elk的威名大家都知道,以前前司有专门的人维护,现在换了环境,实在不想上服务器看,所以就摸索下自己搭建,由于现场服务器是需要类似向日葵那样连接,我还是把日志弄回来,自己本地filebeat上传到es中
配置文件
没啥好说的,就是volume 需要根据自己的环境调整。这里的 ". "相当于你的docker-compose.yml文件所在的目录层级!
- docker-compose
version: '3.2'
services:
elasticsearch:
image: elasticsearch:7.17.4
volumes:
- ./es/plugins:/usr/share/elasticsearch/plugins #插件文件挂载
- ./es/data:/usr/share/elasticsearch/data #数据文件挂载
ports:
- '9200:9200'
- '9300:9300'
container_name: elasticsearch
restart: always
environment:
- 'cluster.name=elasticsearch' #设置集群名称为elasticsearch
- 'discovery.type=single-node' #以单一节点模式启动
- 'ES_JAVA_OPTS=-Xms1024m -Xmx1024m' #设置使用jvm内存大小
networks:
- elk
logstash:
image: logstash:7.17.4
container_name: logstash
restart: always
volumes:
- ./logstash/my-logstash.conf:/usr/share/logstash/config/my-logstash.conf
- ./logstash/logs:/var/logs/demo
ports:
- '5044:5044/tcp'
- '50000:50000/tcp'
- '50000:50000/udp'
- '9600:9600'
environment:
LS_JAVA_OPTS: -Xms1024m -Xmx1024m
TZ: Asia/Shanghai
MONITORING_ENABLED: false
entrypoint:
- logstash
- -f
- /usr/share/logstash/config/my-logstash.conf
links:
- elasticsearch:es #可以用es这个域名访问elasticsearch服务
networks:
- elk
depends_on:</