ELK7.17.3环境搭建

Posted on 2022-07-10

安装es

mkdir -p /Users/dongfengfan/docker/es/data  /Users/dongfengfan/docker/es/data/plugins /Users/dongfengfan/docker/es/config

vi /Users/dongfengfan/docker/es/config/es.yml

#开启跨域
http.cors.enabled: true
http.cors.allow-origin: "*"

#节点名称
node.name: "node-1"
#节点ip 单机默认回环地址 集群必须绑定真实ip
network.host: 0.0.0.0
#集群名称
cluster.name: es-cluster


docker run -p 9200:9200 -p 9300:9300 --name elasticsearch \
-e "discovery.type=single-node" \
-e "cluster.name=elasticsearch" \
-e "ES_JAVA_OPTS=-Xms256m -Xmx256m" \
-v /Users/dongfengfan/docker/es/data/plugins:/usr/share/elasticsearch/plugins \
-v /Users/dongfengfan/docker/es/data:/usr/share/elasticsearch/data \
-v /Users/dongfengfan/docker/es/config/es.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
-d elasticsearch:7.17.3

-- 安装IK分词器
docker exec -it elasticsearch bash

./bin/elasticsearch-plugin install https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v7.17.3/elasticsearch-analysis-ik-7.17.3.zip

exit

下载 https://github.com/medcl/elasticsearch-analysis-ik/releases/download/v7.17.3/elasticsearch-analysis-ik-7.17.3.zip

将config目录copy至/Users/dongfengfan/docker/es/data/plugins/analysis-ik

rm /Users/dongfengfan/docker/es/data/plugins/.DS_Store

docker restart elasticsearch

测试IK分词器
127.0.0.1:9200/_analyze
{ “analyzer”: “ik_smart”, “text”: “我是中国人” }

image.png

logstash

mkdir /Users/dongfengfan/docker/logstash
vi /Users/dongfengfan/docker/logstash/logstash.conf

input {
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4560
    codec => json_lines
    type => "record"
  }
}
filter{
  if [type] == "record" {
    mutate {
      remove_field => "port"
      remove_field => "host"
      remove_field => "@version"
    }
    json {
      source => "message"
      remove_field => ["message"]
    }
  }
}
output {
  elasticsearch {
    hosts => "es:9200"
    index => "fdf-%{type}-%{+YYYY.MM.dd}"
  }
}



docker run --name logstash -p 4560:4560 \
--link elasticsearch:es \
-v /Users/dongfengfan/docker/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf \
-d logstash:7.17.3

--进入容器内部,安装json_lines插件
docker exec -it logstash /bin/bash
logstash-plugin install logstash-codec-json_lines

安装kibana

docker run --name kibana -p 5601:5601 \
--link elasticsearch:es \
-e "elasticsearch.hosts=http://es:9200" \
-d kibana:7.17.3

进入浏览器访问127.0.0.1:5601进入kibana页面。
下篇我们在讲springboot整合elk