Use docker to quickly install Kibana 7.5.1 and query configuration

Install docker

slightly

Kibana

Run the container

docker run -d --name kibana -p 5601:5601 kibana:7.6.1

Copy configuration file

mkdir -p /root/kibana
docker cp kibana:/usr/share/kibana/config/ /root/kibana/

Editing kibana.yml

vi /root/kibana/config/kibana.yml

Modify elasticsearch.hosts
Modify the elasticsearch host address according to the actual situation

server.name: kibana
server.host: "0"
elasticsearch.hosts: [ "http://192.168.130.20:9200","http://192.168.130.19:9200","http://192.168.130.21:9200" ]
xpack.monitoring.ui.container.elasticsearch.enabled: true
kibana.index: ".kibana"

Delete the newly started container and re-hang it in the directory

docker rm -f kibana

docker run -d --name kibana -p 5601:5601 \
-v /root/kibana/config:/usr/share/kibana/config \
kibana:7.5.1

Open the browser and check whether kibana is normal
http://xx.xx.xx.xx:5601

After opening kibana, no index mode is configured by default. After configuration, some fields are not mapped (marked with a question mark? in front), which may cause inconvenience to query.

Index mode configuration

1. Click the bottom menu to enter the management menu
   

2. Enter the index mode interface, click Create Index Mode
   

3. Enter the index mode (multiple indexes can use wildcards, the following list will dynamically load whether there are matching indexes), and then click Next
   

4. Click to create index mode
   

5. After the creation is successful, jump to the detailed interface of index mode, you can click the five-pointed star above to set it as the default index mode
   

6. Click on the top menu to start searching
   

Field mapping

1. Enter the index management interface
   

2. Go to the index template tab page and click Create template
   

3. Enter the template name and index mode, click Next
   

4. The index settings are all set by default here. For specific configuration items, please refer to https://www.elastic.co/guide/en/elasticsearch/reference/7.5/index-modules.html#index-modules-settings

5. Map the fields that need to be indexed (key configuration), refer to https://www.elastic.co/guide/en/elasticsearch/reference/7.5/mapping.html for specific configuration documents
   

6. Skip the alias for now, and then click Create template
   

7. Enter the corresponding index mode
   

8. Click the refresh icon
   

9. After refreshing, enter the Discover interface, you can see the original tape? The fields have been indexed.