注明：新手程序員筆記，沒配置集群唱凯，先從單點(diǎn)開始熟悉功能
環(huán)境：windows，選docker是為了之后適應(yīng)線上環(huán)境部署

先去官網(wǎng)上翻了一下最新版本：8.2.2
那么整個(gè)系列都確定用一個(gè)版本
https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html

image.png

1. 啟動(dòng)elasticsearch

說明：8.2的一些配置和7不同，用7的配置可能會(huì)啟動(dòng)不起來(lái)哦

version: '3'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.2.2
    container_name: es
    privileged: true
    ulimits:
      memlock:
        soft: -1
        hard: -1
    volumes:
      - ./es/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml 
      - ./es/data:/usr/share/elasticsearch/data #數(shù)據(jù)文件掛載
      - ./es/plugins:/usr/share/elasticsearch/plugins #插件文件掛載
    ports:
      - 9200:9200
    networks:
      - esnet

networks:
  esnet:
    driver: bridge

elasticsearch.yml文件：

cluster.name: "elasticsearch" #設(shè)置集群名稱為elasticsearch
network.host: 0.0.0.0
discovery.type: single-node #以單一節(jié)點(diǎn)模式啟動(dòng)

# 是否支持跨域
http.cors.enabled: true
# 表示支持所有域名
http.cors.allow-origin: "*"
# 內(nèi)存交換的選項(xiàng)株搔，官網(wǎng)建議為true
bootstrap.memory_lock: true
# resetful端口
http.port: 9200

# xpack安全
xpack.security.enabled: false

執(zhí)行docker-compose up -d
在本地訪問：http://127.0.0.1:9200/ 確定es已經(jīng)正常運(yùn)行

2. 啟動(dòng)kibana

kibana可以理解為，類似mysql的圖形化client纯蛾，給開發(fā)用的
準(zhǔn)備配置文件：./es/kibana/config/kibana.yml

server.host: "0.0.0.0"
server.name: kibana
xpack.monitoring.ui.container.elasticsearch.enabled: true
i18n.locale: zh-CN #中文

說明：kibana-8.2.2配置文件kibana.yml中的elasticsearch.hosts字段不需要填寫

kibana:
    image: docker.elastic.co/kibana/kibana:8.2.2
    container_name: kibana
    volumes:
      - ./kibana/config/kibana.yml:/usr/share/kibana/config/kibana.yml
    ports:
      - "5601:5601"
    depends_on:
      - elasticsearch #kibana在elasticsearch啟動(dòng)之后再啟動(dòng)      
    networks:
      - esnet

執(zhí)行docker-compose up -d
在本地訪問：http://127.0.0.1:5601/ 確定kibana已經(jīng)正常運(yùn)行
首次啟動(dòng)ikbana需要配置它對(duì)應(yīng)的ES纤房，選擇手動(dòng)配置：http://elasticsearch:9200
說明：這個(gè)地方的訪問地址，要根據(jù)kibana容器內(nèi)訪問es的地址來(lái)配置翻诉。因?yàn)橛昧薲ocker-compose所以千萬(wàn)不能寫成：127.0.0.1:9200炮姨，還有注意是http不是https。
配置后提示需要輸入一個(gè)安全碼碰煌，進(jìn)入kibana的容器舒岸，運(yùn)行獲得

$ docker exec -it kibana sh
$ cd /usr/share/kibana/bin
$ kibana-verification-code
Your verification code is:  273 883

3. Logstash

只是先跟著教程安裝了一個(gè)，具體怎么用不清楚

logstash:
    image: docker.elastic.co/logstash/logstash:8.2.2
    container_name: logstash
    environment:
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m" #限制內(nèi)存
    ports:
      - 5044:5044
    volumes:
      - ./logstash/config/logstash.yml:/usr/share/logstash/config/logstash.yml
      - ./logstash/pipeline:/usr/share/logstash/pipeline
    depends_on:
      - elasticsearch #logstash在elasticsearch啟動(dòng)之后再啟動(dòng)
    networks:
      - esnet

logstash.yml

http.host: "0.0.0.0"

pipleline/logstash.conf

input {
  file {
    path => "/usr/share/logstash/pipeline/data/movies.csv"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
}
filter {
  csv {
    separator => ","
    columns => ["id","content","genre"]
  }

  mutate {
    split => { "genre" => "|" }
    remove_field => ["path", "host","@timestamp","message"]
  }

  mutate {

    split => ["content", "("]
    add_field => { "title" => "%{[content][0]}"}
    add_field => { "year" => "%{[content][1]}"}
  }

  mutate {
    convert => {
      "year" => "integer"
    }
    strip => ["title"]
    remove_field => ["path", "host","@timestamp","message","content"]
  }

}
output {
   elasticsearch {
     hosts => "http://elasticsearch:9200" # 要配置成docker內(nèi)訪問的
     index => "movies"
     document_id => "%{id}"
   }
  stdout {}
}

4. Cerebro安裝

可以簡(jiǎn)單理解為芦圾，給運(yùn)維看的

 cerebro:
    image: lmenezes/cerebro:0.8.3
    container_name: cerebro
    ports:
      - "9100:9000"
    depends_on:
      - elasticsearch #logstash在elasticsearch啟動(dòng)之后再啟動(dòng)
    networks:
      - esnet