一、安装ui

（1）中文docker网页管理
https://www.dockernb.com/

1. docker run -d --name ui --restart always -p 16001:8081 -v /var/run/docker.sock:/var/run/docker.sock wangbinxingkong/fast

2. 用户初始账号/密码：admin/888888

 

（2）油猴脚本，把@match后面的127.0.0.1:16001改成实际ip:端口

// ==UserScript==
// @name         New Userscript
// @namespace    http://tampermonkey.net/
// @version      0.1
// @description  try to take over the world!
// @author       You
// @match        http://127.0.0.1:16001/pc/
// @grant        none
// ==/UserScript==

(function() {
    'use strict';

    // Your code here...
    document.querySelector("#app > section > section > header").remove()
    document.querySelector("#app > section > section > main > div.footer > p").remove()

    setTimeout(function(){
        let name = document.querySelector("#app > section > section > main > div.main.clearfix > div > div > div > p:nth-child(3) > input[type=text]")
        let pass = document.querySelector("#app > section > section > main > div.main.clearfix > div > div > div > p:nth-child(5) > input[type=password]")
        let login = document.querySelector("#app > section > section > main > div.main.clearfix > div > div > div > p.submit > button")
        console.log(name)
        console.log(pass)
        if(name && pass){
            console.log(login)
            name.value = "admin"
            name.dispatchEvent(new Event('input'))
            pass.value = "888888"
            pass.dispatchEvent(new Event('input'))
            login.click()
        }
    }, 700);
    
})();

 

 

二、安装efk

一、快速安装
1. -- 下镜像

1.1 有网
docker pull docker.elastic.co/elasticsearch/elasticsearch:6.8.9
docker pull docker.elastic.co/kibana/kibana:6.8.9
docker pull fluent/fluentd:v1.3.2-debian-1.0

// 不能用7.10.x版本，因为es版本低，会拿不到模板
docker pull store/elastic/filebeat:7.4.1

1.2 没网
导出
docker save docker.elastic.co/elasticsearch/elasticsearch:6.8.9 -o /home/efk-e
docker save docker.elastic.co/kibana/kibana:6.8.9 -o /home/efk-k
docker save fluent/fluentd:v1.3.2-debian-1.0 -o /home/efk-f
导入
docker load -i /home/efk-e
docker load -i /home/efk-k
docker load -i /home/efk-f

2. -- 运行
docker run -itd --name efk-e --network host  -e discovery.type=single-node --restart always docker.elastic.co/elasticsearch/elasticsearch:6.8.9
// network.host这个版本默认已是0.0.0.0，用来允许外部主机访问  
# docker run -itd --name efk-e --network host  -e DISCOVERY_TYPE=SINGLE-NODE -e NETWORK_HOST=0.0.0.0 --restart always docker.elastic.co/elasticsearch/elasticsearch:6.8.9
docker run -itd --name efk-k --network host  -e I18N_LOCALE=zh-CN -e ELASTICSEARCH_URL=http://127.0.0.1:9200 --restart always docker.elastic.co/kibana/kibana:6.8.9

得映射配置文件
docker run -itd --name efk-f --network host -v /a_soft/efk/fluentd/conf:/fluentd/etc --restart always fluent/fluentd:v1.3.2-debian-1.0
docker run -itd --name efk-fb --restart=always --user=root  -v /a_soft/efk/filebeat/conf/filebeat.yml:/usr/share/filebeat/filebeat.yml -v /home:/log store/elastic/filebeat:7.4.1

二、其他说明
1. -- 端口
elasticsearch: 9200
kibana：5601

fluentd: 8888 8889 24224

2. -- 配置文件
#fluent.conf
<source>
    @type forward
    port 24224
    bind 0.0.0.0
</source>

<match *.**>
    @type copy
    <store>
        @type elasticsearch
        host 192.168.1.9
        port 9200
        logstash_format true
        logstash_prefix fluentd
        logstash_dateformat %Y.%m.%d
        include_tag_key true
        type_name access_log
        tag_key @log_name
        flush_interval 1s
    </store>
    <store>
        @type stdout
    </store>
</match>

#filebeat.yml
#=========================== Filebeat inputs =============================

filebeat.inputs:

# 错误日志
- type: log
  enabled: true
  encoding: gbk
  paths:
    - d:\a_file\a*.txt
  fields:
    type: test-a
  
  #scan_frequency: 10s
  #close_inactive: 5m
  close_renamed: true
  #clean_inactive: 7d
  
  
# 普通日志
- type: log
  enabled: true
  encoding: gbk
  paths:
    - d:\a_file\b*.txt
  fields:
    type: test-b
    
  #scan_frequency: 10s
  #close_inactive: 5m
  close_renamed: true
  #clean_inactive: 168h
  
  

#============================= Filebeat modules ===============================

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

  
  
#============================== Template =====================================
  
setup.template.name: test
setup.template.pattern: test-*

#================================ Outputs =====================================

#-------------------------- Elasticsearch output ------------------------------

output.elasticsearch:
  hosts: ["192.168.1.9:9200"]
  index: "test-default-%{+yyyy.MM.dd}"
  indices:
    - index: "test-a-%{+yyyy.MM.dd}"
      when.equals:
        fields.type: "test-a"
    - index: "test-b-%{+yyyy.MM.dd}"
      when.equals:
        fields.type: "test-b"
  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"
 

#================================ Processors =====================================

# Configure processors to enhance or manipulate events generated by the beat.

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~