -v /etc/logstash/pipeline:/usr/share/logstash/pipeline docker.elastic.co/logstash/logstash:7.2.0

logstash的安装需要根据实际业务需求配置

input {
    
    
  tcp{
    
    
    port => 5044
    codec => json_lines
  }
}

filter {
    
    
        json{
    
    
            source => "message"
            target => "message"
        }
}
output {
    
    
  elasticsearch {
    
    
    hosts => ["http://172.17.0.17:9200"]
    index  => "logstash-%{+YYYY.MM.dd}"
    #user => "elastic"
    #password => "changeme"
  }
  stdout {
    
     codec => rubydebug }
}