Elastic stack (ELK) on Docker

碼云git https://gitee.com/wangxuancheng/docker-elk

原github地址 https://github.com/deviantony/docker-elk

#修改
sysctl -w vm.max_map_count=262144

安裝 docker-compose

https://www.runoob.com/docker/docker-compose.html

啟動(dòng)

cd docker-elk
docker-compose up -d

默認(rèn)密碼修改

docker-compose.yml ELASTIC_PASSWORD

kibana/config/kibana.yml elasticsearch.password:

logstash/config/logstash.yml xpack.monitoring.elasticsearch.password:

設(shè)置中文

kibana/config/kibana.yml 增加一行

i18n.locale: "zh-CN"

服務(wù)器ip修改

kibana/config/kibana.yml elasticsearch.hosts:

logstash/config/logstash.yml xpack.monitoring.elasticsearch.hosts:

logstash/pipeline/logstash.conf hosts

收集日志

vim logstash/pipeline/logstash.conf

input {
    file {
        path => "/www/wwwlogs/demo.com.log"
        start_position => "beginning"
        type => "nginx-access"
    }
    
    file {
        path => "/www/wwwlogs/demo.com.error.log"
        start_position => "beginning"
        type => "nginx-error"
    }
    
    file {
        path => "/www/wwwroot/demo.com/storage/logs/*.log"
        start_position => "beginning"
        type => "laravel"
    }
    
    beats {
        port => 5044
    }

    tcp {
        port => 5000
    }
}

output {
    if [type] == "nginx-access" { 
       elasticsearch {
            hosts => "172.21.28.138:9200"
            index => "nginx-access-log-%{+YYYY.MM.dd}"
            user => "elastic"
            password => "123456"
        }
    } else if [type] == "nginx-error" {
        elasticsearch {
            hosts => "172.21.28.138:9200"
            index => "nginx-error-log-%{+YYYY.MM.dd}"
            user => "elastic"
            password => "123456"
        }
    } else if [type] == "laravel" {
        elasticsearch {
            hosts => "172.21.28.138:9200"
            index => "laravel-log-%{+YYYY.MM.dd}"
            user => "elastic"
            password => "123456"
        }
    }
}

修改完配置需掛載上面path的日志文件到logstash容器 （這里收集了nginx日志和php laravel框架日志）

可以掛載elasticsearch/data 數(shù)據(jù)，data目錄需要給讀寫權(quán)限