（注：安裝ELK8.4.3，Java版本必須是java17JDK）
一、Elasticsearch8.8.2部署
1、下載elasticsearch鏡像：
docker pull docker.elastic.co/elasticsearch/elasticsearch:8.8.2
2、創(chuàng)建docker網(wǎng)絡(luò)：
docker network create --driver bridge --subnet 172.18.0.0/16 elastic
3、創(chuàng)建Elasticsearch掛載目錄
mkdir -p /usr/elk8.8.2/elasticsearch
4、給創(chuàng)建的文件夾授權(quán)
chmod 777 /usr/elk8.8.2/elasticsearch
5、第一次執(zhí)行容器
docker run -it \
--name elastic --network=elastic --ip=172.18.0.2 \
-p 9200:9200 -p 9300:9300 \
-e "discovery.type=single-node" \
docker.elastic.co/elasticsearch/elasticsearch:8.8.2
6、將容器內(nèi)的文件復制到主機上
docker cp elastic:/usr/share/elasticsearch/config /usr/elk8.8.2/elasticsearch/
docker cp elastic:/usr/share/elasticsearch/data /usr/elk8.8.2/elasticsearch/
docker cp elastic:/usr/share/elasticsearch/plugins /usr/elk8.8.2/elasticsearch/
docker cp elastic:/usr/share/elasticsearch/logs /usr/elk8.8.2/elasticsearch/
7、刪除容器
docker rm -f elastic
8、創(chuàng)建elasticsearch容器，名稱elastic，加入網(wǎng)絡(luò)elastic：
docker run -itd --name elastic --net elastic --restart=always \
-p 9200:9200 -p 9300:9300 \
-v /usr/elk8.8.2/elasticsearch/data:/usr/share/elasticsearch/data \
-v /usr/elk8.8.2/elasticsearch/plugins:/usr/share/elasticsearch/plugins \
-v /usr/elk8.8.2/elasticsearch/logs:/usr/share/elasticsearch/logs \
-v /usr/elk8.8.2/elasticsearch/config:/usr/share/elasticsearch/config \
--log-opt max-size=10m --log-opt max-file=3 \
--ip 172.18.0.2 \
docker.elastic.co/elasticsearch/elasticsearch:8.8.29、查看容器是否創(chuàng)建成功：
docker ps -a
10、查看Elasticsearch分配的IP：
docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' elastic
11、通過本機IP用https://訪問并登錄elasticsearch，登錄用戶名是elastic，密碼需要從Elasticsearch日志里
查看Elasticsearch日志：docker logs -f elastic
? Elasticsearch security features have been automatically configured!
? Authentication is enabled and cluster connections are encrypted.
?? Password for the elastic user (reset with `bin/elasticsearch-reset-password -u elastic`):
Dx2SOh9cHZogN7kILzoR
?? HTTP CA certificate SHA-256 fingerprint:
c2e324295466cab02f47d06f1ea432e3f42b23e0c63c502d7478682d0bad946c
?? Configure Kibana to use this cluster:
? Run Kibana and click the configuration link in the terminal when Kibana starts.
? Copy the following enrollment token and paste it into Kibana in your browser (valid for the next 30 minutes):
eyJ2ZXIiOiI4LjguMiIsImFkciI6WyIxNzIuMTguMC4yOjkyMDAiXSwiZmdyIjoiYzJlMzI0Mjk1NDY2Y2FiMDJmNDdkMDZmMWVhNDMyZTNmNDJiMjNlMGM2M2M1MDJkNzQ3ODY4MmQwYmFkOTQ2YyIsImtleSI6IktMR01uNHdCSkRFb2dIMVg5ZEVEOjhFQ0M2b2VoUXZxYjBzRU9DZk1Wc2cifQ==
?? Configure other nodes to join this cluster:
? Copy the following enrollment token and start new Elasticsearch nodes with `bin/elasticsearch --enrollment-token <token>` (valid for the next 30 minutes):
eyJ2ZXIiOiI4LjguMiIsImFkciI6WyIxNzIuMTguMC4yOjkyMDAiXSwiZmdyIjoiYzJlMzI0Mjk1NDY2Y2FiMDJmNDdkMDZmMWVhNDMyZTNmNDJiMjNlMGM2M2M1MDJkNzQ3ODY4MmQwYmFkOTQ2YyIsImtleSI6IktyR01uNHdCSkRFb2dIMVg5ZEVNOmlTT05uVHNnUXA2Wjg1MnNoNUN3UVEifQ==
If you're running in Docker, copy the enrollment token and run:
`docker run -e "ENROLLMENT_TOKEN=<token>" docker.elastic.co/elasticsearch/elasticsearch:8.8.2`（注：Elasticsearch部署的時候是有時效性的，時間在30分鐘，超過30分鐘得重新生成token）
https://192.168.8.184:9200/
登錄后就看到了基本信息：
12、進入Elasticsearch容器：
docker exec -it elastic /bin/bash
執(zhí)行創(chuàng)建用戶命令：bin/elasticsearch-users useradd Demo
角色授權(quán)：
bin/elasticsearch-users roles -a superuser Demo
bin/elasticsearch-users roles -a kibana_system Demo
（Kibana登錄的時候就使用Demo的賬號和密碼進行登錄就可以了）
13、設(shè)置開機自動啟動：
docker update --restart=always 96f7744f5f7a
14、下面是Elasticsearch.yml的配置信息：
cluster.name: "docker-cluster"
network.host: 0.0.0.0
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
enabled: true
keystore.path: certs/http.p12
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
keystore.path: certs/transport.p12
truststore.path: certs/transport.p1215、prometheus監(jiān)控es
下載鏡像：docker pull quay.io/prometheuscommunity/elasticsearch-exporter:latest
運行鏡像：docker run --name es_exporter -d -p 9114:9114 --privileged=true --restart=always quay.io/prometheuscommunity/elasticsearch-exporter:latest
二、Kibana8.8.2部署
1、下載kibana鏡像：
docker pull docker.elastic.co/kibana/kibana:8.8.2
2、創(chuàng)建kibana掛載目錄
mkdir -p /usr/elk8.8.2/kibana
3、文件授權(quán)
sudo chown -R 1000:1000 /usr/elk8.8.2/kibana
4、第一次執(zhí)行容器：
docker run -itd --name kibana --net elastic --restart=always \
-p 5601:5601 --log-driver json-file \
--log-opt max-size=10m --log-opt max-file=3 \
docker.elastic.co/kibana/kibana:8.8.2
5、將容器內(nèi)的文件復制到主機上
docker cp kibana:/usr/share/kibana/config /usr/elk8.8.2/kibana/
docker cp kibana:/usr/share/kibana/data /usr/elk8.8.2/kibana/
docker cp kibana:/usr/share/kibana/plugins /usr/elk8.8.2/kibana/
docker cp kibana:/usr/share/kibana/logs /usr/elk8.8.2/kibana/
6、刪除容器
docker rm -f kibana
7、創(chuàng)建Kibana容器，名稱kibana，加入網(wǎng)絡(luò)elastic
docker run -itd --name kibana --net elastic --restart=always \
-p 5601:5601 --log-driver json-file \
-v /usr/elk8.8.2/kibana/config:/usr/share/kibana/config \
-v /usr/elk8.8.2/kibana/data:/usr/share/kibana/data \
-v /usr/elk8.8.2/kibana/plugins:/usr/share/kibana/plugins \
-v /usr/elk8.8.2/kibana/logs:/usr/share/kibana/logs \
--log-opt max-size=10m --log-opt max-file=3 \
--ip 172.18.0.3 \
docker.elastic.co/kibana/kibana:8.8.28、查看容器是否創(chuàng)建成功：
docker ps -a
9、訪問并進入Kibana:
輸入本機IP訪問http://192.168.8.184:5601/，輸入Elasticsearch日志記錄下來的enrollment-token，如果出現(xiàn)無法配置Elastic，那就證明enrollment-token已經(jīng)超過了30分鐘，已時效。
此時將采用創(chuàng)建kibana連接Elasticsearch的enrollment-token：
docker exec -it elastic /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
docker exec -it elastic /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
WARNING: Owner of file [/usr/share/elasticsearch/config/users] used to be [root], but now is [elasticsearch]
WARNING: Owner of file [/usr/share/elasticsearch/config/users_roles] used to be [root], but now is [elasticsearch]
eyJ2ZXIiOiI4LjguMiIsImFkciI6WyIxNzIuMjQuMC4yOjkyMDAiXSwiZmdyIjoiYTU3ODc0NjZiZTE1ZWI3YTZmYTczNjRjMzc3NzRmNjgyYzQyZGIzNzgzOWM3MDU0MjY1MmNlM2U4MTE4ZDAzYyIsI
mtleSI6IlpPVDZVWXdCcERMVmVEeWE1M3lVOjI1Wkd5X1dfUjVPWGlwVG5QTHlGY1EifQ==把產(chǎn)生的enrollment-token復制到多行文本框后，點擊Configure Elastic繼續(xù)操作
10、查看或生成verification-code：
查看Kibana日志可以看到verification-code：
docker logs -f kibana
或者可以執(zhí)行kibana-verification-code命令，生成verification-code
11、登錄kibana
重置elastic密碼：docker exec -it elastic /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic
選擇y繼續(xù)
然后輸入用戶名：elastic，密碼就是生成出來的New value后面的密碼值
12、修改密碼：
點擊右上角的頭像選擇Edit profile，選擇Change password，然后輸入上一步生成的密碼_puJyZzE4d3id0gsT4RG，然后再輸入自己創(chuàng)建的新密碼，選擇Change password
13、添加中文語言：
進入kibana容器：docker exec -it kibana bash
添加中文： echo "i18n.locale: zh-CN" >> config/kibana.yml
退出容器進行重啟：
exit
docker restart kibana
14、設(shè)置開機自動啟動：
docker update --restart=always e1d516dd1601
15、刷新瀏覽器頁面進行就可以看到中文版的登錄頁面了，然后使用剛才自己設(shè)置的密碼進行登錄
登錄后的頁面也變成了中文界面
15、下面的是kibana.yml的配置信息
server.host: 0.0.0.0
server.shutdownTimeout: 5s
elasticsearch.hosts: ['https://172.18.0.2:9200']
monitoring.ui.container.elasticsearch.enabled: true
elasticsearch.serviceAccountToken: AAEAAWVsYXN0aWMva2liYW5hL2Vucm9sbC1wcm9jZXNzLXRva2VuLTE3MDM0ODQyNTcxNjk6RVcwcWdYaXJU
QUstcS16Y1o4VmNRZw
elasticsearch.ssl.certificateAuthorities: [/usr/share/kibana/data/ca_1703484258615.crt]
xpack.fleet.outputs: [{id: fleet-default-output, name: default, is_default: true, is_default_monitoring: true, type: el
asticsearch, hosts: ['https://172.18.0.2:9200'], ca_trusted_fingerprint: c2e324295466cab02f47d06f1ea432e3f42b23e0c63c50
2d7478682d0bad946c}]
i18n.locale: zh-CN16、prometheus監(jiān)控kibana
下載鏡像：
運行鏡像：docker run -d --name kibana_exporter -e ELASTICSEARCH_HOSTS=http://192.168.8.184:9200 --network=es-net -p 1015:5601 kibana_exporter:8.4.3
docker run -d --name kibana_exporter -e ELASTICSEARCH_HOSTS=http://192.168.8.184:9200 --network=es-net -p 9675:9675 monitoringartist/kibana_exporter:latest
三、Logstash8.8.2部署
1、下載kibana鏡像：
docker pull docker.elastic.co/logstash/logstash:8.8.2
2、創(chuàng)建Logstash掛載目錄
mkdir -p /usr/elk8.8.2/logstash
3、文件授權(quán)
sudo chown -R 1000:1000 /usr/elk8.8.2/logstash
4、創(chuàng)建Logstash容器，名稱logstash，加入網(wǎng)絡(luò)elastic
docker run -itd --name logstash -p 9600:9600 -p 5044:5044 docker.elastic.co/logstash/logstash:8.8.2
5、將容器內(nèi)的文件復制到主機上
docker cp logstash:/usr/share/logstash/config /usr/elk8.8.2/logstash/
docker cp logstash:/usr/share/logstash/pipeline /usr/elk8.8.2/logstash/
6、編輯信息logstash.yml
需要把es里的config下的certs復制到logstash下的config/certs目錄里http_ca.crt
cd /usr/elk8.8.2/elasticsearch/config/ & cp -r certs /usr/elk8.8.2/logstash/config/
vim usr/elk8.8.2/logstash/config/logstash.yml
#（如果es沒有設(shè)置賬號密碼，這里也不設(shè)置賬號密碼,如果es加了賬號密碼，這里需要增加es的認證和賬號密碼）
http.host: "0.0.0.0"
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.hosts: ["https://172.18.0.2:9200"]
xpack.monitoring.elasticsearch.username: "Test"
xpack.monitoring.elasticsearch.password: "sloveb55"
xpack.monitoring.elasticsearch.ssl.certificate_authority: "/usr/share/logstash/config/certs/http_ca.crt"
#下面這一行去es記錄的信息里可以找到，找HTTP CA certificate SHA-256 fingerprint的密文
#xpack.monitoring.elasticsearch.ssl.ca_trusted_fingerprint: "c2e324295466cab02f47d06f1ea432e3f42b23e0c63c502d7478682d0bad946c"7、編輯pipelines.yml
- pipeline.id: main
path.config: "/usr/share/logstash/pipeline"8、編輯日志配置信息logstash.conf
vim usr/elk8.8.2/logstash/pipeline/logstash.conf
input {
syslog {
type => "system-syslog"
port => 5044
}
}
filter{
}
output {
elasticsearch {
hosts => ["https://172.18.0.2:9200"]
index => "system-syslog-%{+YYYY.MM.dd}"
user => "Test"
password => "sloveb55"
codec => plain {
charset => "US-ASCII"
}
ssl_certificate_authorities => "/usr/share/logstash/config/certs/http_ca.crt"
}
}8、刪除容器
docker rm -f logstash
9、創(chuàng)建Logstash容器，名稱Logstash，加入網(wǎng)絡(luò)elastic
docker run -itd --name logstash --net elastic --restart=always \
-p 9600:9600 -p 5044:5044 \
-v /usr/elk8.8.2/logstash/config:/usr/share/logstash/config \
-v /usr/elk8.8.2/logstash/pipeline:/usr/share/logstash/pipeline \
--log-opt max-size=10m --log-opt max-file=3 \
--ip 172.18.0.4 \
docker.elastic.co/logstash/logstash:8.8.210、開放端口
firewall-cmd --zone=public --add-port=5044/tcp --permanent && firewall-cmd --reload
firewall-cmd --zone=public --add-port=9600/tcp --permanent && firewall-cmd --reload
systemctl restart firewalld
11、查看容器是否創(chuàng)建成功：
docker ps -a
12、在Kibana里的索引管理里將看到剛才我們收集的日志
13、然后在Analytics的Discover里將看到具體的日志文件
四、Filebeat:8.8.2部署
1、下載鏡像：
docker pull elastic/filebeat:8.8.2
2、創(chuàng)建Filebeat容器
docker run -itd \
--name filebeat \
--network host \
-e TZ=Asia/Shanghai \
elastic/filebeat:8.8.2 \
filebeat -e -c /usr/share/filebeat/filebeat.yml3、創(chuàng)建Filebeat掛載目錄：
mkdir -p /usr/elk8.8.2/filebeat/log
4、將容器內(nèi)的文件復制到主機上
docker cp filebeat:/usr/share/filebeat/filebeat.yml /usr/elk8.8.2/filebeat/
docker cp filebeat:/usr/share/filebeat/data /usr/elk8.8.2/filebeat/
docker cp filebeat:/usr/share/filebeat/logs /usr/elk8.8.2/filebeat/
5、修改配置文件
vim /usr/elk8.8.2/filebeat/filebeat.yml
filebeat.config:
modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
processors:
- add_cloud_metadata: ~
- add_docker_metadata: ~
output.logstash:
enabled: true
# The Logstash hosts
hosts: ["172.18.0.4:5044"]
filebeat.inputs:
- type: log
enabled: true
paths:
- /usr/share/filebeat/target/*/*/*.log. # 這個路徑是需要收集的日志路徑，是docker容器中的路徑
scan_frequency: 10s
exclude_lines: ['HEAD']
exclude_lines: ['HTTP/1.1']
multiline.pattern: '^[[:space:]]+(at|\.{3})\b|Exception|捕獲異常'
multiline.negate: false
multiline.match: after6、文件授權(quán)
sudo chown -R 1000:1000 /usr/elk8.8.2/filebeat
7、刪除容器
docker rm -f filebeat文章來源：http://www.zghlxwxcb.cn/news/detail-788719.html
8、重新創(chuàng)建腳本文章來源地址http://www.zghlxwxcb.cn/news/detail-788719.html
docker run -itd --name filebeat --restart=always \
--network host -e TZ=Asia/Shanghai \
-v /usr/elk8.8.2/filebeat/log:/usr/share/filebeat/target \
-v /usr/elk8.8.2/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml \
-v /usr/elk8.8.2/filebeat/data:/usr/share/filebeat/data \
-v /usr/elk8.8.2/filebeat/logs:/usr/share/filebeat/logs \
elastic/filebeat:8.8.2 \
filebeat -e -c /usr/share/filebeat/filebeat.yml到了這里，關(guān)于Docker 安裝 Elasticsearch8.8.2\kibana8.8.2\Logstash8.8.2\Filebeat:8.8.2[親測可用]的文章就介紹完了。如果您還想了解更多內(nèi)容，請在右上角搜索TOY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
