运行启动脚本：

docker run -e ES_JAVA_OPTS="-Xms512m -Xmx512m" -d -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" \
 -v /Users/jelex/dockerV/es/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml  \
-v /Users/jelex/dockerV/es/data:/usr/share/elasticsearch/data \
-v /Users/jelex/dockerV/es/plugins:/usr/share/elasticsearch/plugins \
--name ES01 arm64v8/elasticsearch:7.17.5

#查看端口ip:

jelex@jelexxudeMacBook-Pro config % docker inspect -f '{{.Name}} - {{.NetworkSettings.IPAddress }}' $(docker ps -aq)
/ES01 - 172.17.0.4

下载对应版本的kibana: https://hub.docker.com/r/arm64v8/kibana/tags?page=1

docker run --name kibana -e ELASTICSEARCH_HOSTS=http://172.17.0.4:9200 -p 5601:5601 -d arm64v8/kibana:7.17.5

http://localhost:5601/app/home#/

下载ik-smart插件：
https://github.com/medcl/elasticsearch-analysis-ik
https://github.com/medcl/elasticsearch-analysis-ik/releases

下载解压放到plugins目录：

编辑IKAnalyzer.cfg.xml：

删除特殊文件：

重启es:

#kibana控制台测试： http://localhost:5601/app/dev_tools#/console

GET _analyze
{
   "analyzer": "ik_smart",
   "text": "徐菜鸟努力study,day day up,金庸先生！贫道酸衡子，敬仰大名～"
}

右侧输出结果：

#! Elasticsearch built-in security features are not enabled. Without authentication, your cluster could be accessible to anyone. See https://www.elastic.co/guide/en/elasticsearch/reference/7.17/security-minimal-setup.html to enable security.
{
  "tokens" : [
    {
      "token" : "徐菜鸟",
      "start_offset" : 0,
      "end_offset" : 3,
      "type" : "CN_WORD",
      "position" : 0
    },
    {
      "token" : "努力",
      "start_offset" : 3,
      "end_offset" : 5,
      "type" : "CN_WORD",
      "position" : 1
    },
    {
      "token" : "study",
      "start_offset" : 5,
      "end_offset" : 10,
      "type" : "ENGLISH",
      "position" : 2
    },
    {
      "token" : "day",
      "start_offset" : 11,
      "end_offset" : 14,
      "type" : "ENGLISH",
      "position" : 3
    },
    {
      "token" : "day",
      "start_offset" : 15,
      "end_offset" : 18,
      "type" : "ENGLISH",
      "position" : 4
    },
    {
      "token" : "up",
      "start_offset" : 19,
      "end_offset" : 21,
      "type" : "ENGLISH",
      "position" : 5
    },
    {
      "token" : "金庸",
      "start_offset" : 22,
      "end_offset" : 24,
      "type" : "CN_WORD",
      "position" : 6
    },
    {
      "token" : "先生",
      "start_offset" : 24,
      "end_offset" : 26,
      "type" : "CN_WORD",
      "position" : 7
    },
    {
      "token" : "贫道",
      "start_offset" : 27,
      "end_offset" : 29,
      "type" : "CN_WORD",
      "position" : 8
    },
    {
      "token" : "酸衡子",
      "start_offset" : 29,
      "end_offset" : 32,
      "type" : "CN_WORD",
      "position" : 9
    },
    {
      "token" : "敬仰",
      "start_offset" : 33,
      "end_offset" : 35,
      "type" : "CN_WORD",
      "position" : 10
    },
    {
      "token" : "大名",
      "start_offset" : 35,
      "end_offset" : 37,
      "type" : "CN_WORD",
      "position" : 11
    }
  ]
}

————————安装log stash—————
拉取镜像：docker pull logstash:7.17.5

创建数据卷：

配置目录的权限：

先临时运行一下容器，把容器里默认的config目录全部文件复制到宿主机config目录里来：

docker run --name logstash01 -d logstash:7.17.5
docker cp logstash01:/usr/share/logstash/config/ /Users/jelex/dockerV/logstash/

复制默认的pipeline目录：docker cp logstash01:/usr/share/logstash/pipeline/ /Users/jelex/dockerV/logstash/

此时logstash还没有写权限：配置下：要运行kibana-tencent容器

创建用户：拥有上述权限：logstash_writer

修改logstash配置：使用远程服务器存储：

停止上面临时启动的logstash容器：docker stop logstash01
再删除： docker rm logstash01

#启动正式的：
docker run --name logstash01 \
-p 5044:5044 -p 9600:9600 \
-v /Users/jelex/dockerV/logstash/config:/usr/share/logstash/config \
-v /Users/jelex/dockerV/logstash/data:/usr/share/logstash/data \
-v /Users/jelex/dockerV/logstash/pipeline:/usr/share/logstash/pipeline \
-d logstash:7.17.5