基于docker安装ELK

docker pull docker.elastic.co/elasticsearch/elasticsearch:6.3.2

docker run -d --name es -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" docker.elastic.co/elasticsearch/elasticsearch:6.3.2

docker exec -it es /bin/bash

            
                # 显示文件
ls
结果如下：
LICENSE.txt  README.textile  config  lib   modules
NOTICE.txt   bin             data    logs  plugins
# 进入配置文件夹
cd config
# 显示文件
ls
结果如下：
elasticsearch.keystore  ingest-geoip  log4j2.properties  roles.yml  users_roles
elasticsearch.yml       jvm.options   role_mapping.yml   users
# 修改配置文件
vi elasticsearch.yml
#==========================================重点在这==================================
# 加入跨域配置
http.cors.enabled: true
http.cors.allow-origin: "*"

            VI使用三个命令：


            1） 修改命令 shift + i；

2）退出修改模式esc；

3）保存退出shift + :  wq

docker restart es 

http://localhost:9200/

            {
  
            "
            name
            " : "Y4XWRMb",
  "cluster_name" : "docker-cluster",
  "cluster_uuid" : "QFkmUQb2Q4OaF_Jv_LTISg",
  "version" : {
    "number" : "6.3.2",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "053779d",
    "build_date" : "2018-07-20T05:20:23.451332Z",
    "build_snapshot" : false,
    "lucene_version" : "7.3.1",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  },
  "tagline" : "You Know, for Search"
}

docker pull mobz/elasticsearch-head:5

docker run -d --name es_admin -p 9100:9100 mobz/elasticsearch-head:5

http://localhost:9100/

docker pull docker.elastic.co/logstash/logstash:6.2.4

docker run --name es_logstash docker.elastic.co/logstash/logstash:6.2.4

            
                #进入容器
docker exec -it es_logstash /bin/bash
#进入config目录，并修改配置文件
ls
cd config
vi logstash.yml

#修改内容如下
http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.url: http://192.168.1.3:9200xpack.monitoring.elasticsearch.username: elastic
xpack.monitoring.elasticsearch.password: changme

docker pull docker.elastic.co/kibana/kibana:6.3.2

docker run --name es_kibana -p 5601:5601 -d -e ELASTICSEARCH_URL=http://192.168.1.3:9200 kibana:6.3.2

http://127.0.0.1:5601

            
                #进入容器
docker exec -it es_logstash /bin/bash
#修改
ls
cd pipeline
ls
vi logstash.conf

            #原来的
#========================================
#input {
#  beats {
#    port => 5044
#  }
#}

#output {
#  stdout {
#    codec => rubydebug
#  }
#}
#========================================
            
                
#添加的部分
input {
        file {
            codec=> json
                path => "/usr/local/*.json"
        }
}
filter {
  #定义数据的格式
  grok {
    match => { "message" => "%{DATA:timestamp}\|%{IP:serverIp}\|%{IP:clientIp}\|%{DATA:logSource}\|%{DATA:userId}\|%{DATA:reqUrl}\|%{DATA:reqUri}\|%{DATA:refer}\|%{DATA:device}\|%{DATA:textDuring}\|%{DATA:duringTime:int}\|\|"}
  }
}
output {
   elasticsearch{
     hosts=> "http://192.168.1.3:9200"
   }
}