ELK部署

elasticsearch部署

运行docker，并将数据目录和日志目录挂到主机数据盘。

docker run -d --name es -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" -v /data1/containers/es/data/:/usr/share/elasticsearch/data/ -v /data1/containers/es/logs/:/usr/share/elasticsearch/logs/ elasticsearch:7.13.2

加入跨域配置

docker exec -it es /bin/bash

vi config/elasticsearch.yml
http.cors.enabled: true
http.cors.allow-origin: "*"

docker restart es

kibana部署

docker run --name kibana -p 5601:5601 -d -e ELASTICSEARCH_URL=http://192.168.21.102:9200 -v /data1/containers/kibana/data/:/usr/share/kibana/data/ kibana:7.13.2

修改yml配置
docker exec -it kibana /bin/bash
vi config.kibana.yml
修改es url

重启docker
docker restart kibana

logstash部署

docker启动，映射要采集的日志（以nginx access日志为例）和logstash的配置文件。

docker run --name logstash -d -v /data1/log:/var/log2 -v /data1/elk/logstash_aiops:/usr/share/logstash/pipeline logstash:7.13.2

logstash 配置文件结构为

logstash_aiops
├── aiops_patterns
│ └── nginx_pattern
└── logstash.conf

bash-4.2$ vi nginx_pattern

NGINXACCESS %{IP:remote_ip} \- \- \[%{HTTPDATE:timestamp}\] %{QS:request} %{NUMBER:status} %{NUMBER:bytes} %{QS:referer} %{QS:agent}

bash-4.2$ vi logstash.conf

input {
file {
path => "/var/log2/access.log"
start_position => "beginning"
}
}

filter {
grok {
match => {"message" => "%{NGINXACCESS}"}
}
}

output {
elasticsearch {
hosts => "http://localhost:9200"
index => "logstash"
}
}

docker内修改yml配置

docker exec -it logstash/bin/bash

vi logstash.yml

http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.hosts: [ "http://localhost:9200" ]

重启docker

docker restart logstash

ELK部署

原文：https://www.cnblogs.com/zcsh/p/14943838.html