ELK 是 Elasticsearch、Logstash 和 Kibana 三个开源项目的首字母缩写。这三个工具组合在一起，形成了一个强大的日志管理和分析平台，在企业级日志处理、监控和搜索等领域应用广泛

Elasticsearch：是一个基于 Lucene 的分布式搜索和分析引擎，具有高可扩展性、高可用性等特点。它能够存储大量的数据，并提供快速的搜索和分析功能。在 ELK 栈中，它主要负责存储和索引由 Logstash 收集和处理后的日志数据，以便后续的查询和分析

Logstash：是一个数据收集、处理和转发的工具。它可以从各种数据源（如文件、数据库、系统日志等）收集数据，对数据进行过滤、转换和丰富，然后将处理后的数据发送到 Elasticsearch 进行存储

Kibana：是一个基于 Web 的可视化工具，与 Elasticsearch 集成，用于展示和探索 Elasticsearch 中的数据。用户可以通过 Kibana 创建各种可视化图表（如柱状图、折线图、饼图等）、仪表盘，进行数据的交互式分析和查询

IK 分词器是一个专为 Elasticsearch 设计的中文分词插件，它基于 Lucene 的 IK 分词器，旨在提供高效、准确的中文分词能力。在 Elasticsearch 中，分词器是一个关键组件，用于将文本切分成独立的词语或标记，以便进行索引和搜索。由于中文语言的特殊性，默认的分词器对中文处理效果不佳，因此需要使用专门的中文分词器，IK 分词器就是其中一种常用的选择

 

服务器需要开放端口

• 5044：Logstash Beats 输入
• 50000：Logstash TCP 输入
• 9600：Logstash 监控 API
• 9200：Elasticsearch HTTP
• 9300：Elasticsearch TCP 传输
• 5601：Kibana

环境提前配置

Important system configuration | Elasticsearch Guide [8.17] | Elastic

GET项目文件到/home/docker-elk

git clone https://github.com/deviantony/docker-elk.git /home/docker-elk

 创建目录

/home/docker-elk

mkdir -p /home/docker-elk/elasticsearch/{data,plugins}
chmod 777 /home/docker-elkelasticsearch/

下载IK分词器解压

wget -P /home/docker-elk/elasticsearch/plugins https://get.infini.cloud/elasticsearch/analysis-ik/8.17.3

cd /home/docker-elk/elasticsearch/plugins
unzip elasticsearch-analysis-ik-8.17.3.zip

修改文件

/home/docker-elk/docker-compose.yml

services:

  # The 'setup' service runs a one-off script which initializes users inside
  # Elasticsearch — such as 'logstash_internal' and 'kibana_system' — with the
  # values of the passwords defined in the '.env' file. It also creates the
  # roles required by some of these users.
  #
  # This task only needs to be performed once, during the *initial* startup of
  # the stack. Any subsequent run will reset the passwords of existing users to
  # the values defined inside the '.env' file, and the built-in roles to their
  # default permissions.
  #
  # By default, it is excluded from the services started by 'docker compose up'
  # due to the non-default profile it belongs to. To run it, either provide the
  # '--profile=setup' CLI flag to Compose commands, or "up" the service by name
  # such as 'docker compose up setup'.
  setup:
    profiles:
      - setup
    build:
      context: setup/
      args:
        ELASTIC_VERSION: ${ELASTIC_VERSION}
    init: true
    volumes:
      - ./setup/entrypoint.sh:/entrypoint.sh:ro,Z
      - ./setup/lib.sh:/lib.sh:ro,Z
      - ./setup/roles:/roles:ro,Z
    environment:
      ELASTIC_PASSWORD: ${ELASTIC_PASSWORD:-}
      LOGSTASH_INTERNAL_PASSWORD: ${LOGSTASH_INTERNAL_PASSWORD:-}
      KIBANA_SYSTEM_PASSWORD: ${KIBANA_SYSTEM_PASSWORD:-}
      METRICBEAT_INTERNAL_PASSWORD: ${METRICBEAT_INTERNAL_PASSWORD:-}
      FILEBEAT_INTERNAL_PASSWORD: ${FILEBEAT_INTERNAL_PASSWORD:-}
      HEARTBEAT_INTERNAL_PASSWORD: ${HEARTBEAT_INTERNAL_PASSWORD:-}
      MONITORING_INTERNAL_PASSWORD: ${MONITORING_INTERNAL_PASSWORD:-}
      BEATS_SYSTEM_PASSWORD: ${BEATS_SYSTEM_PASSWORD:-}
    networks:
      - elk
    depends_on:
      - elasticsearch

  elasticsearch:
    build:
      context: elasticsearch/
      args:
        ELASTIC_VERSION: ${ELASTIC_VERSION}
    volumes:
      - ./elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml:ro,Z
      - ./elasticsearch/data:/usr/share/elasticsearch/data:Z
    ports:
      - 9200:9200
      - 9300:9300
    environment:
      node.name: elasticsearch
      ES_JAVA_OPTS: -Xms5g -Xmx151g
      # Bootstrap password.
      # Used to initialize the keystore during the initial startup of
      # Elasticsearch. Ignored on subsequent runs.
      ELASTIC_PASSWORD: ${ELASTIC_PASSWORD:-}
      # Use single node discovery in order to disable production mode and avoid bootstrap checks.
      # see: https://www.elastic.co/guide/en/elasticsearch/reference/current/bootstrap-checks.html
      discovery.type: single-node
    networks:
      - elk
    restart: unless-stopped

  logstash:
    build:
      context: logstash/
      args:
        ELASTIC_VERSION: ${ELASTIC_VERSION}
    volumes:
      - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml:ro,Z
      - ./logstash/pipeline:/usr/share/logstash/pipeline:ro,Z
    ports:
      - 5044:5044
      - 50000:50000/tcp
      - 50000:50000/udp
      - 9600:9600
    environment:
      LS_JAVA_OPTS: -Xms1g -Xmx5g
      LOGSTASH_INTERNAL_PASSWORD: ${LOGSTASH_INTERNAL_PASSWORD:-}
    networks:
      - elk
    depends_on:
      - elasticsearch
    restart: unless-stopped

  kibana:
    build:
      context: kibana/
      args:
        ELASTIC_VERSION: ${ELASTIC_VERSION}
    volumes:
      - ./kibana/config/kibana.yml:/usr/share/kibana/config/kibana.yml:ro,Z
    ports:
      - 5601:5601
    environment:
      KIBANA_SYSTEM_PASSWORD: ${KIBANA_SYSTEM_PASSWORD:-}
    networks:
      - elk
    depends_on:
      - elasticsearch
    restart: unless-stopped

networks:
  elk:
    driver: bridge

volumes:
  elasticsearch:

 

/home/docker-elk/.env 修改自己想要的密码

 

/home/docker-elk/setup/Dockerfile

ARG ELASTIC_VERSION

# https://www.docker.elastic.co/
FROM elasticsearch:${ELASTIC_VERSION:-8.17.3}


#$FROM docker.elastic.co/elasticsearch/elasticsearch:{ELASTIC_VERSION:-8.17.3}

ENTRYPOINT ["/entrypoint.sh"]

 

 /home/docker-elk/elasticsearch/Dockerfile

ARG ELASTIC_VERSION

# https://www.docker.elastic.co/
#FROM docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_VERSION:-8.17.3}
FROM elasticsearch:${ELASTIC_VERSION:-8.17.3}
# Add your elasticsearch plugins setup here
#RUN elasticsearch-plugin install ik
COPY plugins plugins

 

/home/docker-elk/kibana/Dockerfile

ARG ELASTIC_VERSION

# https://www.docker.elastic.co/
#FROM docker.elastic.co/kibana/kibana:${ELASTIC_VERSION:-8.17.3}
FROM kibana:${ELASTIC_VERSION:-8.17.3}
# Add your kibana plugins setup here
# Example: RUN kibana-plugin install <name|url>

 

/home/docker-elk/logstash/Dockerfile

ARG ELASTIC_VERSION

# https://www.docker.elastic.co/
#FROM docker.elastic.co/logstash/logstash:${ELASTIC_VERSION:-8.17.3}
FROM logstash:${ELASTIC_VERSION:-8.17.3}
# Add your logstash plugins setup here
# Example: RUN logstash-plugin install logstash-filter-json

 

 

启动

 

初始化docker-elk所需的Elasticsearch用户和组：

docker compose up setup

如果一切顺利，并且设置完成且没有错误，请启动其他堆栈组件：

docker compose up

重新启动 Logstash 和 Kibana

docker compose up -d logstash kibana