1、参考

1. How to Run Elasticsearch 8 on Docker for Local Development
2. Docker下elasticsearch8部署、扩容、基本操作实战(含kibana)

2、安装elasticsearch:8.6.2

2.1 创建网络

docker network create elastic

2.2 创建无密码访问的elasticsearch服务

docker run --name elasticsearch8.6.2 --net elastic -p 9200:9200 -e discovery.type=single-node -e ES_JAVA_OPTS="-Xms1g -Xmx1g" -e xpack.security.enabled=false -idt elasticsearch:8.6.2

2.3 访问验证

curl localhost:9200

2.4 建一个索引试试，此索引名为my-book，有六个字段

curl -X PUT "http://localhost:9200/my-book?pretty" \
-H 'Content-Type: application/json' \
-d'
{
  "settings": {
    "number_of_shards": 1
  },
  "mappings": {
    "properties": {
                "line_id": {
                    "type": "long"
                   },
                "line_number": {
                     "type": "keyword"
                },
               "play_name": {
                    "type": "keyword"
               },
               "speaker": {
                    "type": "keyword"
               },
               "speech_number": {
                    "type": "long"
               },
               "text_entry": {
                    "type": "text"
               }
          }
  }
}
'

2.5 用GET命令获取索引信息试试，如下，符合预期

curl -X GET http://localhost:9200/my-book
//或者
curl -X GET http://localhost:9200/my-book?pretty

2.6 再试试批量导入一笔数据，从这个地址下载数据文件

//下载数据文件
wget https://raw.githubusercontent.com/zq2599/blog_download_files/master/files/shakespeare_for_es_822.json

导入es数据

curl -H 'Content-Type: application/x-ndjson' -XPOST 'http://localhost:9200/_bulk' --data-binary @shakespeare_for_es_822.json

2.7 docker安装部署es-head查看es数据

• docker安装elasticsearch和head插件
• docker安装elasticsearch和head插件,连接失败问题解决

docker pull mobz/elasticsearch-head:5-alpine

docker run -d \
  --name=elasticsearch-head \
  --restart=always \
  -p 9100:9100 \
  mobz/elasticsearch-head:5-alpine

3、安装kibana:8.6.2

3.1 启动命令

docker run -idt --name kibana --net elastic -p 5601:5601 kibana:8.6.2

3.2 访问5601端口测试

需要输入token

3.2 生成token，kibana连接es的时候要用到

docker exec -it elasticsearch8.6.2 /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana

• 生成token报错
  ERROR: [xpack.security.enrollment.enabled] must be set to true to create an enrollment token

3.4 解决办法如下

弹出验证码

然后弹出个输入验证码的页面

获取验证码

docker exec -it kibana bin/kibana-verification-code

重新验证验证码

点击 右上角 关闭 重新验证

进入kibana

本文档配置无密码的kibana, 有密码的可以看参考中的实战的链接

• Kibana 中文文档

3. docker安装logstash

/mnt/docker/elk/logstash/config/logstash.yml

node.name: logstash862
http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.hosts: [ "http://172.16.5.103:9200" ]

/mnt/docker/elk/logstash/pipeline/logstash.conf

input {
	syslog {
		port => 5044
	}
}
filter {
    json { source => "message" }

    mutate {
        remove_field => ["message"]
        remove_field => ["host", "process", "log"]
        remove_field => ["event", "service", "@version"]

    }
}
output {
  elasticsearch {
    hosts => "172.16.5.103:9200"
    index => "threatinfo-log-%{+YYYY.MM.dd}"
  }
}

docker run -d --name logstash --net elastic -m 1000M --restart=always -p 5044:5044 --privileged=true -e ES_JAVA_OPTS="-Duser.timezone=Asia/Shanghai" -v /mnt/docker/elk/logstash/pipeline/logstash.conf:/usr/share/logstash/pipeline/logstash.conf -v /mnt/docker/elk/logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml logstash:8.6.2

• 参考：Docker 安装 Logstash

4. kibana查看数据参考

• docker-compose 搭建 ELK 7.X 并整合 SpringBoot