Elasticsearch默认使用mmapfs目录来存储索引。操作系统默认的mmap计数太低可能导致内存不足,我们可以使用下面这条命令来增加内存:
sysctl -w vm.max_map_count=262144
创建Elasticsearch数据挂载路径:
mkdir -p /sunsas/elasticsearch/data
对该路径授予777权限:
chmod 777 /sunsas/elasticsearch/data
创建Elasticsearch插件挂载路径:
mkdir -p /sunsas/elasticsearch/plugins
创建Logstash配置文件存储路径:
mkdir -p /sunsas/logstash
在该路径下创建logstash-febs.conf
配置文件(没有安装vim的话可以使用yum install vim
命令安装):
vim /sunsas/logstash/logstash-sunsas.conf
内容如下(注意先进入INSERT模式,不要输错):
input { tcp { mode => "server" host => "0.0.0.0" port => 4560 codec => json_lines } } output { elasticsearch { hosts => "es:9200" index => "febs-logstash-%{+YYYY.MM.dd}" } }
创建ELK Docker Compose文件存储路径:
mkdir -p /sunsas/elk
在该目录下创建docker-compose.yml
文件:
vim /sunsas/elk/docker-compose.yml
内容如下:
version: '3' services: elasticsearch: image: elasticsearch:6.4.1 container_name: elasticsearch environment: - "cluster.name=elasticsearch" #集群名称为elasticsearch - "discovery.type=single-node" #单节点启动 - "ES_JAVA_OPTS=-Xms512m -Xmx512m" #jvm内存分配为512MB volumes: - /febs/elasticsearch/plugins:/usr/share/elasticsearch/plugins - /febs/elasticsearch/data:/usr/share/elasticsearch/data ports: - 9200:9200 kibana: image: kibana:6.4.1 container_name: kibana links: - elasticsearch:es #配置elasticsearch域名为es depends_on: - elasticsearch environment: - "elasticsearch.hosts=http://es:9200" #因为上面配置了域名,所以这里可以简写为http://es:9200 ports: - 5601:5601 logstash: image: logstash:6.4.1 container_name: logstash volumes: - /febs/logstash/logstash-febs.conf:/usr/share/logstash/pipeline/logstash.conf depends_on: - elasticsearch links: - elasticsearch:es ports: - 4560:4560
切换到/sunsas/elk
目录下,使用如下命令启动:
docker-compose up -d
第一次启动需要下载,启动完成后,查看docker容器:
docker ps -a