Docker + ELK structures

Changed the operating environment, re-build ELK inside of a local company, even before the take over (accessible: https://yanganlin.com/31.html ), recently wanted to do something with Docker, this time also with Docker, fairly well, what did not fall into the pit, the last building, also used with version 6.2+, which are over a year, Elk three products are already on the 7, or with a docker built with 6.2.4 stable enough to date

Installation elasticsearch

installation

docker run \
    -d \
    --name elasticsearch \
    -p 9200:9200 \
    -p 9300:9300 \
    -e "discovery.type=single-node" \
    docker.elastic.co/elasticsearch/elasticsearch:6.2.4

accesshttp://localhost:9200

AnSo kibana

installation

docker run \
    -d \
    -u 0 \
    --name kibana \
    -p 5601:5601\
    docker.elastic.co/kibana/kibana:6.2.4

Into the interior of the container: docker exec -it kibana /bin/bash
find kibana configuration file: /usr/share/kibana/config/ kibana.yml
Restart container:doccker restart kibana

Modify the configuration file, because you want to bypass the security check x-pack of

elasticsearch.url: http://localhost:9200
xpack.monitoring.ui.container.elasticsearch.enabled: false

Installation logstash

installation

docker run \
    -d \
    -u 0 \
    --name logstash \
    -p 5044:5044\
    docker.elastic.co/logstash/logstash:6.2.4

Into the container:docker exec -it logstash /bin/bash

Locate the file:/usr/share/logstash/pipeline

Modify the configuration filelogstash.conf

input {
    tcp {
        port => 5044
        codec => json_lines
    }
}

output{
    elasticsearch {
        hosts => ["localhost:9200"]
        action => "index"
        index => "%{[appname]}"
    }
  stdout { codec => rubydebug }
}

Restart container:doccker restart logstash

SpringBoot configuration Logstash

logback.xml

<appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
    <destination>localhost:5044</destination>
    <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder">
        <customFields>{"appname":"eureka-server"}</customFields>
    </encoder>
</appender>

<root level="INFO">
    <appender-ref ref="LOGSTASH"/>
</root>

pom.xml

<dependency>
    <groupId>net.logstash.logback</groupId>
    <artifactId>logstash-logback-encoder</artifactId>
    <version>4.9</version>
</dependency>

Create an index Kibana

Reference: https://yanganlin.com/31.html