为啥装这套东西?
原因:Logstash收集系统日志,将日志以json的形式发送给ElasticSearch存储,用Kibana客户端打开来查看日志信息。
不用Docker大概弄个半天以上,现在10分钟搞定。
1、下载镜像文件
docker pull elasticsearch:5.6.11 docker pull kibana:5.6.11 docker pull logstash:5.6.15
2、创建实例
ElasticSearch
mkdir -p /mydata/elasticsearch/config mkdir -p /mydata/elasticsearch/data echo "http.host: 0.0.0.0" >> /mydata/elasticsearch/config/elasticsearch.yml
docker run --name elasticsearch -p 9200:9200 -p 9300:9300 \ -e "discovery.type=single-node" \ -e ES_JAVA_OPTS="-Xms256m -Xmx256m" \ -v /mydata/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \ -v /mydata/elasticsearch/data:/usr/share/elasticsearch/data -d elasticsearch:5.6.11
特别注意:
-e ES_JAVA_OPTS="-Xms256m -Xmx256m" \ 测试环境下,设置ES的初始内存和最大内存,否则导致过大启动不了ES
Kibana
docker run --name kibana -e ELASTICSEARCH_URL=http://192.168.31.128:9200 -p 5601:5601 \ -d kibana:5.6.11
Logstash
mkdir -p /mydata/logstash vim /mydata/logstash/logstash.conf
1)、在mydata/logstash中创建logstash.conf文件:文件内容如下
input { tcp { port => 4560 codec => json_lines } } output{ elasticsearch { hosts => ["192.168.31.128:9200"] index => "applog" } stdout { codec => rubydebug } }
2)启动
docker run -d -p 4560:4560 \ -v /mydata/logstash/logstash.conf:/etc/logstash.conf \ --link elasticsearch:elasticsearch \ --name logstash logstash:5.6.15 \ logstash -f /etc/logstash.conf
3)检查是否有logstash-codec-json_lines插件,如果没有侧安装
安装插件:
https://github.com/logstash-plugins
docker exec –it logstash /bin/bash cd /usr/share/logstash/bin
查看插件
logstash-plugin list
安装插件
logstash-plugin install logstash-codec-json_lines