docker-compose部署ELK7.9.3（附帶FileBeat）

這里隨筆記錄下，docker-compose搭建7.9.3的ELK+FileBeat。
FileBeat從test.log讀取日志，然后傳給LogStash，最后給ElasticSearch，然后Kibana負責數據可視化

下面直接貼docker-compose.yml，具體的其他文件在我的GitHub

version: '3'

# 單機版本
networks:
  ash-elasticstack:
    driver: bridge

services:
  # Elastic-Search
  elasticsearch:
    image: elasticsearch:7.9.3
    container_name: elasticsearch
    environment:
      - TZ=Asia/Shanghai
      - "cluster.name=EScluster" #設置集群名稱為 EScluster
      - "discovery.type=single-node" #以單一節點模式啟動
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m" #設置使用jvm內存大小
    volumes: 
      - ./elasticsearch/es01/data:/usr/share/elasticsearch/data
      - ./elasticsearch/es01/logs:/usr/share/elasticsearch/logs
      - ./elasticsearch/es01/mydocs:/usr/share/elasticsearch/mydocs
    ports:
      - 9200:9200
      - 9300:9300
    networks: 
      - ash-elasticstack
  
  # FileBeat
  filebeat:
    image: store/elastic/filebeat:7.9.3
    hostname: filebeat
    container_name: filebeat
    volumes:
      - ./filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml
      - ./filebeat/logs:/usr/share/filebeat/logs
      - ./filebeat/mydocs:/usr/share/filebeat/mydocs
    environment:
      - TZ=Asia/Shanghai
    links:
      - logstash # 把logstash的ip記錄到該容器中
    networks: 
      - ash-elasticstack

  # LogStash
  logstash:
    image: logstash:7.9.3
    hostname: logstash
    container_name: logstash
    volumes:
      - ./logstash/config:/usr/share/logstash/config     # logstash 配置文件目錄
      - ./logstash/pipeline:/usr/share/logstash/pipeline # logstash 的采集與輸入的配置文件目錄
      - ./logstash/mydocs:/usr/share/logstash/mydocs
    environment:
      - TZ=Asia/Shanghai
      - "ES_JAVA_OPTS=-Xmx1g -Xms1g"
    links:
      - elasticsearch
    # depends_on: 
      # - elasticsearch # 在elastic-search節點01啟動后再啟動
    # ports:
      # - 5044:5044 # filebeat傳遞數據給logstash時默認使用的端口，據說這個ports設置可以沒有
    networks: 
      - ash-elasticstack

  # Kibana
  kibana:
    image: kibana:7.9.3
    hostname: kibana
    container_name: kibana
    environment:
      - TZ=Asia/Shanghai
      - "elasticsearch.hosts=http://elasticsearch:9200" #設置訪問elasticsearch的地址
    links:
      - elasticsearch
    depends_on: 
      - elasticsearch # 在elastic-search節點01啟動后再啟動
    ports:
      - 5601:5601
    networks: 
      - ash-elasticstack



#如上內容，其他容器使用links可以將mongo容器的ip記錄到該容器中, 再通過連接 mongo:27017 可以訪問數據庫。 => 這個之前查links復制過來的注解，先留着提醒自己
#通過depends_on來標記依賴關系, 當mongo服務啟動完成后, 才會啟動backend服務;