Shulou(Shulou.com)06/02 Report--

Use Docker to quickly deploy an ELK environment (the latest version 5.5.1)

Docker pull docker.elastic.co/elasticsearch/elasticsearch:5.5.1docker pull docker.elastic.co/kibana/kibana:5.5.1docker pull docker.elastic.co/logstash/logstash:5.5.1123

Start the Elastic Search container:

Docker run-p 9200 transport.host=127.0.0.1 9200-e "http.host=0.0.0.0"-e "transport.host=127.0.0.1"\-- name my-elastic-d docker.elastic.co/elasticsearch/elasticsearch:5.5.112

Start the Kibana container:

Docker run-p 5601 name my-kibana 5601-e "ELASTICSEARCH_URL= http://localhost:9200"-- name my-kibana\-- network host-d docker.elastic.co/kibana/kibana:5.5.112

Create logstash/logstash.yml and configure xpack to monitor logstash:

Http.host: "0.0.0.0" path.config: / usr/share/logstash/pipelinexpack.monitoring.elasticsearch.url: http://localhost:9200xpack.monitoring.elasticsearch.username: elasticxpack.monitoring.elasticsearch.password: changeme12345

Create a logstash/conf.d/logstash.conf and configure the input and output of the logstash:

Input {file {path = > "/ tmp/access_log" start_position = > "beginning"} output {elasticsearch {hosts = > ["localhost:9200"] user = > "elastic" password = > "changeme"} 12345678910111213

Start the Logstash container:

Docker run-v / home/ubuntu/logstash/conf.d:/usr/share/logstash/pipeline/:ro-v / tmp:/tmp:ro\-v / home/ubuntu/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml:ro-- name my-logstash\-- network host-d docker.elastic.co/logstash/logstash:5.5.1123

To test it, add two lines of information to / tmp/access.log:

Echo "Hello World!" > > / tmp/access_logecho "Hello ELK!" > > / tmp/access_log12

Open the link http://yourhost:5601 of kibana and log in with username / password: elastic/changeme. Click the Create button on the "Configure an index pattern" page. Click the menu Monitor to view the status of the ELK node

Click the Discover menu in Kibana to see the relevant log information:

Using Elastic Search cluster deployment

Elastic officially provides a way to start an Elastic Search cluster with docker-compose. Install docker-compose first.

Curl-L https://github.com/docker/compose/releases/download/1.15.0/docker-compose-Linux-x86_64\ > / usr/local/bin/docker-composesudo chmod + x / usr/local/bin/docker-composedocker-compose-- version1234

Create an elasticsearch/docker-compose.yml file:

Version: '2'services: elasticsearch2: image: docker.elastic.co/elasticsearch/elasticsearch:5.5.1 container_name: elasticsearch2 environment:-cluster.name=docker-cluster-bootstrap.memory_lock=true-"ES_JAVA_OPTS=-Xms512m-Xmx512m" ulimits: memlock: soft:-1 hard:-1 mem_limit: 1g volumes:-esdata1:/usr/share/elasticsearch / data ports:-9200 networks:-esnet elasticsearch3: image: docker.elastic.co/elasticsearch/elasticsearch:5.5.1 environment:-cluster.name=docker-cluster-bootstrap.memory_lock=true-"ES_JAVA_OPTS=-Xms512m-Xmx512m"-"discovery.zen.ping.unicast.hosts=elasticsearch2" ulimits: memlock: soft:-1 hard:-1 Mem_limit: 1g volumes:-esdata2:/usr/share/elasticsearch/data networks:-esnetvolumes: esdata1: driver: local esdata2: driver: localnetworks: esnet:123456789101112131415161718192021222324252627282930313233343536373839404142434445

Append a line to the / etc/sysctl.conf file

Vm.max_map_count = 2621441

Execute the command to apply the changes:

Sudo sysctl-p1

Start the elastic search cluster by executing the following command in the directory where docker-compose.yml is located:

Docker stop my-elastic & & docker rm my-elasticdocker-compose up & 12

From the Monitor menu in Kibana, you can see that the Elastic Search cluster is working properly:

Change the default password

The default account password for Elastic Docker Images is elastic/changeme. It is not safe to use the default password. Suppose you want to change the password to elastic0. Execute the command on the server where Docker resides to change the password of user elastic:

Curl-XPUT-u elastic 'localhost:9200/_xpack/security/user/elastic/_password'-H "Content-Type: application/json"\-d' {"password": "elastic0"}' 1234

Set the password and restart Kibana:

Docker stop my-kibana & & docker rm my-kibanadocker run-p 5601 docker rm my-kibanadocker run 5601-e "ELASTICSEARCH_URL= http://localhost:9200"-e" ELASTICSEARCH_PASSWORD=elastic0 "\-- name my-kibana-- network host-d docker.elastic.co/kibana/kibana:5.5.1123

Change the password in logstash/logstash.yml,logstash/conf.d/logstash.conf and restart the logstash service

Docker restart my-logstash2

To test it, add two lines of information to / tmp/access.log:

Echo "Hello World!" > > / tmp/access_logecho "Hello ELK!" > > / tmp/access_log12

Open the link http://yourhost:5601 of kibana and log in with username / password: elastic/elastic0. Click the Create button on the "Configure an index pattern" page. Click the menu Monitor to view the status of the ELK node. The default password has been modified successfully.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.