友情提醒：es和kibana的版本最好一致

0.准备工作

mkdir -p  /home/elasticsearch/data/ 
mkdir -p  /home/elasticsearch/config/
mkdir -p  /home/elasticsearch/plugins/
chmod -R 777 /home/elasticsearch

 编写配置文件

echo 'http.host: 0.0.0.0
http.cors.enabled: true
http.cors.allow-origin: "*" '>>/home/elasticsearch/config/elasticsearch.yml

1.elasticsearch

docker pull elasticsearch:7.8.0

单机启动

docker run --name elasticsearch -p 9200:9200 \-p 9300:9300 \-e "discovery.type=single-node" \-e ES_JAVA_OPTS="-Xms64m -Xmx128m" \-v /home/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \-v /home/elasticsearch/data:/usr/share/elasticsearch/data \-v /home/elasticsearch/plugins:/usr/share/elasticsearch/plugins \-d elasticsearch:7.8.0

验证： 访问http://localhost:9200

 2.ik分词器

推荐离线下载

Releases · infinilabs/analysis-ik · GitHub

找到自己想要的版本，最好跟es版本一样

然后解压到设置的插件挂载目录(/home/elasticsearch/plugins)里面，重新命名为ik

3.kibana

docker pull kibana:7.8.0

正常启动：

docker run -d \
--name kibana \
-e ELASTICSEARCH_HOSTS=你的es地址:9200 \
-p 5601:5601  \
kibana:7.8.0

启动大概等个半分钟那样，然后输入地址http://localhost:5601

4.logstash

docker pull logstash:7.8.0

启动

docker run -d --name=logstash logstash:7.8.0

把配置文件拷贝下来，省得自己写

docker cp logstash:/usr/share/logstash /data/logstash
mkdir /data/logstash/logstash/config/conf.d
chmod 777 -R /data/logstash

/data/logstash是挂载文件的地址

/data/logstash/logstash是从docker里面拷贝下来的配置文件

修改配置文件里的es地址

vi /data/logstash/logstash/config/logstash.yml

http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.hosts: [ "你的es地址:9200" ]
path.config: /usr/share/logstash/config/conf.d/*.conf
path.logs: /usr/share/logstash/logs

编写输入输出的配置文件，我这里数据读取以kafka为例，数据输出的es

vi /data/logstash/logstash/config/conf.d/projectlog.conf

input {kafka {topics => "project_log"  #kafka的topicbootstrap_servers => ["kafka地址"]  #kafka服务器地址codec => "json"  #以Json格式取数据   }
}
output {elasticsearch {hosts => ["你的es地址"]  #ES地址index => "project_log-%{+YYYY.MM.dd}"    #ES index，必须使用小写字母     #user => "elastic"      #这里建议使用  elastic 用户#password => "**********"}
}

最后重启logstash就好了

docker stop logstash的container Id

docker run -d \--name=logstash \--restart=always \-p 5044:5044 \-v /data/logstash/logstash:/usr/share/logstash \logstash:7.8.0