1、前言 ELK由Elastaicsearch、Logstash和Kibana组合,如下图所示,Logstash从各种不同的数据源收集数据,通过内置的管道对输入的数据进行加工。最终,这些数据会被存储到Elastaicsearch中供Kibana完成数据可视化。 2、创建Docker自定义网络dockernetworkcreateesnet 3、Elasticsearch安装镜像拉取dockerpullelasticsearch:7。6。2Docker运行dockerrundnameelasticsearchnetesnetp9200:9200p9300:9300ediscovery。typesinglenodeelasticsearch:7。6。2配置elasticsearch。yml添加http。cors。enabled:truehttp。cors。alloworigin:http。cors。allowheaders:Authorizationxpack。security。enabled:truexpack。security。transport。ssl。enabled:true配置完成后,重启elasticsearch容器dockerexecitelasticsearchbash执行binelasticsearchsetuppasswordsinteractive〔rootnode01elasticsearch7。7。0〕binelasticsearchsetuppasswordsinteractivefutureversionsofElasticsearchwillrequireJava11;yourJavaversionfrom〔optappjdk1。8。0181jre〕doesnotmeetthisrequirementInitiatingthesetupofpasswordsforreserveduserselastic,apmsystem,kibana,logstashsystem,beatssystem,remotemonitoringuser。Youwillbepromptedtoenterpasswordsastheprocessprogresses。Pleaseconfirmthatyouwouldliketocontinue〔yN〕yEnterpasswordfor〔elastic〕:Reenterpasswordfor〔elastic〕:Enterpasswordfor〔apmsystem〕:Reenterpasswordfor〔apmsystem〕:Enterpasswordfor〔kibana〕:Reenterpasswordfor〔kibana〕:Enterpasswordfor〔logstashsystem〕:Reenterpasswordfor〔logstashsystem〕:Enterpasswordfor〔beatssystem〕:Reenterpasswordfor〔beatssystem〕:Enterpasswordfor〔remotemonitoringuser〕:Reenterpasswordfor〔remotemonitoringuser〕:Changedpasswordforuser〔apmsystem〕Changedpasswordforuser〔kibana〕Changedpasswordforuser〔logstashsystem〕Changedpasswordforuser〔beatssystem〕Changedpasswordforuser〔remotemonitoringuser〕Changedpasswordforuser〔elastic〕 4、Kibana安装镜像拉取dockerpullkibana:7。6。2dockerrundnamekibananetesnetp5601:5601kibana:7。6。2配置修改kibanaymlserver。name:kibanaserver。host:0elasticsearch。hosts:〔http:192。168。50。16:9200〕xpack。monitoring。ui。container。elasticsearch。enabled:truei18n。locale:zhCNelasticsearch。username:elasticelasticsearch。password:123456 5、Logstash安装镜像拉取dockerpulllogstash:7。6。2dockerrunitdp5044:5044namelogstashnetesnetlogstash:7。6。2配置修改logstashyml屏蔽掉http。host:0。0。0。0xpack。monitoring。elasticsearch。hosts:〔http:elasticsearch:9200〕宿主拷贝到logstash容器dockercpmysqlconnectorjava8。0。23。jarlogstash:usrsharelogstashconfigdockercplogstashuser。conflogstash:usrsharelogstashpipelinelogstashuser。conf修改配置input{stdin{}jdbc{typeusertrack注意mysql连接地址一定要用ip,不能使用localhost等jdbcconnectionstringjdbc:mysql:192。168。19。113:3306testshop?useUnicodetruecharacterEncodingUTF8autoReconnecttrueuseSSLfalsejdbcuserrootjdbcpassword123456这个jar包的地址是容器内的地址jdbcdriverlibraryusrsharelogstashconfigmysqlconnectorjava8。0。23。jarjdbcdriverclasscom。mysql。jdbc。DriverjdbcpagingenabledtruestatementSELECTFROMtuserloginschedulejdbcdefaulttimezoneAsiaShanghaijdbcpagesize500recordlastruntrueusecolumnvaluetruecleanrunfalse}}output{stdout{codecjsonlines}elasticsearch{注意mysql连接地址一定要用ip,不能使用localhost等hosts192。168。50。16:9200indexuser{type}{YYYY。MM。dd}documentid{id}userelasticpassword123456documenttypedoc}}重启logstash(dockerrestartlogstash)查看日志dockerlogsflogstash