适合快速构建测试环境日志收集系统，线上日志收集，需要做集群化部署，或直接采购云服务 基于：6.8.22 版本（elasticsearch、filebeat、kibana）

image.png

一、构建 docker-compose

创建统一网络环境：docker network create elk_bridge

1.1、Elasticsearch 启动(单机)

Docker Hub Docker 地址 官方镜像使用案例

  1. version: '2.2'
  2. services:
  3.   es01:
  4.     image: docker.elastic.co/elasticsearch/elasticsearch:6.8.22
  5.     container_name: elasticsearch
  6.     environment:
  7.       ## 指定运行堆大小
  8.       - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
  9.       ## 时区
  10.       - "TZ=Asia/Shanghai"
  11.     ulimits:
  12.       memlock:
  13.         soft: -1
  14.         hard: -1
  15.     volumes:
  16.      ## 持久化数据存放
  17.       - ./data:/usr/share/elasticsearch/data
  18.     ports:
  19.       - 9200:9200
  20.     networks:
  21.       ## 外部定义统一网络
  22.       - elk_bridge
  23. networks:
  24.   elk_bridge: 
  25.     external: true

1.2、Kibana 启动（单机）

官方镜像使用案例

version: '2'
services:
  kibana:
    image: docker.elastic.co/kibana/kibana:6.8.22
    container_name: kibana
    environment:
      SERVER_NAME: kibana
      ELASTICSEARCH_HOSTS: http://elasticsearch:9200
      I18N_LOCALE: zh-CN
      TZ: Asia/Shanghai
    ports:
      - 5601:5601
    networks:
      - elk_bridge
networks:
  elk_bridge:
    external: true

1.3、Filebeat 启动

Filebeat 官方Docker案例

version: '2'
services:
  filebeat:
    image: docker.elastic.co/beats/filebeat:6.8.22
    container_name: filebeat
    volumes:
      - ./conf/filebeat.yml:/usr/share/filebeat/filebeat.yml
      - ./log/:/opt/docker/infrastructure/filebeat/log
      - /var/log/:/var/log
    environment:
      TZ: Asia/Shanghai
    networks:
      - elk_bridge
networks:
  elk_bridge:
    external: true

简单配置：filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/*.log
    - /opt/docker/infrastructure/filebeat/log
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3

setup.kibana:
  host: "kibana:5601"

output.elasticsearch:
  hosts: ["elasticsearch:9200"]

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

二、测试

往 /var/log或 /opt/docker/infrastructure/filebeat/log中放入 nginx 日志

image.png