elk分布式日志搭建-docker快速部署

# 1.创建虚拟网络
docker network create elk

#2.创建elasticsearch
docker run  --name elasticsearch  -e  ES_JAVA_OPTS="-Xms512m -Xmx512m" -e "discovery.type=single-node" --net=elk  -d -p 10092:9200 -p 10093:9300 elasticsearch:7.12.1

#3.查看网络
sudo docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' elasticsearch

#4.创建 kibana
sudo docker run -d --name kibana --net elk -p 10256:5601 kibana:7.12.1

input {
    tcp {
        port => 3456
        codec => "json"
    }
}
output {

    elasticsearch { hosts => ["172.18.0.2:9200"] } #docker虚拟网络的ip地址
  stdout { codec => rubydebug }
}   

docker run  --name logstash  -d 
            -v /data/logstash/config:/config-dir 
            -p 10345:3456 
            --net elk 
            logstash:7.12.1 
            logstash -f /data/logstash/config/logstash.conf
            
            

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.12.1-linux-x86_64.tar.gz
tar xzvf filebeat-7.12.1-linux-x86_64.tar.gz


#修改 filebeat.yml 以设置连接信息：

output.elasticsearch:
  hosts: [""] #172.20.0.2:9200
  username: "elastic"
  password: "" 
setup.kibana:
  host: ""#172.20.0.4:5601
  
  

#启动
./filebeat modules enable kibana


#setup 命令加载 Kibana 仪表板。如果仪表板已设置，请省略此命令。
./filebeat setup
./filebeat -e