一、创建ELK目录

mkdir -p /opt/docker/elk/elasticsearch/config
mkdir -p /opt/docker/elk/elasticsearch/data
mkdir -p /opt/docker/elk/elasticsearch/logs
mkdir -p /opt/docker/elk/logstash/config
mkdir -p /opt/docker/elk/logstash/data
mkdir -p /opt/docker/elk/logstash/logs
mkdir -p /opt/docker/elk/kibana/config
mkdir -p /opt/docker/elk/kibana/data
mkdir -p /opt/docker/elk/kibana/logs

💡创建完成后检查文件系统中是否创建成功

二、创建docker-compose.yaml用于集成配置部署

2.1 切换到elk目录

cd /opt/docker/elk

2.2 创建docker-compose.yaml文件

touch docker-compose.yaml

将以下内容填写进去：

version: '3.7'
 
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.14.3
    container_name: elasticsearch
    volumes:
      -  ./elasticsearch/data:/usr/share/elasticsearch/data:rw
      -  ./elasticsearch/logs:/usr/share/elasticsearch/logs:rw
    environment:
      - node.name=elasticsearch
      - discovery.type=single-node
      - cluster.name=docker-cluster
      - bootstrap.memory_lock=true
      - xpack.security.enabled=false
      - xpack.monitoring.collection.enabled=true
      - ES_JAVA_OPTS=-Xms512m -Xmx512m
    ulimits:
      memlock:
        soft: -1
        hard: -1
    ports:
      - "9200:9200"
    networks:
      - elk
    restart: always
 
  logstash:
    image: docker.elastic.co/logstash/logstash:8.14.3
    container_name: logstash
    volumes:
      -  ./logstash/data:/usr/share/logstash/data:rw
      -  ./logstash/logs:/usr/share/logstash/logs:rw
      -  ./logstash/config/ls.conf:/usr/share/logstash/pipeline/logstash.conf
    environment:
      - LS_JAVA_OPTS=-Xms256m -Xmx256m
    ports:
      - "4560:4560"
      - "5044:5044"
    networks:
      - elk
    restart: always
 
  kibana:
    image: docker.elastic.co/kibana/kibana:8.14.3
    container_name: kibana
    volumes:
      -  ./kibana/data:/usr/share/kibana/data:rw
      -  ./kibana/logs:/usr/share/kibana/logs:rw
    environment:
      ELASTICSEARCH_HOSTS: http://elasticsearch:9200
    ports:
      - "5601:5601"
    networks:
      - elk
    restart: always
 

networks:
  elk: 
    driver: bridge

2.3 对于logstash需要写一个配置文件

💡配置日志的接收与存储，实现从TCP接收日志到elasticsearch存储的完整链路

创建ls.conf

cd /opt/docker/elk/logstash/config
touch ls.conf

内容如下：

input {
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4560
    codec => json_lines
  }
}
output {
  elasticsearch {
    hosts => "elasticsearch:9200"
    index => "application-%{+YYYY.MM.dd}"
  }
}

2.4 保存退出并运行以下脚本

💡执行前请设置elasticsearch、logstash、kibana三个文件夹的777权限

chmod 777 elasticsearch
chmod 777 logstash
chmod 777 kibana

docker-compose up -d

拉取时间较长，耐心等待pull完成后，在宝塔面板侧边栏docker查看创建是否成功

三、注意事项

3.1 版本

💡本文档记录的是elasticsearch、logstash、kibana的8.14.3版本的安装及配置过程

3.2 数据卷挂载

elasticsearch

volumes:
      -  ./elasticsearch/data:/usr/share/elasticsearch/data:rw
      -  ./elasticsearch/logs:/usr/share/elasticsearch/logs:rw

logstash

volumes:
      -  ./logstash/data:/usr/share/logstash/data:rw
      -  ./logstash/logs:/usr/share/logstash/logs:rw
      -  ./logstash/config/ls.conf:/usr/share/logstash/pipeline/logstash.conf

kibana

volumes:
      -  ./kibana/data:/usr/share/kibana/data:rw
      -  ./kibana/logs:/usr/share/kibana/logs:rw

💡其中，es挂载出来防止数据丢失，要保证给予读写权限

四、运行ip:5601检查系统是否成功部署