docker-compose

  1. version: "2"
  2. services:
  3.   es-node01:
  4.     container_name: es-node01
  5.     image: docker.elastic.co/elasticsearch/elasticsearch:8.1.0
  6.     restart: always
  7.     mem_limit: 32g
  8.     ports:
  9.       - 9200:9200
  10.       - 9300:9300
  11.     environment:
  12.       - TAKE_FILE_OWNERSHIP=true
  13.       - ES_JAVA_OPTS=-Xms16g -Xmx16g
  14.       - ELASTIC_PASSWORD=${ELASTIC_PASSWORD}
  15.     volumes:
  16.       - ./data/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml
  17.       - ./data/logs:/usr/share/elasticsearch/logs
  18.       - ./data/plugins:/usr/share/elasticsearch/plugins
  19.       - ./data/certs:/usr/share/elasticsearch/config/certs
  20.       - /mnt/disk1/es-data1:/mnt/data1
  21.       - /mnt/disk2/es-data2:/mnt/data2
  22.       - /mnt/disk3/es-data3:/mnt/data3
  23.       - /mnt/disk4/es-data4:/mnt/data4

.env

  1. ELASTIC_PASSWORD=password

data/config/elasticsearch.yml

  2. cluster.name: test-es-cluster
  3. node.name: es-node01
  4. node.roles:
  5.   - master
  6.   - data
  7. network.host: 0.0.0.0
  8. network.publish_host: 192.168.20.21
  9. http.port: 9200
  10. transport.port: 9300
  11. path.data:
  12.   - /mnt/data1
  13.   - /mnt/data2
  14.   - /mnt/data3
  15.   - /mnt/data4
  16. discovery.seed_hosts:
  17.   - 192.168.20.22:9300
  18.   - 192.168.20.23:9300
  19. cluster.initial_master_nodes:
  20.   - es-node01
  21.   - es-node02
  22.   - es-node03
  23. http.cors.enabled: true
  24. http.cors.allow-origin: "*"
  25. xpack.security.enabled: true
  26. xpack.security.http.ssl.enabled: true
  27. xpack.security.http.ssl.key: /usr/share/elasticsearch/config/certs/es-node02.key
  28. xpack.security.http.ssl.certificate: /usr/share/elasticsearch/config/certs/es-node02.crt
  29. xpack.security.http.ssl.certificate_authorities: /usr/share/elasticsearch/config/certs/ca.crt
  30. xpack.security.http.ssl.verification_mode: certificate
  31. xpack.security.transport.ssl.enabled: true
  32. xpack.security.transport.ssl.key: /usr/share/elasticsearch/config/certs/es-node02.key
  33. xpack.security.transport.ssl.certificate: /usr/share/elasticsearch/config/certs/es-node02.crt
  34. xpack.security.transport.ssl.certificate_authorities: /usr/share/elasticsearch/config/certs/ca.crt
  35. xpack.security.transport.ssl.verification_mode: certificate
  36. xpack.license.self_generated.type: basic

生成证书

  1. version: "2.2"
  3. services:
  4.   setup:
  5.     image: docker.elastic.co/elasticsearch/elasticsearch:8.1.0
  6.     volumes:
  7.       - ./certs:/usr/share/elasticsearch/config/certs
  8.     user: "0"
  9.     command: >
  10.       bash -c '
  11.         if [ ! -f certs/ca.zip ]; then
  12.           echo "Creating CA";
  13.           bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
  14.           unzip config/certs/ca.zip -d config/certs;
  15.         fi;
  16.         if [ ! -f certs/certs.zip ]; then
  17.           echo "Creating certs";
  18.           echo -ne \
  19.           "instances:\n"\
  20.           "  - name: es-node01\n"\
  21.           "    dns:\n"\
  22.           "      - es-node01\n"\
  23.           "    ip:\n"\
  24.           "      - 192.168.20.21\n"\
  25.           "  - name: es-node02\n"\
  26.           "    dns:\n"\
  27.           "      - es-node02\n"\
  28.           "    ip:\n"\
  29.           "      - 192.168.20.22\n"\
  30.           "  - name: es-node03\n"\
  31.           "    dns:\n"\
  32.           "      - es-node03\n"\
  33.           "    ip:\n"\
  34.           "      - 192.168.20.23\n"\
  35.           > config/certs/instances.yml;
  36.           bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key;
  37.           unzip config/certs/certs.zip -d config/certs;
  38.         fi;
  39.       '

注意事项

1、echo “vm.max_map_count=262144” > /etc/sysctl.conf ; sysctl -p
2、在容器中，程序是以elasticsearch用户启动的，其uid:gid为1000:1000
如果要绑定挂载本地目录或文件，则elasticsearch用户必须可以读取它。此外，该用户必须具有对配置、数据和日志目录的写入权限。所以要修改本地数据目录uid为1000。

部署参考：
https://www.elastic.co/guide/en/elasticsearch/reference/8.1/docker.html